Patent Application
20070143830
This invention relates generally to user authentication techniques, and in particular relates to a method and apparatus for authenticating a user prior to allowing the user to access a secure system, such as one protected by password, using input submitted by the user that is in response to an instruction issued by or on behalf of the secure system.
Computer systems often employ computer security techniques, such as access control mechanisms, to prevent unauthorized users from accessing certain information, such as sensitive or personal information contained in a database on the system. The process of verifying the identity of a user in a computer system as having access to such information is often termed user authentication. There are a number of different protocols for user authentication to prevent the unauthorized access of information. One common protocol involves the use of a password that must be asserted along with a user's identity, e.g., a username. In such a password-protected system, each user has a password which the user must provide to the system, along with his or her identity (i.e., username), to prove his or her authority to access the system and the information contained therein. A central data processing unit for the system then compares the password provided by the user with the stored password corresponding to that particular user, and if the text matches, the user is authorized to access the system.
Concerns regarding the security of electronic communications and computer systems are rising inversely with the failure of password protection protocols to prevent unauthorized access to sensitive information. In password protected systems, individuals without access to a particular secured system who are intent upon gaining such access have been able to gain authentication as a user by, for example, using computer programs to submit many combinations of usernames and passwords to the system until the correct combination is found, literally by trial and error. Not only does this result in a breach in security, but the submissions of multitudes of computer-generated guesses at username/password combinations can also severely impact the performance of the computer system, especially if multiple password deciphering programs concurrently hit a given system.
Therefore, a simple password protocol often does not provide adequate security for sensitive information, since a password that is selected by a user might be easy for an attacker to guess. Some ways in which the security offered by simple password protocol is bolstered include: limiting the number of logon attempts (to prevent an attacker from trying combinations to guess a password) and requiring an authorized user to correctly answer personal information, such as mother's maiden name or social security number. The former can be problematic in that a user who has authority to access the information, but for whatever reason has difficulty entering his or her username and password correctly, will likely be disabled from further logon attempts and will be required to seek a password reset, which can be expensive to administer across an information technology system, e.g., including resources for first disabling the account then resetting the password and sending the new password to the authorized user. The latter can be problematic in that the questions posed are often generic and/or easily gathered from other sources, so that the response to the questions can often be determined programmatically or via a second more public source of information.
Another method for defeating attempts at unauthorized access into a password protected system is providing a distorted image of a word or number and asking the individual seeking access to enter that word or number, such as via typing on a keyboard. However, recent developments in computer vision have made it possible to programmatically decipher these images.
Therefore, a need remains to prevent unauthorized access of information stored in computer systems, such as by the use of sophisticated programs that try multiple username/password combinations and/or that programmatically decipher, and then submit for access, authenticating images set forth in the user authentication process.
The need of the prior art for preventing unauthorized access to secure systems is addressed by the present invention. In accordance with the invention, disclosed is a method for authenticating a user over a communication medium, the method comprising the steps of sending, via a communication medium, an instruction to the user that includes at least one element in which the user is directed to provide input that is not alphanumeric; in response to the instruction, the user preparing the instructed input and sending it via the communication medium; an authentication means receiving the input via the communication medium and checking it to determine whether it complies with the instruction; and, if results of the authentication means are sufficient, and the authentication means has sufficient identifying information regarding the user, sending via the communication medium an indication that the user is authenticated.
Also claimed is a computer program product capable of performing steps for authenticating a user over a communication medium, those steps comprising sending via a communication medium an instruction to the user that includes at least one element in which the user is directed to provide input that is not alphanumeric; receiving the input from the user via said communication medium; checking the input to determine whether it complies with the instruction; and, if results of said determination are sufficient, and with sufficient identifying information regarding the user, sending via the communication medium an indication that the user is authenticated.
