Method and apparatus utilizing dynamic questioning to provide secure access control

• US 5,774,525 A
• Filed: 08/14/1997
• Issued: 06/30/1998
• Est. Priority Date: 01/23/1995
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Zadrozny, Wlodek Wlodzimierz, Kanevsky, Dimitri, Yung, Marcel Mordechay
• Primary Examiner(s): Tsang, Fan S.
• Application Number:
  US08/911,259
• Time in Patent Office: 320 Days
• Field of Search: 379/67, 379/88, 379/89, 379/201, 379/188, 379/196, 379/197, 379/198, 379/199, 395/153, 395/154, 395/155, 395/161, 395/2.79, 395/2.82, 380/4, 380/23, 380/24, 380/25
• US Class Current: 379/88.02
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04M 3/382 using authorisation codes or passwords
• CPC Class Codes: H04M 3/493 Interactive information services, e.g. directory enquiries ; Arrangements therefor, e.g. interactive voice response [IVR] systems or voice portals

Abstract

A method and corresponding apparatus utilizes questioning to provide secure access control including the steps of storing information in a database; generating at least one question based upon the information stored in the data base; communicating to the user the generated question(s); receiving a response associated with the question(s), interpreting the response to determine whether the response conforms to the information upon which is based the associated question(s); and outputting an authorization status indicating whether or not the user is authorized for access according to the determination. The question(s) concerns a relationship among portions of information contained in said data base. This feature is advantageous because it protects against an eavesdropper gaining access to the service or facility and provides the capability of generating a relatively large number of different questions from a small data base. Furthermore, the questions asked of the user may be based on dynamic data, which advantageously protects against eavesdroppers gaining access to the service or facility. In addition, the number and/or type of questions generated by the first module may correspond to a security level of the system. The security level may be set by the service or facility, or may be set the system control module according to user input.

Claims

1. An apparatus for controlling access to a service or facility according to answers provided by a user in response to questions asked of the user, said apparatus comprising:

a data base storing information;

a first module that generates at least one question based upon said information stored in said data base, wherein said at least one question concerns an arithmetic relationship among portions of information contained in said data base, and wherein said at least one question does not explicitly disclose said portions of information contained in said database; and

means for communicating to the user said at least one question generated by said first module.

2. The apparatus of claim 1, further comprising:

means for receiving a response associated with said at least one question, wherein said response is generated by the user; and

a second module that interprets said response to determine whether said response conforms to said information upon which is based the associated at least one question.

3. The apparatus of claim 2, further comprising a system control module that outputs an authorization status indicating whether or not the user is authorized for access according to the determination made by said second module.

4. The apparatus of claim 1, wherein said first module generates a number of questions to be asked of the user, wherein said number corresponds to a security level of said apparatus.

5. The apparatus of claim 1, wherein said first module generates a plurality of questions each having an associated security level, wherein cumulative security level of said plurality of questions corresponds to a security level of said apparatus.

6. The apparatus of claim 2, wherein said response is spoken voice and said second module further comprises a speech recognition module for processing said response.

7. The apparatus of claim 2, wherein said response is handwriting and said second module further comprises a handwriting recognition module for processing said response.

8. The apparatus of claim 3, wherein upon receiving said authorization status indicating the user is authorized for access, said first module generates at least one new question, and said second module updates said data base according to a response associated with said at least one new question.

9. The apparatus of claim 1, wherein said information stored in said data base includes static and dynamic information.

10. A method for controlling access to a service or facility according to answers provided by a user in response to questions asked of the user, the method comprising the steps of:

controlling a first module to generate at least one question based upon data stored in a data base, wherein said at least one question concerns an arithmetic relationship among portions of information contained in said data base, and wherein said at least one question does not explicitly disclose said portions of information contained in said database;

communicating to the user said at least one question;

receiving a response associated with said at least one question, wherein said response is generated by the user;

controlling a second module to interpret said response to determine whether said response conforms to said data upon which is based the associated at least one question; and

outputting an authorization status indicating whether or not the user is authorized for access according to the determination made by said second module.

11. The method of claim 10, wherein said first module generates a plurality of questions each having an associated security level, wherein cumulative security level of said plurality of questions corresponds to a system security level.

12. The method of claim 10, wherein said response is spoken voice and said second module further comprises a speech recognition module for processing said response.

13. The method of claim 10, wherein said response is handwriting and said second module further comprises a handwriting recognition module for processing said response.

14. The method of claim 10, further comprising the steps of:

upon receiving said authorization status indicating the user is authorized for access, controlling said first module to generate at least one new question, and controlling said second module to update said data base according to a response associated with said at least one new question.

15. The method of claim 10, wherein said information stored in said data base includes static and dynamic information.

16. The method of claim 10, wherein said first module generates a number of questions to be asked of the user, wherein said number corresponds to a security level.