Security system based on questions that do not publicly identify the speaker

• US 9,311,461 B2
• Filed: 04/16/2008
• Issued: 04/12/2016
• Est. Priority Date: 04/16/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Basson, Sara H., Kanevsky, Dimitri, Kelley, Edward E., Ramabhadran, Bhuvana
• Primary Examiner(s): Le, Chau
• Assistant Examiner(s): LAVELLE, GARY E
• Application Number:
  US12/103,892
• Publication Number:
  US 20090265770A1
• Time in Patent Office: 2,918 Days
• Field of Search: 726/7, 726/17, 726/21, 726/29, 713/182
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A method and system for authenticating a user seeking access to a secured system in a public area. Access is granted when a user demonstrates sufficient knowledge of the user'"'"'s personal characteristics stored in the system. The user initiates the access process by tapping into the stored characteristics without overtly stating information that may be overheard. The user statements reflect an awareness about the categories of user uniqueness without divulging details. The system response statements act to elicit further information from the user for response and the response statements are scored. After a cumulative score threshold is met, the user is granted access.

Claims

1. A computer method for authenticating a user to allow user access to secure information stored in a computer system using personal characteristics of the user, comprising the steps of:

receiving at the computer system a user information statement of a user from a computer system user input terminal device sufficient to initially identify the user so as to authorize initiation of the authentication process in said computer system;

initiating the beginning of the authentication process by receiving at said computer system from said user input terminal a user initiated and created statement self-identifying a general personal characteristic of the user related to a class of personal characteristics of the user stored in a user personal characteristics database in said computer system with said user-initiated and created statement used by said computer system to begin the authentication dialog;

computer system generation of a list of user personal characteristics from the user identified class of personal characteristics of the user stored in the user personal characteristics database in said computer system in response to the user initiated and created statement self-identifying the personal characteristic;

further computer system generation of another list of general global user personal characteristic statements stored in a global user personal characteristics database stored in said computer system corresponding to said user identified class of user personal characteristics with said global user personal characteristic statements applicable to a broad cross-section of users and with said list including one list of general global user personal characteristic statements related to the personal characteristics of the user identified class of stored personal characteristics of the user with said statements generated to be used to elicit user created response statements from the user and another list of a collection of various user responses to each of the general global user personal characteristic statements of said one list;

sending to the user a general global user personal characteristic statement from said one list to elicit a user created response statement regarding corresponding personal characteristics in the generated list of user personal characteristics for the user identified class of user characteristics;

receipt of a user created response statement to the general global user personal characteristic statement sent to the user;

computer system comparison of the user created response statement created by the user to the general global personal statement sent to the user with the corresponding responses to the generated list of a collection of various user responses to the corresponding general global statement to determine if the user created response statement is unique as compared to the collection of various user responses;

where the created response statement is unique, sending successive further general global user personal characteristic statements from said one list each time a further statement sent to the user elicits further user created response statements that are unique as compared to the corresponding statements of the generated list of a collection of various user responses to the corresponding global statements;

computer system analysis of each of the respective further user created response statements to the successive further global general statements sent to the user as compared to the corresponding stored personal characteristics for the user selected class of user personal characteristics stored in the computer system database to further determine if each of the user created response statements is unique with said analysis based upon the key words and organization used in the response statements;

where the computer system analysis concludes that the user created response statements are unique, compute generation of a score based upon the degree of uniqueness and closeness of each of the response statements to the corresponding stored personal characteristic using key words and organization to create a cumulative score;

computer comparison of the cumulative score to a predetermined threshold score; and

where the cumulative score fails to reach the predetermined threshold score condition, such failure of condition acts to initiate sending another of said sending successive further general global user personal characteristic statements from said one list.

2. The computer method for authenticating a user to allow user access to secure information stored in the computer system of claim 1 the user initiated and created statement, the user created response statement and the global user personal characteristic statement sent to the user are interactive and oral.

3. The computer method for authenticating a user to allow user access to secure information stored in the computer system of claim 2 further comprising the steps of comparing the cumulative score when the score reaches a predetermined threshold to a stored cumulative score history and granting user access to secure information stored in the computer system when the cumulative score is sufficiently close to the stored cumulative score history.

4. The computer method for authenticating a user to allow access to secure information stored in the computer system of claim 3 further comprising the step of terminating the sending to the user global user personal characteristic statements from said one list when a predetermined number statements have been sent and the cumulative score has not reached the predetermined threshold score.