Authentication method of field contents based challenge and enumerated pattern of field positions based response in random partial digitized path recognition system

• US 8,868,919 B2
• Filed: 10/23/2012
• Issued: 10/21/2014
• Est. Priority Date: 10/23/2012
• Status: Active Grant

• Current Assignee: Authernative
• Original Assignee: Authernative
• Inventors: Barton, Edward M., Mizrah, Len L.
• Primary Examiner(s): Williams, Jeffery
• Assistant Examiner(s): Zhu, Zhimei
• Application Number:
  US13/658,800
• Publication Number:
  US 20140115670A1
• Time in Patent Office: 728 Days
• Field of Search: 713182-185, 726 2- 21
• US Class Current: 713/182
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

An interactive method for authentication is based on a shared secret which is in the form of an enumerated pattern of fields on a frame of reference. An instance of the frame of reference comprises an array of characters in which the characters are arranged in a random or other irregular pattern on a grid of content fields. An authentication challenge includes characters from the character set, and is delivered in- or out-of-band. The authentication response includes the enumerated position numbers on the enumerated pattern of the field locations on the grid at which the challenge characters are found.

Claims

1. A method for identification and verification of a user at a client platform in a client/server, computer-networking system that implements an authentication server, the method using an authentication credential as a shared secret with the authentication server, the authentication credential comprising a data set identifying an enumerated pattern of fields on a frame of reference, the fields in the enumerated pattern having locations on the frame of reference and numbered positions in the enumerated pattern;

the method comprising;

using a data processing machine or data processing machines, establishing one or more communication channels to the authentication server, and sending a user identifier via said one or more communication channels to the authentication server;

receiving a session specific instance of the frame of reference as a result of successful identification of the user identifier by the authentication server, from the authentication server, from an application synchronized with a logical function used to produce an instance at the authentication server or from a combination of the authentication server and an application, the session-specific instance of the frame of reference having fields filled with a session-specific content, wherein the session-specific content comprises characters that are members of a set of characters;

rendering an interface on a display including a graphical representation of the session-specific instance of the frame of reference;

using an authentication challenge including a plurality of challenge characters from said set of characters, to determine a subset of session-specific numbered positions in the enumerated pattern of fields at which said plurality of challenge characters match the characters in said session-specific instance of the frame of reference;

sending authentication response data via said one or more communication channels to the authentication server, the response data identifying said session-specific numbered positions in the enumerated pattern, said session specific numbered positions being usable by the authentication server as part of a verification process; and

receiving a signal via said one or more communication channels from the authentication server that indicates completion of the verification process.

2. The method of claim 1, wherein the authentication credential comprises a second data set identifying a second enumerated pattern of fields on a frame of reference, the fields in the second enumerated pattern having locations in the frame of reference and numbered positions in the second enumerated pattern, and wherein the challenge characters of the authentication challenge are disposed in at least a subset of the locations in the second enumerated pattern in said session-specific instance of the frame of reference.

3. The method of claim 1, including rendering the interface using a first data processing machine, and receiving the authentication challenge at a second data processing machine.

4. The method of claim 3, wherein the authentication credential comprises a second data set identifying a second enumerated pattern of fields on a frame of reference, the fields in the second enumerated pattern having locations in the frame of reference and numbered positions in the second enumerated pattern, and including:

receiving a second session-specific instance of the frame of reference on the second data processing machine from the authentication server, from a local application synchronized with a logical function used to produce an instance at the authentication server or from a combination of the authentication server and a local application, the second session-specific instance of the frame of reference having fields filled with a session-specific content, wherein the session-specific content comprises characters that are members of a set of characters;

wherein the challenge characters of the authentication challenge are disposed in at least a subset of the locations in the second enumerated pattern in said second session-specific instance of the frame of reference.

5. The method of claim 1, wherein the set of characters consists of a number N1 of characters, and the session-specific instance of the frame of reference includes a number N2 of locations populated by characters from the set of characters, where N2 is equal to or greater than a multiple M times N1, and the multiple M is at least 2.

6. The method of claim 1, wherein the set of characters consists of a number of characters, and each character in the set of characters is included in at least two fields having locations on the session-specific instance of the frame of reference.

7. The method of claim 1, wherein for a given session-specific instance of the frame of reference, if there are no locations in the enumerated pattern that include a character matching one of the challenge characters, then apply a rule to determine a character to include in the response data.

