Graphical Password Authentication with Randomized Object Positioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication techniques using graphical passwords are vulnerable to record/replay and phishing attacks due to predictable image sequences and lack of secure interaction data exchange.
Innovation Solution
A system that generates a random interface with graphical objects on a client device, where user interactions are recorded as input events without revealing object identities, and verified against an object map to grant access, reducing the risk of phishing and replay attacks by varying object positions across sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If graphical passwords use fixed image sequences and predictable object positions, then user authentication is simplified and easier to implement, but the system becomes vulnerable to record/replay and phishing attacks
Solution Approach 1:
The patent implements dynamic object positioning where graphical objects are placed at random locations on the display during each authentication session. This dynamic repositioning ensures that even if an attacker records a session, the recorded positions become invalid in subsequent sessions, preventing replay attacks while maintaining the same ease of use for legitimate users.
Solution Approach 2:
The system changes the spatial parameters of graphical objects by randomly repositioning them across different sessions. This parameter change (position coordinates) transforms the authentication interface from a static, predictable layout to a dynamic, unpredictable one, thereby enhancing security without complicating the user interaction model.
2Ease of operation
If the system reveals object identities and positions during authentication, then user interaction is simplified, but phishing attacks become more effective as attackers can observe and replicate the interface
Solution Approach 1:
The patent applies local quality by providing visual feedback only at the specific location where the user clicks, rather than revealing the identity of the clicked object. This localized feedback mechanism maintains ease of interaction (users can see where they clicked) while preventing phishing (the actual object identity remains hidden until verification).
Solution Approach 2:
The system introduces an intermediary verification process where click coordinates are sent to the server for validation against the object map. This intermediary step acts as a mediator between user interaction and object identification, allowing the system to verify authentication without exposing object identities to the client side where phishing could occur.
3Reliability
If the system uses traditional multi-factor authentication methods, then security layers are added, but implementation and maintenance costs increase
Solution Approach 1:
The patent implements a universal authentication mechanism that can work across different platforms and devices using standard web technologies. The graphical password system serves multiple functions: it provides visual feedback for accessibility, maintains security through randomized positioning, and integrates with existing web infrastructure, thereby reducing implementation complexity compared to specialized hardware tokens or biometric scanners.
Solution Approach 2:
The system enables self-service authentication where users independently interact with the graphical interface using familiar click-based interactions. The automatic generation of randomized layouts and verification processes eliminates the need for manual configuration or specialized maintenance, reducing both implementation and ongoing maintenance costs while providing robust security.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Systems and methods for multi-factor authentication using graphical passwords. An access request that includes an identifier and which identifies a protected resource is received from a client device. An interface is generated having a plurality of graphical objects for presentation at random locations on a display of the client device as defined by an object map. The plurality of graphical objects include a null object and a set of user-defined objects associated with the identifier that define a graphical password. Input data including an input event for each detected interaction with the interface is received. Each input event identifies a position on the display at which a corresponding interaction was detected. Using the object map, it is determined that the input data satisfies the graphical password. Access to the protected resource is granted in response to determining that the input data satisfies the graphical password.