Authentication system and method based on random partial digitized path recognition

Abstract

An authentication server (1030) provides a clue to a client (1010) indicating a random partial subset of a full pattern that characterizes a full digitized path on a frame of reference, and the client enters a data to fulfill an authentication factor suggested by the clue. The full pattern consists of an ordered set of data fields, which store parameters that specify the full digitized path on a reference grid for recognition. The server presents an instance of a graphical representation of the frame of reference, including an array of random indicators at data field coordinates in the frame of reference (3050). The server accepts indicators from the array of indicators at data field coordinates in the frame of reference. The server accepts indicators from the array of indicators corresponding to coordinates along said digitized path identified by the random partial subset as input data to fulfill the authentication factor.

Description

technical field [0001] The present invention relates generally to user authentication systems for computer and network security access control systems; more particularly to improved authentication factors based on "what user knows" in client / server network architectures and other architectures . Background technique [0002] The most widely used method of user authentication is referred to herein as the Standard Static Password Recognition (SSPR) algorithm. The SSPR algorithm simply requires the user to enter a username and password for authentication. This is a "what does the user know" type of differentiator. Other types of authentication factors are less widely used and include "what the user has" (card key) and "what the user is" (fingerprint). The "what does the user have" and "what is the user" types of authentication factors require specialized hardware devices on the input terminals, such as card readers, tokens, fingerprint sensors, etc. Much more expensive and ...

AI Technical Summary

Problems solved by technology

[0004] 2. Another question is about password combination capabilities for typical passwords within the complexity of the "comfort level" for most users

The easy-to-think defensive line might be to increase the length of the static password

Unfortunately, as we've already discussed, this capability has been greatly limited by the user's "comfort level"

Thus, SSPR-based security systems appear to be in a dilemma, as the minimum password length (3-4 alphanumeric characters) must be increased to withstand increasingly efficient combinatorial attacks, while the overall static password length had to stay the same and be limited to 6-7 alphanumeric characters

[0009] 2. In addition, a large number of security issues have emerged in large-scale systems, such as flaws in state / national voting systems, credit card fraud in health data banks and financial service organizations, privacy and security gaps, vulnerabilities in Microsoft 2000 and XP operating systems, etc., This leads to the need to improve or rebuild large-scale security systems

[0033] 7. Scammers

Otherwise, the system has no chance of widespread adoption

[0051] 4. Client and server need to perform mutual authentication of each other

However, there is no known method (other than SSPR) that is widely accepted by the public and industry

Furthermore, none allow for a comprehensive security system and user authentication method covering the entire list of requirements listed above

Images