8. An interactive method for authentication of a client, comprising:

storing data defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including a number N of pre-defined fields having locations on the frame of reference;

storing a data set associated with the client in a memory, the data set including a shared secret, the shared secret comprising data identifying an enumerated pattern of fields on a frame of reference, the fields in the enumerated pattern having locations on the frame of reference and the locations having numbered positions in the enumerated pattern;

receiving via data communications, a client identifier from the client and initiating a request for use in an authentication session;

presenting using data communications, to the client an instance of the graphical representation of the frame of reference in response to the request for use in the authentication session, the instance including characters in the number N of pre-defined fields according to a pattern different than used in other authentication sessions with the client, the characters consisting of members of a character set including M members, where N is greater than or equal to 2M, and

using challenge characters known or delivered to the client via data communications, which match characters in the fields at a session-specific subset of the locations along the enumerated pattern, whereby the position numbers of said session-specific subset comprise an authentication response for the instance;

accepting input data from the client via data communications, the input data including said authentication response entered by the client using an input device; and

determining whether the input data matches the authentication response, and if the input data matches, signaling successful authentication, and if the input data does not match, signaling failed authentication.

9. The method of claim 8, wherein said data set includes a second shared secret comprising data identifying a second enumerated pattern of fields on a frame of reference, the fields in the second enumerated pattern having locations in the frame of reference and the locations having numbered positions in the second enumerated pattern, and wherein said challenge characters include characters in at least a subset of the fields of the second enumerated pattern.

10. The method of claim 8, including presenting to the client an instance of the graphical representation of the frame of reference by sending an electronic document executable by the client to render said instance.

11. The method of claim 8, wherein the client positions the characters in the instance of the graphical representation, using a program executed by the client.

12. The method of claim 8, wherein the set of characters consists of a number of characters, and each character in the set of characters is included in at least two fields having locations on the session-specific instance of the frame of reference.

13. The method of claim 8, wherein for a given session-specific instance of the frame of reference, if there are no locations in the enumerated pattern that include a character matching one of the challenge characters, then apply a rule which can be applied by the client, to determine a character to include in the authentication response.

14. The method of claim 8, including presenting to the client an instance of the graphical representation of the frame of reference using a first communication medium, and sending the challenge to the client using a different communication medium.

15. The method of claim 8, including presenting to the client an instance of the graphical representation of the frame of reference by sending to the client an electronic document executable by the client to render said instance, wherein said sending to the client a challenge includes sending the challenge to the client embedded in said electronic document.

16. The method of claim 8, wherein said client has access to a first data processing machine and to a second data processing machine, and including:

establishing a first communication channel including a connection between a computer and the first data processing machine;

receiving an input client identifier from the first data processing machine via one or more data communications on the first communication channel;

verifying the input client identifier; and

establishing a second communication channel including a connection between the computer and the second data processing machine; and

after said verifying, presenting said to challenge to the second data processing machine using one or more data communications on the second communication channel.

17. The method of claim 16, wherein said data set includes a second shared secret comprising data identifying a second enumerated pattern of fields on a frame of reference, the fields in the second enumerated pattern having locations in the frame of reference and the locations having numbered positions in the second enumerated pattern, and including:

using a second instance of the frame of reference having characters positioned in the number N of pre-defined fields according to a pattern different than used in said first mentioned instance, wherein said challenge characters include characters in at least a subset of the fields of the second enumerated pattern on the second instance.

18. The method of claim 17, including:

accepting said input data in response to the challenge from the first data processing machine via one or more data communications on the first communication channel.

19. The method of claim 17, wherein said first data processing machine comprises a first application executed on a first processor having an interface to a physical communication medium, and the second data processing machine comprises a second application executed on a second processor different than the first processor, and having an interface to a different physical communication medium.

