Authentication system and method based upon random partial pattern recognition

• US 7,644,433 B2
• Filed: 12/23/2002
• Issued: 01/05/2010
• Est. Priority Date: 12/23/2002
• Status: Active Grant

• Current Assignee: Authernative
• Original Assignee: Authernative
• Inventors: Mizrah, Len L.
• Primary Examiner(s): LaForgia; Christian
• Assistant Examiner(s): Homayounmehr; Farid
• Application Number:
  US10/328,640
• Publication Number:
  US 20040123160A1
• Time in Patent Office: 2,570 Days
• Field of Search: 726/1, 726/2
• US Class Current: 726/2
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

An interactive client-server authentication system and method are based on Random Partial Pattern Recognition algorithm (RPPR). In RPPR, an ordered set of data fields is stored for a client to be authenticated in secure memory. An authentication server presents a clue to the client via a communication medium, such positions in the ordered set of a random subset of data fields from the ordered set. The client enters input data in multiple fields according to the clue, and the server accepts the input data from the client via a data communication medium. The input data corresponds to the field contents for the data fields at the identified positions of the random subset of data fields. The server then determines whether the input data matches the field contents of corresponding data fields in a random subset.

Claims

1. An interactive method for authentication of a client, comprising:

storing an ordered set of data fields in a memory, data fields in said ordered set including respective field contents, the field contents in the data fields in the ordered set including at least one data object, and the field contents in at least one of the data fields in the ordered set including more than one data object;

sending an authentication challenge to the client via a data communication medium, identifying positions in said ordered set of a random subset of data fields from said ordered set;

accepting an authentication response from the client via a data communication medium, the authentication response including input data identifying data objects corresponding to field contents for corresponding data fields in the random subset of the stored ordered set; and

determining whether the input data matches the field contents of corresponding data fields in the random subset.

2. The method of claim 1, including if the input data matches, signaling successful authentication, and if the input data does not match, signaling failed authentication.

3. The method of claim 1, wherein the respective field contents for data fields in the ordered set includes data objects recognizable as a function of the respective positions of corresponding data fields in said ordered set.

4. The method of claim 1, including presenting to the client an input construct for account set up including tools for entering selected data objects, and accepting data identifying selected data objects from the client based on the input construct, to set field contents for the data fields in the ordered set.

5. The method of claim 1, including presenting to the client an input construct for account set up including tools for entering selected data objects, and accepting data identifying selected data objects from the client based on the input construct, to set field contents for the data fields in the ordered set, wherein the input construct enables the client to supply data identifying selected data objects that comprise alphanumeric characters, images and colors.

6. The method of claim 1, including presenting to the client an input construct for account set up including tools for entering selected data objects, and accepting data identifying selected data objects from the client based on the input construct, to set field contents for the data fields in the ordered set, wherein said input construct identifies said ordered set of fields according to an order of said ordered set facilitating use of a function of said order to define said field contents.

7. The method of claim 1, wherein the respective field contents for data fields in the ordered set include respective sets of data objects based on a cognitive function of the respective positions of corresponding data fields in said ordered set.

8. The method of claim 1, including presenting to the client an input construct for entry of field contents of said random subset of data fields including tools for entering selected data objects, and wherein said accepting input data from the client includes accepting the selected data objects based on said input construct.

9. The method of claim 1, including presenting to the client an input construct for entry of field contents of said random subset of data fields including tools for entering selected data objects, and wherein said accepting input data from the client includes accepting data identifying selected objects based on said input construct, said input construct including tools enabling the client to supply data identifying selected data objects that comprise one or more of alphanumeric characters, images and colors.

10. The method of claim 1, including presenting to the client an input construct for entry of field contents of said random subset of data fields including tools for entering selected data objects, and wherein said accepting input data from the client includes accepting data identifying selected objects based on said input construct, said input construct including tools enabling the client to supply data identifying selected data objects that comprise a menu presenting an ordered set of candidate images.

11. The method of claim 1, including presenting to the client an input construct for entry of field contents of said random subset of data fields including tools for entering selected data objects, and wherein said accepting input data from the client includes accepting data identifying selected objects based on said input construct, said input construct including tools enabling the client to supply data identifying selected data objects that comprise a menu presenting an ordered set of candidate colors.

12. The method of claim 1, including presenting to the client an input construct for entry of field contents of said random subset of data fields including tools for entering selected data objects, and wherein said accepting input data from the client includes accepting data identifying selected objects based on said input construct, said input construct including tools enabling the client to supply data identifying selected data objects that comprise a window for entry of alphanumeric characters, a menu presenting an ordered set of candidate colors and a menu presenting an ordered set of candidate images.

13. The method of claim 1, including presenting to the client an input construct for account set up including tools for entering selected data objects, and accepting data identifying selected objects from the client based on the input construct, to set field contents for the data fields in the ordered set, wherein said input construct including tools enabling the client to supply data identifying selected data objects that comprise a window for entry of alphanumeric characters, a menu presenting an ordered set of candidate colors and a menu presenting an ordered set of candidate images.

14. The method of claim 1, including providing a session timer.

15. The method of claim 1, including providing a session timer, and including disabling a client session if an elapsed time exceeds a threshold before said input data is accepted for all fields in said random subset.

