SYSTEM ACCESS DETERMINATION BASED ON CLASSIFICATION OF STIMULI

• US 20110314559A1
• Filed: 06/15/2011
• Published: 12/22/2011
• Est. Priority Date: 06/16/2010
• Status: Active Grant

• Current Assignee: RavenWhite Security, Inc. (Bjorn Markus Jakobsson)
• Original Assignee: RavenWhite Security, Inc. (Bjorn Markus Jakobsson)
• Inventors: Jakobsson, Bjorn Markus
• Granted Patent: US 9,432,199 B2
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

An authentication system is disclosed. Information associated with at least one of a user'"'"'s use of a resource and demographic information associated with the user is collected. The collected information is processed to determine one or more stimuli to be presented to the user. The collected information is processed to determine one or more stimuli to be presented to the user. Classification data provided by the user is stored. Classification data associated with the user is received. The received classification data is compared to the stored classification data. A determination of whether to authorize an action based at least in part on the comparison is determined.

Claims

1. An authentication system, comprising:

a processor configured to;

collect information associated with at least one of a user'"'"'s use of a resource and demographic information associated with the user;

process the collected information to determine one or more stimuli to be presented to the user;

store classification data provided by the user;

receive classification data associated with the user;

compare the received classification data to stored classification data; and

determine whether to authorize an action based at least in part on the comparison; and

a memory coupled to the processor and configured to the processor to provide the processor with instructions.

2. The system of claim 1 wherein the resource comprises a purchase history.

3. The system of claim 1 wherein the resource comprises a browser history.

4. The system of claim 1 wherein the resource comprises the playback of audio.

5. The system of claim 1 wherein the resource comprises the playback of video.

6. The system of claim 1 wherein the resource comprises an IP address.

7. The system of claim 1 wherein the demographic information comprises an age of the user.

8. The system of claim 1 wherein the demographic information comprises a gender of the user.

9. The system of claim 1 wherein the classification comprises an indication of whether the user finds a stimulus to be funny.

10. The system of claim 1 wherein the classification comprises an indication of whether the user finds a stimulus to be scary.

11. The system of claim 1 wherein the classification comprises an indication of whether the user owns the stimulus.

12. The system of claim 1 wherein the classification comprises an indication of whether the user has ever been to the stimulus.

13. The system of claim 1 wherein the classification comprises an indication of whether the user recognizes the stimulus.

14. The system of claim 1 wherein the action includes a password reset request.

15. The system of claim 1 wherein the action includes receiving access to a service.

16. The system of claim 1 wherein the interface is configured to receive at least some of the received classification data acoustically.

17. The system of claim 1 wherein the received data and stored data are of different types.

18. The system of claim 1 wherein determining whether to authorize an action includes computing a score based at least in part on the comparison and determining whether the score exceeds a threshold.

19. The system of claim 18 wherein the threshold is determined based at least in part on an entropy score.

20. The system of claim 1 further comprising an enrollment interface configured to capture a plurality of classifications.

21. The system of claim 20 wherein the enrollment interface is configured to display stimuli of a plurality of types.

22. The system of claim 20 wherein the enrollment interface is further configured to provide an audio sample.

23. The system of claim 1 wherein the classification data is received in conjunction with a checkout process.

24. The system of claim 1 wherein the classification data is received as a probabilistic security check.

25. The system of claim 24 wherein the processor is further configured to determine an outbreak of malicious software.

26. A method, comprising:

collect information associated with at least one of a user'"'"'s use of a resource and demographic information associated with the user;

process the collected information to determine one or more stimuli to be presented to the user;

store classification data provided by the user;

receive classification data associated with the user;

compare the received classification data to stored classification data; and

determine whether to authorize an action based at least in part on the comparison.

27. A computer program product embodied in a tangible computer readable storage medium and comprising computer instructions for:

collect information associated with at least one of a user'"'"'s use of a resource and demographic information associated with the user;

process the collected information to determine one or more stimuli to be presented to the user;

store classification data provided by the user;

receive classification data associated with the user;

compare the received classification data to stored classification data; and

determine whether to authorize an action based at least in part on the comparison.