20. An interactive method for authentication of a client, comprising:

storing data defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including a number N of pre-defined fields in the frame of reference having locations on the frame of reference;

storing a data set associated with the client in a memory, the data set including a first shared secret and a second shared secret, the first shared secret comprising data identifying a first enumerated pattern of fields on a frame of reference, the fields in the first enumerated pattern having locations in the frame of reference and the locations have numbered positions in the first enumerated pattern, and the second shared secret comprising data identifying a second enumerated pattern of fields on a frame of reference, the fields in the second enumerated pattern having locations in the frame of reference and the locations have numbered positions in the second enumerated pattern;

receiving via a first data communication, a client identifier from the client and initiating a request for use in an authentication session;

presenting via a second data communication, to the client an instance of the graphical representation of the frame of reference in response to the request for use in the authentication session, the instance including characters positioned in the number N of pre-defined fields according to a pattern different than used in other authentication sessions with the client, the characters consisting of members of a character set including M members, where N is greater than or equal to 2M, and

in which characters in the fields of the second enumerated pattern comprise challenge characters which match characters in the fields at a session-specific subset of the locations along the first enumerated pattern, whereby the position numbers of said session-specific subset comprise an authentication response for the instance;

accepting input data from the client via a third data communication, the input data including said authentication response entered by the client using an input device; and

determining whether the input data matches the authentication response, and if the input data matches, signaling successful authentication, and if the input data does not match, signaling failed authentication.

21. A client-server authentication system to authenticate a client, comprising:

data processing resources, including one or more processors, memory and a communication interface;

data stored in said memory defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including a number N of pre-defined fields in the frame of reference having locations on the frame of reference, and including data including authentication credentials for clients, the authentication credential for a particular client comprising a data set identifying a first enumerated pattern of fields on a frame of reference, the fields in the first enumerated pattern having locations in the frame of reference and the locations have numbered positions in the first enumerated pattern;

the data processing resources including executable instructions stored in said memory adapted for execution by the processor, including logic to

receive via data communications, a client identifier from the client and initiating a request for use in an authentication session;

present using data communications, to the client an instance of the graphical representation of the frame of reference in response to the request for use in the authentication session, the instance including characters positioned in the number N of pre-defined fields according to a pattern different than used in other authentication sessions with the client, the characters consisting of members of a character set including M members, where N is greater than or equal to 2M, and

to use challenge characters known or delivered to the client via data communications, which match characters in the fields at a session-specific subset of the locations along the enumerated pattern, whereby the position numbers of said session-specific subset comprise an authentication response for the instance;

accept input data from the client via data communications, the input data including said authentication response entered by the client using an input device; and

determine whether the input data matches the authentication response, and if the input data matches, to signal successful authentication, and if the input data does not match, to signal failed authentication.

22. The system of claim 21, wherein said data set includes a second shared secret comprising data identifying a second enumerated pattern of fields on a frame of reference, the fields in the second enumerated pattern having locations in the frame of reference and the locations having numbered positions in the second enumerated pattern, and wherein said challenge characters include characters in at least a subset of the fields of the second enumerated pattern.

23. The system of claim 21, including logic to present to the client an instance of the graphical representation of the frame of reference by sending an electronic document executable by the client to render said instance.

24. The system of claim 21, wherein the client positions the characters in the instance of the graphical representation, using a program executed by the client.

25. The system of claim 21, wherein the set of characters consists of a number of characters, and each character in the set of characters is included in at least two fields having locations on the session-specific instance of the frame of reference.

26. The system of claim 21, wherein for a given session-specific instance of the frame of reference, if there are no locations in the enumerated pattern that include a character matching one of the challenge characters, then the logic applies a rule which can be applied by the client, to determine a character to include in the authentication response.

27. The system of claim 21, including logic to present to the client an instance of the graphical representation of the frame of reference using a first communication medium, and to send the challenge to the client using a different communication medium.

28. The system of claim 21, including logic to present to the client an instance of the graphical representation of the frame of reference by sending to the client an electronic document executable by the client to render said instance, wherein said logic to send to the client a challenge includes sending the challenge to the client embedded in said electronic document.

29. The system of claim 21, wherein said client has access to a first data processing machine and to a second data processing machine, and including logic to:

establish a first communication channel including a connection between a computer and the first data processing machine;

receive an input client identifier from the first data processing machine via one or more data communications on the first communication channel;

verify the input client identifier; and

establish a second communication channel including a connection between the computer and the second data processing machine; and

after said verifying, to present said challenge to the second data processing machine using one or more data communications on the second communication channel.

30. The system of claim 29, wherein said data set includes a second shared secret comprising data identifying a second enumerated pattern of fields on a frame of reference, the fields in the second enumerated pattern having locations in the frame of reference and the locations having numbered positions in the second enumerated pattern, and including logic to:

use a second instance of the frame of reference having characters positioned in the number N of pre-defined fields according to a pattern different than used in said first mentioned instance, wherein said challenge characters include characters in at least a subset of the fields of the second enumerated pattern on the second instance.

