Patent Application
20080077978
The present invention should become apparent from the following description, which is given by way of example only, of a preferred but non-limiting embodiment thereof, described in connection with the accompanying figures.
According to a first broad form, there is provided a method of allowing user input of a password. Users may select and enter one or more passwords using an abstract representation of data, rather than inputting ASCII characters (for example user selection can be by using a keyboard, either hardware or software implemented such as a touch screen, a mouse, a pointer-device or a stylus). The method seeks to provide increased entropy, relative to ASCII input, to be associated with the input password, thus making it more difficult, or preferably infeasible, to use a brute force attack to determine the password.
In a particular example embodiment, there is provided a method of allowing a user to input a password including the steps of presenting password elements to the user, receiving selected password elements from the user, and submitting the password. According to further optional aspects, the method may include converting the password to binary format, and then performing processing on the converted password.
In a particular, but non-limiting, form the password is not submitted until at least one password criteria is satisfied.
According to a further example form, each password element is selected from one or more password arrays, each array including a selection of one or more objects, where an object is, for example, a value, a shape, or an aspect of a value or a shape. Other types of object are also possible and are hereinafter discussed.
Optionally, an object (i.e. value, shape or aspect) may be a shape such as, for example: a square, a triangle, a cross, a circle, a hexagon, a diamond, a left arrow, a right arrow, an up arrow, a down arrow, etc.
Optionally, an object (i.e. value, shape or aspect) may be a style, such as, for example: filled, border only, striped, chequered, etc.
Optionally, an object (i.e. value, shape or aspect) may be a colour, such as, for example: red, green, blue, black, white, grey, pink, purple, orange, yellow, aqua, etc.
According to further broad forms, there is provided a system and a computer program product for embodying the aforementioned methods.
The following modes, given by way of example only, are described in order to provide a more precise understanding of the subject matter of a preferred embodiment or embodiments.
In the figures, incorporated to illustrate features of an example embodiment, like reference numerals are used to identify like parts throughout the figures.
A particular embodiment of the present invention can be realised using a processing system, an example of which is shown in
Input device 106 receives input data 118 and can include, for example, a keyboard, a pointer device such as a pen-like device or a mouse, audio receiving device for voice controlled activation such as a microphone, data receiver or antenna such as a modem or wireless data adaptor, data acquisition card, etc. Input data 118 could come from different sources, for example keyboard instructions in conjunction with data received via a network. Output device 108 produces or generates output data 120 and can include, for example, a display device or monitor in which case output data 120 is visual, a printer in which case output data 120 is printed, a port for example a USB port, a peripheral component adaptor, a data transmitter or antenna such as a modem or wireless network adaptor, etc. Output data 120 could be distinct and derived from different output devices, for example a visual display on a monitor in conjunction with data transmitted to a network. A user could view data output, or an interpretation of the data output, on, for example, a monitor or using a printer. The storage device 114 can be any form of data or information storage means, for example, volatile or non-volatile memory, solid state storage devices, magnetic devices, etc.
In a particular embodiment, input data 118 can be a password and output data 120 can be a converted or processed password transmitted to a remote processing system.
In use, the processing system 100 is adapted to allow data or information to be stored in and/or retrieved from, via wired or wireless communication means, the at least one database 116. The interface 112 may allow wired and/or wireless communication between the processing unit 102 and peripheral components that may serve a specialised purpose. More than one input device 106 and/or output device 108 can be provided. It should be appreciated that the processing system 100 may be any form of terminal, server, specialised hardware, or the like.
The processing system 100 may be a part of a networked communications system. Processing system 100 could connect to a network, for example the Internet or a WAN. Input data 118 and output data 120 could be received from or communicated to other devices, such as a server, via the network. The network may form part of, or be connected to, the Internet, and may be or form part of other communication networks, such as LAN, WAN, ethernet, token ring, FDDI ring, star, etc., networks, or mobile telephone networks, such as GSM, CDMA or 3G, etc., networks, and may be wholly or partially wired, including for example optical fibre, or wireless networks, depending on a particular implementation.
Referring to
Referring to
At step 340, the user inputted password can be submitted. Submission may be to a local terminal or a remote terminal, for example user interface 400 may be presented on a web-page and the password submitted to a remote server. Password elements may be presented on a web-page and the password may be submitted to an application, either running on a local terminal or a remote terminal. At step 350, the password is converted to binary format. The conversion at step 350 may occur locally at a terminal or at a remote server. At step 360, the converted password is processed, which, as before, can occur either at a local terminal or a remote server. Processing of the converted password can include salting and/or application of a hash function to the binary format password.