16. The method of claim 1, wherein said client provides input data in a client system coupled to communication media.

17. The method of claim 1, wherein said client provides input data in a client system, including a browser coupled to communication media.

18. An authentication system for a client, comprising:

data processing resources, including a processor, memory and a communication interface;

user account information stored in said memory, including for respective clients an ordered set of data fields in a memory, data fields in said ordered set including respective field contents, the field contents in the data fields in the ordered set including at least one data object, and the field contents in at least one of the data fields in the ordered set including more than one data object;

an authentication server adapted for execution by the data processing resources, including logic to send an authentication challenge to the client via communication interface, identifying positions in said ordered set of a random subset of data fields from said ordered set;

logic to accept an authentication response from the client via the communication interface, the authentication response including input data identifying data objects corresponding to field contents for corresponding data fields in the random subset of the stored ordered set; and

logic to determine whether the input data matches the field contents of corresponding data fields in the random subset.

19. The system of claim 18, wherein the authentication server includes logic which if the input data matches, signals successful authentication, and if the input data does not match, signals failed authentication.

20. The system of claim 18, wherein the respective field contents for data fields in the ordered set includes data objects recognizable as a function of the respective positions of corresponding data fields in said ordered set.

21. The system of claim 18, including logic to present to the client an input construct for account set up including tools for entering selected data objects, and to accept data identifying selected data objects from the client based on the input construct, to set field contents for the data fields in the ordered set.

22. The system of claim 18, including logic to present to the client an input construct for account set up including tools for entering selected data objects, and to accept data identifying selected data objects from the client based on the input construct, to set field contents for the data fields in the ordered set, wherein the input construct enables the client to supply data identifying selected data objects that comprise alphanumeric characters, images and colors.

23. The system of claim 18, including logic to present to the client an input construct for account set up including tools for entering selected data objects, and to accept data identifying selected data objects from the client based on the input construct, to set field contents for the data fields in the ordered set, wherein said input construct identifies said ordered set of fields according to an order of said ordered set facilitating use of a function of said order to define said field contents.

24. The system of claim 18, wherein the respective field contents for data fields in the ordered set include respective sets of data objects based on a cognitive function of the respective positions of corresponding data fields in said ordered set.

25. The system of claim 18, including logic to present to the client a graphical input construct for entry of field contents of said random subset of data fields.

26. The system of claim 18, including logic to present to the client an input construct for entry of field contents of said random subset of data fields including tools for entering selected data objects, said input construct including tools enabling the client to supply data identifying selected data objects that comprise one or more of alphanumeric characters, images and colors.

27. The system of claim 18, including logic to present to the client an input construct for entry of field contents of said random subset of data fields including tools for entering selected data objects, said input construct including tools enabling the client to supply data identifying selected data objects that comprise a menu presenting an ordered set of candidate images.

28. The system of claim 18, including logic to present to the client an input construct for entry of field contents of said random subset of data fields including tools for entering selected data objects, said input construct including tools enabling the client to supply data identifying selected data objects that comprise a menu presenting an ordered set of candidate colors.

29. The system of claim 18, including logic to present to the client an input construct for entry of field contents of said random subset of data fields including tools for entering selected data objects, said input construct including tools enabling the client to supply data identifying selected data objects that comprise a window for entry of alphanumeric characters, a menu presenting an ordered set of candidate colors and a menu presenting an ordered set of candidate images.

30. The system of claim 18, including logic to present to the client an input construct for account set up fields including tools for entering selected data objects, and to accept data identifying selected data objects from the client based on the input construct, to set field contents for the data fields in the ordered set, wherein said input construct including tools enabling the client to supply data identifying selected data objects that comprise a window for entry of alphanumeric characters, a menu presenting an ordered set of candidate colors and a menu presenting an ordered set of candidate images.

31. The system of claim 18, including logic to provide a session timer.

32. The system of claim 18, including logic to provide a session timer, and logic to disable a client session if an elapsed time exceeds a threshold before said input data is accepted for all fields in said random subset.

33. An interactive method for authentication of a client, comprising:

storing a full pattern in a memory, the full pattern comprising an ordered set of data fields, data fields in said ordered set including respective field contents, the field contents in the data fields in the ordered set including at least one data object, and the field contents in at least one of the data fields in the ordered set including more than one data object;

upon a request for access to online resources, determining a random partial pattern based on the full pattern, the random partial pattern changing from request to request;

presenting to the client via a data communication medium, an authentication challenge including a clue concerning entry of said random partial pattern, wherein said random partial pattern includes a set of one or more data fields suggested by the clue, said one or more data fields including respective field contents;

accepting an authentication response from the client via a data communication medium, the authentication response including input data identifying data objects corresponding to field contents for corresponding data fields in said set of one or more data fields suggested by the clue; and

determining whether the input data matches the field contents of said set of one or more data fields of the random partial pattern.

34. The method of claim 33, wherein the full pattern comprises an ordered set of data fields, data fields in said ordered set including respective field contents, and wherein said clue comprises a random position in said ordered set.

35. The method of claim 33, wherein the full pattern comprises an ordered set of data fields, data fields in said ordered set including respective field contents, and wherein said clue comprises positions in said ordered set of a random subset of data fields from said ordered set.

36. The method of claim 33, comprising:

presenting said clue to the client via a data display device of the client.