Authentication system and method based upon random partial digitized path recognition

• US 7,073,067 B2
• Filed: 05/07/2003
• Issued: 07/04/2006
• Est. Priority Date: 05/07/2003
• Status: Active Grant

• Current Assignee: Authernative
• Original Assignee: Authernative
• Inventors: Mizrah, Len L.
• Primary Examiner(s): Louis-Jacques, Jacques H.
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US10/431,412
• Publication Number:
  US 20040225899A1
• Time in Patent Office: 1,154 Days
• Field of Search: 713183-185, 713/161
• US Class Current: 713/183
• CPC Class Codes: G06F 21/31 User authentication

Abstract

An authentication server provides a clue to a client indicating a random partial subset of a full pattern that characterizes a full digitized path on a frame of reference, and the client enters a data to fulfill an authentication factor suggested by the clue. The full pattern consists of an ordered set of data fields, which store parameters that specify the full digitized path on a reference grid for recognition. The server presents an instance of a graphical representation of the frame of reference, including an array of random indicators at data field coordinates in the frame of reference. The server accepts indicators from the array of indicators corresponding to coordinates along said digitized path identified by the random partial subset as input data to fulfill the authentication factor.

Claims

1. An interactive method for authentication of a client, comprising:

storing data defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including pre-defined locations in the frame of reference having coordinates on the frame of reference;

storing a data set in a memory, the data set including a plurality of data fields having respective positions in said data set and having field contents identifying a plurality of said pre-defined locations having an order with coordinates along a digitized directional path known to the client on the frame of reference;

identifying to the client via a data communication medium, positions of a random partial subset of data fields in said data set;

accepting input data from the client via a data communication medium, corresponding to coordinates on the frame of reference of a partial subset of said plurality of pre-defined locations along said digitized path, the partial subset of said plurality of pre-defined locations being identified by the positions of the data fields in the random partial subset of said data set; and

determining whether the input data matches the pre-defined locations identified by the field contents of data fields in the random partial subset, and if the input data matches, signaling successful authentication, and if the input data does not match, signaling failed authentication.

2. The method of claim 1, including presenting an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and wherein said input data includes said indicators.

3. The method of claim 1, including presenting an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and wherein said input data includes said indicators, wherein said indicators comprise alphanumeric characters.

4. The method of claim 1, including presenting an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and said input data includes said indicators, wherein said indicators are randomly or pseudo-randomly generated by a server so that the instance presented uses different indicators in said pre-defined locations than are used in other instances of the graphical representation.

5. The method of claim 1, including presenting to the client from a server via a data communication medium, an input construct for entry of data corresponding to field contents of said random partial subset of data fields from the data set, and wherein said accepting input data from the client includes accepting data based on said input construct.

6. The method of claim 1, including presenting to the client from a server via a data communication medium, a graphical user interface including an input construct facilitating input of data corresponding to said positions by the client wherein said input construct comprises an instance of a graphical representation of said frame of reference having an array of indicators said pre-defined locations on the frame of reference, and input fields for inserting indicators from said array of indicators corresponding to said random partial subset.

7. The method of claim 1, including presenting to the client an input construct for account set up, and accepting data from the client based on the input construct, to set field contents for the data fields in the data set.

8. The method of claim 1, including presenting to the client an input construct for account set up, and accepting data from the client based on the input construct, to set field contents for the data fields in the data set, wherein the input construct includes a graphical representation of said frame of reference.

9. The method of claim 1, wherein said digitized path on the frame of reference includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, and wherein the field contents of data fields in said data set respectively identify the first set of said pre-defined locations and the additional sets of said pre-defined locations, and the positions of data fields in said data set correspond to said order.

10. The method of claim 1, wherein said digitized path includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, wherein said first set of said pre-defined locations and said sequence of additional sets of said pre-defined locations consist of a continuous digitized path on said frame of reference.

11. The method of claim 1, wherein said digitized path includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, wherein said first set of said pre-defined locations and said sequence of additional sets of said pre-defined locations consist of a non-continuous digitized path on said frame of reference.

12. The method of claim 1, wherein said digitized path on the frame of reference has a predetermined number of sets of said pre-defined locations, and includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order set by the client to define the full digitized path.

13. The method of claim 1, including selecting instances of said random partial subset at a server, wherein said instances include a variable number of positions of data fields in said data set.

14. The method of claim 1, including identifying positions of data fields for a plurality of random partial subsets of said data set.

15. The method of claim 1, including providing a session timer, and including disabling a client session if an elapsed time exceeds a threshold before an authentication event in a client session.

16. The method of claim 1, including:

displaying an icon during said identifying, accepting and determining, said icon having a first state during said identifying, a second state after said accepting, and a third state after said determining.

17. The method of claim 1, including:

displaying a stop light icon during said identifying, accepting and determining, said icon displaying a red light during said identifying, displaying a yellow light after said accepting, and displaying a green light after said determining.

18. The method of claim 1, wherein said client provides input data in a client system coupled to communication media.

19. The method of claim 1, wherein said client provides input data in a client system, including a browser coupled to communication media.