Referring to
For example, user interface 400 may allow a user to be able to select each password element 420 from an array of password elements provided as a combination of objects, i.e. a combination of values, shapes and/or aspects. For example, the array of password elements, grouped in panels, could be presented to the user based on the following table.
Table 1 allows for a selection of 444 (10×4×11) unique values for each member of the password array. In practice, this number of selections may be considered too high and thus certain values may be excluded to limit the number of combinations to 255. Each password element could be represented by various icons, images, indicia, characteristics of indicia, digital photos, animations, audio or video clips.
In a particular embodiment, the method of the present invention provides a user interface for password input by a user. Each password element is represented by an abstract indication, for example various indicia or icons, colours, shapes, textures, etc., and combinations thereof. Preferably, the user is provided with a greater number of password elements than the standard number of ASCII characters (128 different bit patterns).
It should be noted that a password element could be an ASCII character. For example, one of the panels could present ASCII characters to the user for use as password elements. In this example, the user could select a standard ASCII based password in combination with one or more objects from another panel, for example the object could be a colour or style of the ASCII based password, or an image to be associated with the ASCII based password. Thus, selection of password elements to form a password can involve a user selecting ASCII characters (such as standard alpha-numerals) in combination with selection of one or more objects. ASCII characters could be selected from a panel as for the selection of objects, or entered via a keyboard.
The user interface may include one or more panels displaying groupings of password elements (i.e. input elements). Password elements may be displayed in a pseudo-random fashion, resulting in password elements being displayed at a different location, or different relative location, each time a user loads the user interface. Password elements may automatically scroll and pause when the user “hovers” the user's curser/mouse over a particular password element. Additionally or alternatively, password elements may scroll or animate when a user “hovers” the user's curser/mouse over a particular section of a panel. In another embodiment, a panel can be provided with a group of objects, such as shapes, where the ordering or positioning of the objects is constantly or periodically changing, for example by being animated or moved. Movement of objects could be set at any desired speed for user visibility or usability, and movement could be in any direction, for example horizontal or vertical. A user could select an object as desired using a pointing device. In another form, hovering or positioning a pointer, e.g. a mouse pointer, over a moving object could cause the movement of the object to be slowed, and eventually cause user selection of the object without the user having to click on the object (for example after hovering over a stopped object for one second).
Similar password policies as those discussed in the prior art may still be applied to password input with certain modifications, for example the entered password could still be required to be of a minimum number of password elements, and/or each password element might be required to be unique.
Preferably, once the user has selected a password, the submitted password is converted to binary format. Conversion can be performed by mapping each possible input element to a byte representation, for example up to the number 255. The converted password can then be processed in a similar manner as is presently known, for example the converted password can be salted then hashed to provide a unique value even when two users have selected the same password.
The following pseudocode illustrates how a computer program product can be structured to provide the method of allowing user input of a password.
The invention may be embodied as a computer readable medium of instructions and/or a computer program product, e.g. software. Such software can be implemented separately or in combination with known software packages and/or online services. Such software can be used to provide added password security by enabling input of passwords consisting of non-alphanumeric indicia, i.e. abstract “characters” or “aspects” of characters. An embodiment may run on the Windows® operating system, however it should be realised that various embodiments can be applied to any operating system on any type of terminal.
Example applications can include: web-site logon, for example internet banking; terminal logon, for example to extend existing logon mechanisms such as the Windows® logon screen; and software registration/activation codes, for example to activate a software product after purchase.
Thus, there has been provided a means for allowing user input of a password.
Optional embodiments of the present invention may also be said to broadly consist in the parts, elements and features referred to or indicated herein, individually or collectively, in any or all combinations of two or more of the parts, elements or features, and wherein specific integers are mentioned herein which have known equivalents in the art to which the invention relates, such known equivalents are deemed to be incorporated herein as if individually set forth.
Although a preferred embodiment has been described in detail, it should be understood that various changes, substitutions, and alterations can be made by one of ordinary skill in the art without departing from the scope of the present invention.
The present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, firmware, or an embodiment combining software and hardware aspects.
This application claims the benefit of priority from U.S. Provisional Patent Application No. 60/847,324 filed Sep. 26, 2006, and is incorporated by referenced.
| Number | Date | Country | |
|---|---|---|---|
| 60847324 | Sep 2006 | US |
