Electronic authentication using pictures and images

• US 8,881,251 B1
• Filed: 02/22/2013
• Issued: 11/04/2014
• Est. Priority Date: 05/30/2012
• Status: Expired due to Fees

• Current Assignee: Rememberin Incorporated
• Original Assignee: Rememberin Incorporated
• Inventors: Hilger, Stuart
• Primary Examiner(s): KOSOWSKI, CAROLYN M
• Application Number:
  US13/774,949
• Time in Patent Office: 620 Days
• Field of Search: 726/7
• US Class Current: 726/7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A method and system for user authentication uses photos, pictures, images, pictures of words, logos, graphics, icons, or pictures of colors (graphical elements) as password elements (graphical password) to gain access to a secure platform, section of a platform, specific content, website, computer, mobile device or other electronic device (secure content). The Method and system provide the creation, use in authentication and maintenance of the graphical password. Graphical password creation is initiated through user selection and platform storage of a subset of one or more platform provided or user provided graphical elements (secret graphical elements). The graphical elements are photos, pictures or images that are memorable to the user and are from within one or more relevant categories, e.g. colors, playing cards, animals. A graphical user interface (GUI) having virtual dials, wheels, reels or keypads to display images is used to implement the login/authentication process.

Claims

1. A computer authentication system comprising:

a memory holding a graphical password of a given user, the graphical password being formed of a user selected series of certain graphical elements chosen from within at least one user-selected category;

an authentication process executable by a processor and implementing an authentication session, the authentication process having;

a user interface, and

a source of graphical elements, wherein during the authentication session the user interface (i) displays to an end-user one or more pluralities of ones of the graphical elements from the source randomly placed with the certain graphical elements dispersed throughout the pluralities, each different certain graphical element being dispersed in a respective different plurality, and (ii) requires the end-user to identify the at least one user-selected category, and then find in and select from the displayed pluralities within the at least one user-selected category each of the certain graphical elements that form the graphical password, and

wherein upon the end-user correctly selecting all of the certain graphical elements forming the graphical password, the authentication process positively authenticates the end-user as the given user of the graphical password; and

wherein the certain graphical elements of the graphical password and the graphical elements from the source are organized by respective category, and strength of the graphical password is a function of (i) a number of the graphical elements chosen in sequence from the user-selected categories used in forming the graphical password, (ii) a total number of available categories from which the user selects, and (iii) a total number of graphical elements within each of the available categories.

2. A system as claimed in claim 1 wherein the memory holding the graphical password is communicatively coupled to an access device, and the graphical password is a result of a registration process of the access device.

3. A system as claimed in claim 1 wherein the user interface employs a revolving area in which to display to the end user the pluralities of graphical elements randomly placed together with the certain graphical elements;

and

the revolving area is configured for user interaction as one of a set of reels, a wheel, a disk and a dial that the end-user operates by spinning to select from the displayed pluralities each of the certain graphical elements forming the graphical password.

4. A system as claimed in claim 1 wherein the user interface displays each plurality of graphical elements randomly placed together with the respective certain graphical element in one or more pads, pull down menus or columns from which the end-user makes his selection.

5. A system as claimed in claim 1 wherein the certain graphical elements are photos, pictures or images from one or more categories of subject matter, and the images can include images or photos of colors or words.

6. A system as claimed in claim 1 further comprising a module enabling the given user to update, edit, add, and/or delete graphical elements in the source.

7. A system as claimed in claim 1 wherein at least one of the certain graphical elements indicates a merchant logo or brand, and

the authentication process further:

upon positively authenticating the end-user, triggers entry into a website or application specific to the merchant or brand.

8. A system as claimed in claim 1 wherein the source includes graphical elements retrieved or imported from any combination of:

the given user'"'"'s personal collection of images, third party collections of images, a social network account, licensed images and other sources.

9. A system as claimed in claim 8 wherein the retrieved or imported graphical elements are normalized for storage in the source, said normalizing ensuring that said retrieved or imported graphical elements are not identifiable as belonging to the given user or appear to be more susceptible to given user choice as a secret graphical element.

10. A system as claimed in claim 1 wherein the authentication process further obscures the end-user selections from the displayed pluralities during the authentication session in a manner that reduces susceptibility to shoulder surfing or recording of the graphical password.

11. A system as claimed in claim 1 wherein the authentication process further includes:

a process for the end-user to retrieve a forgotten password, and a process to reset a password,

wherein said process for retrieving and said process for resetting a password use various levels of hints, challenge questions and/or challenge images.

12. A system as claimed in claim 11 wherein at least the process for retrieving prompts the end-user to supply an image and compares the supplied image to a challenge image previously stored by the given user during his creation of the graphical password.

13. A system as claimed in claim 1 wherein each certain graphical element has a respective user specific alpha-numeric string or other comparator used to compare selected graphical elements from the displayed pluralities to the stored graphical password of the given user, the user specific alpha-numeric string or other comparator being created by the given user or assigned through the system, ensuring of non-duplication of the graphical passwords among users using the same certain graphical elements in common.

14. A system as claimed in claim 13 wherein the memory further stores a unique identifier of the given user'"'"'s device used to create the graphical password, and

the authentication process further authenticates the end-user based on device unique identifier.

15. A system as claimed in claim 1 wherein strength of the graphical password is increased by the source maintaining a relatively high number of graphical elements available for the pluralities, and by number of graphical elements being re-used in different graphical passwords of different users being limited.

16. A system as claimed in claim 1 wherein the source is a database that includes the certain graphical elements of users'"'"' graphical passwords, and

the system further comprising a reporter generating from the database aggregate non-user specific information regarding the graphical elements used in passwords.

17. A system as claimed in claim 16 wherein the certain graphical elements of graphical passwords of users are organized by category, and

the reporter enables targeted advertising to at least a subset of users having passwords with a category in common.

18. A system as claimed in claim 1 wherein the authentication process allows the end-user up to a threshold number of attempts, in the authentication session, to select the graphical password,

wherein the threshold number is pre-defined by the given user.

19. A system as claimed in claim 1 wherein the authentication session is configurable by the given user to:

last up to only a threshold period of time, and/or

be idle (without user interaction) for only a certain amount of time.

20. A system as claimed in claim 1 further comprising a strength indicator that provides to the given user a visual depiction of the probabilities of an unauthorized user correctly guessing the graphical password as the number of categories, number of certain graphical elements in each category and number of graphical elements in each category are increased.

21. A system as claimed in claim 20 wherein the strength indicator further indicates to the given user a comparison relative to probabilities of other random events.

22. A system as claimed in claim 1 further comprising a module enabling the given user to update, edit, add, and/or delete graphical elements and categories in the source.

23. A system as claimed in claim 1 wherein upon the end-user incorrectly selecting one of the certain graphical elements from the respective plurality of graphical elements, the authentication process withholds displaying the remaining certain graphical elements in the respective pluralities of graphical elements.

24. A system as claimed in claim 1 wherein the user interface further requires the end-user to place the certain graphical elements selected from the displayed pluralities in proper sequence (user-defined series order).

25. A system as claimed in claim 1 wherein at least one of the certain graphical elements has a respective user specific alpha-numeric string representing a personal identifier (PIN) of the given user, and changing the one certain graphical element in the graphical password enables automatic updating of the personal identifier.

26. A system as claimed in claim 1 wherein at least one of the following is user-defined:

the certain graphical elements;

the graphical elements from the source; and

the at least one user-selected category.