31. The system of claim 30, including logic to:

accept said input data in response to the challenge from the first data processing machine via one or more data communications on the first communication channel.

32. The system of claim 29, wherein said first data processing machine comprises a first application executed on a first processor having an interface to a physical communication medium, and the second data processing machine comprises a second application executed on a second processor different than the first processor, and having an interface to a different physical communication medium.

33. A computer program stored on a non-transitory computer readable medium and executable by a computer to authenticate a client, comprising instructions to:

use data stored in a memory defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including a number N of pre-defined fields in the frame of reference having locations on the frame of reference, and including data including authentication credentials for clients, the authentication credential for a particular client comprising a data set identifying a first enumerated pattern of fields on a frame of reference, the fields in the first enumerated pattern having locations in the frame of reference and the locations have numbered positions in the first enumerated pattern;

receive via data communications, a client identifier from the client and initiating a request for use in an authentication session;

present using data communications, to the client an instance of the graphical representation of the frame of reference in response to the request for use in the authentication session, the instance including characters positioned in the number N of pre-defined fields according to a pattern different than used in other authentication sessions with the client, the characters consisting of members of a character set including M members, where N is greater than or equal to 2M, and

to use challenge characters known or delivered to the client via data communications, which match characters in the fields at a session-specific subset of the locations along the enumerated pattern, whereby the position numbers of said session-specific subset comprise an authentication response for the instance;

accept input data from the client via data communications, the input data including said authentication response entered by the client using an input device; and

determine whether the input data matches the authentication response, and if the input data matches, to signal successful authentication, and if the input data does not match, to signal failed authentication.

34. The program of claim 33, wherein said data set includes a second shared secret comprising data identifying a second enumerated pattern of fields on a frame of reference, the fields in the second enumerated pattern having locations in the frame of reference and the locations having numbered positions in the second enumerated pattern, and wherein said challenge characters include characters in at least a subset of the fields of the second enumerated pattern.

35. The program of claim 33, including logic to present to the client an instance of the graphical representation of the frame of reference by sending an electronic document executable by the client to render said instance.

36. The program of claim 33, wherein the client positions the characters in the instance of the graphical representation, using a program executed by the client.

37. The program of claim 33, wherein the set of characters consists of a number of characters, and each character in the set of characters is included in at least two fields having locations on the session-specific instance of the frame of reference.

38. The program of claim 33, wherein for a given session-specific instance of the frame of reference, if there are no locations in the enumerated pattern that include a character matching one of the challenge characters, then the logic applies a rule which can be applied by the client, to determine a character to include in the authentication response.

39. The program of claim 33, including logic to present to the client an instance of the graphical representation of the frame of reference using a first communication medium, and to send the challenge to the client using a different communication medium.

40. The program of claim 33, including logic to present to the client an instance of the graphical representation of the frame of reference by sending to the client an electronic document executable by the client to render said instance, wherein said logic to send to the client a challenge includes sending the challenge to the client embedded in said electronic document.

41. The program of claim 33, wherein said client has access to a first data processing machine and to a second data processing machine, and including logic to:

establish a first communication channel including a connection between a computer and the first data processing machine;

receive an input client identifier from the first data processing machine via one or more data communications on the first communication channel;

verify the input client identifier; and

establish a second communication channel including a connection between the computer and the second data processing machine; and

after said verifying, to present said challenge to the second data processing machine using one or more data communications on the second communication channel.

42. The program of claim 41, wherein said data set includes a second shared secret comprising data identifying a second enumerated pattern of fields on a frame of reference, the fields in the second enumerated pattern having locations in the frame of reference and the locations having numbered positions in the second enumerated pattern, and including logic to:

use a second instance of the frame of reference having characters positioned in the number N of pre-defined fields according to a pattern different than used in said first mentioned instance, wherein said challenge characters include characters in at least a subset of the fields of the second enumerated pattern on the second instance.

43. The program of claim 42, including logic to:

accept said input data in response to the challenge from the first data processing machine via one or more data communications on the first communication channel.

44. The program of claim 41, wherein said first data processing machine comprises a first application executed on a first processor having an interface to a physical communication medium, and the second data processing machine comprises a second application executed on a second processor different than the first processor, and having an interface to a different physical communication medium.