20. The method of claim 1, including:

detecting an attempt to access a network resource by the user;

presenting, in response to the detected attempt to access a protected network resource, an interface to the client via a data communication medium, the interface supporting said indicating and said accepting; and

if the input data matches, signaling authentication of the client.

21. The method of claim 20, wherein said interface includes an instance of a graphical representation of the frame of reference, including an array of indicators at said pre-defined locations in the frame of reference, and said input data includes said indicators.

22. An authentication system for a client, comprising:

data processing resources, including a processor, memory and a communication interface;

data stored in said memory defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including pre-defined locations in the frame of reference having coordinates on the frame of reference;

user account information stored in said memory, including for respective clients a data set including a plurality of data fields having respective positions in said data set and having field contents a plurality of said pre-defined locations having an order with coordinates along a digitized directional path known to the client on the frame of reference;

an authentication server adapted for execution by the data processing resources, including logic to identify to the client via the communication interface, positions in said data set of a random partial subset of data fields from said data set, logic to accept input data from the client via the communication interface, corresponding to coordinates on the frame of reference of a partial subset of said plurality of pre-defined locations, the partial subset of said plurality of pre-defined locations being identified by the positions of the data fields in the random partial subset, and logic to determine whether the input data matches the field contents of corresponding data fields in the random partial subset wherein the authentication server includes logic which if the input data matches, signals successful authentication, and if the input data does not match, signal failed authentication.

23. The system of claim 22, wherein the authentication server includes logic to present an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and said input data includes said indicators.

24. The system of claim 22, wherein the authentication server includes logic to present an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and said input data includes said indicators, wherein said indicators comprise alphanumeric characters.

25. The system of claim 22, wherein the authentication server includes logic to present an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and said input data includes said indicators, and logic to randomly or pseudo-randomly generate said array of indicators so that the instance presented uses different indicators than are used in other instances of the graphical representation.

26. The system of claim 22, wherein the authentication server includes logic to present said graphical user interface including an input construct facilitating input of data corresponding to said data field positions by the client, wherein said input construct comprises an instance of said frame of reference having an array of indicators at said pre-defined locations on the frame of reference, and input fields for inserting indicators from said array of indicators corresponding to said random partial subset.

27. The system of claim 22, including logic to present to the client an input construct for account set up, and to accept data from the client based on the input construct, to set field contents for the data fields in said data set wherein the input construct includes an instance of a graphical representation of said frame of reference.

28. The system of claim 22, wherein said a full digitized path on the frame of reference includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, and wherein the field contents of data fields in said data set respectively identify the first set of said pre-defined locations and the additional sets of said pre-defined locations, and the positions of data fields in said data set correspond to said order.

29. The system of claim 22, wherein said digitized path includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, wherein said first set of said pre-defined locations and said sequence of additional sets of said pre-defined locations consist of a continuous digitized path on said frame of reference.

30. The system of claim 22, wherein said digitized pat includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, wherein said first set of said pre-defined locations and said sequence of additional sets of said pre-defined locations consist of a non-continuous digitized path on said frame of reference.

31. The system of claim 22, wherein said full digitized path on the frame of reference characterized by a predetermined number of sets of said pre-defined locations and includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order set by the client to define the digitized path.

32. The system of claim 22, wherein the authentication server includes logic to generate instances of said random partial subset, wherein said instances include a variable number of positions of data fields in said data set.

33. The system of claim 22, wherein the authentication server includes logic to identify positions of data fields for a plurality of random partial subsets of said data set in a client session.

34. The system of claim 22, including logic to present to the client an input construct for account set up, and to accept data from the client based on the input construct, to set field contents for the data fields in the data set.

35. The system of claim 22, including logic to present to the client a graphical input construct for entry of field contents of said random subset of data fields.

36. The system of claim 22, including logic to provide a session timer, and logic to disable a client session if an elapsed time exceeds a threshold before an authentication event in client session.

37. The system of claim 22, wherein said authentication server includes logic to display an icon, said icon, having a first state during an initial stage of a client session, a second state after accepting input data, and a third state after determining whether the input data matches.

38. The system of claim 22, wherein said authentication server includes logic to display a stop light icon, said icon displaying a red light during an initial stage of a client session, displaying a yellow light after accepting input data, and displaying a green light after determining whether the input data matches.

39. An article storing computer programs supporting an authentication system for a client, comprising:

a machine readable data storage medium storing data defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including pre-defined locations in the frame of reference having coordinates on the frame of reference;

a machine readable data storage medium storing user account information, including for respective clients a data set including a plurality of data fields having respective positions in said data set and having field contents identifying a plurality of said pre-defined locations having an order with coordinates along a digitized directional path known to the client on the frame of reference, and

a machine readable data storage medium storing computer programs executable by a data processor including logic to identify to the client via the communication interface, positions in said data set of a random partial subset of data fields from said data set, logic to accept input data from the client via the communication interface, corresponding to coordinates on the frame of reference of a partial subset of said plurality of pre-defined locations, the partial subset of said plurality of pre-defined locations being identified by the positions of the data fields in the random partial subset, and logic to determine whether the input data matches the field contents of corresponding data fields in the random partial subset, and if the input data matches, signaling successful authentication, and if the input does not match, signaling failed authentication.