Also claimed is a system for authenticating a user over a communication medium. The recited system comprises a first transmitter means to send via the communication medium an instruction to the user that includes at least one element in which the user is directed to provide input that is not alphanumeric; an authentication means to receive the input via the communication medium, to check it to determine whether it complies with the instruction, and to check for the sufficiency of identifying information regarding the user; and a second transmitter means to send to the user, via the communication medium, an indication regarding whether user is authenticated.
Also claimed is a method for providing the service of authenticating a user over a communication medium for access to a secure system. The recited method involves sending, via a communication medium, an instruction on behalf of the secure system to a user that includes at least one element in which the user is directed to provide input that is not alphanumeric; receiving user input in response to the instruction via the communication medium and checking the input to determine whether it complies with the instruction; and, if the user input is sufficient, sending via the communication medium an indication that the user input is sufficient.
For a fuller understanding of the present invention, reference should be made to the following detailed description taken in conjunction with the accompanying drawings.
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, will be best understood by reference to the following detailed description when read in conjunction with the accompanying drawings, wherein:
This invention is described in preferred embodiments in the following description with reference to the Figures, in which like numerals represent the same or similar elements. While this invention is described in terms of the best mode for achieving this invention's objectives, it will be appreciated by those skilled in the art that it is intended to cover alternatives, modifications, and equivalents as may be included within the spirit and scope of the invention as defined by the appended claims.
With reference now to the Figures,
The present invention could be implemented on a variety of hardware platforms.
With reference now to
In operation, a user employing a user device, such as keyboard 140 or mouse 142, sends a message over a network 110 (using communication link,138) to another device attached to the network 110, such as server 112. The server 112 may in turn be associated, for example with a call center or web server. As already noted, the server 112 may be any computing device, such as a personal computer, workstation or the like.
Those of ordinary skill in the art will appreciate that the hardware in
In the practice of the invention, a device within the distributed data processing system 100, such as server 112, serves as an authentication device or authentication server. The authentication device 112 serves to process requests for access to a secure system or database (not shown) from other devices in the network 100, such as but not limited to clients 116-118. In a typical system, a client 116 submits an identification string (such as a “user id” along with a password) over network 110 to the authentication device 112, which then checks the information using a CPU 122 against information contained on, e.g., a disk 134, to determine whether the information matches such that the client 116 should be granted access to the secure system. If the information provided by client 116 is sufficient, the client 116 will be informed of, and given, access to the secure system. If the information provided by client 116 is not sufficient or matching, the client 116 will typically be so informed and will be denied access to the secure system. It is noted that the invention is not limited to the foregoing authentication system, i.e., the use of a user id and password, but is rather contemplated to augment any system of user authentication through submission by the user of identifying information.
The authentication device 112 can be any device capable of authenticating a user, and could be as simple as a computer with software installed that is capable of storing all of the user identification strings for authorized users and, upon receipt of a request to access the secure system, checking such request against that information to determine whether access to the system should be granted. A large secure system would likely employ an authentication server 112 dedicated to the task of authenticating users.
Typically, in regard to a password protected system, a client 116 is permitted to attempt to request access to the secure system or database some specific number of times, e.g., “N” times, where “N” is set by the system administrator for the authentication process. A primary reason for limiting attempts to “N” times is in recognition of the possibility that the user is actually a computing device, as opposed to a human being, that is programmatically generating user Ids and passwords in an attempt to gain access, albeit improperly, to the secure system or database by guessing the user id and password. Typically, such programmatically generated attempts have certain patterns whereby the guesses derive from a dictionary or the like, and successive attempts to log on to the secure system are variations of the immediately preceding attempt.
Turning to
In Step 216, and in accordance with the present invention, the user is presented with an instruction. The instruction will require the user to submit input, at least one element of which is not alphanumeric. Examples of non-alphanumeric input include, but are not limited to, requiring the user to manipulate a mouse 142 or a stylus or the like in some prescribed fashion; to type non-alphanumeric information at a keyboard 140; or to touch a touch screen display at a prescribed location. Since the input required of the user of not alphanumeric, this step is useful in deterring improper logon by a programmatic dictionary attack. The instruction presented to the user in Step 216 is contemplated to be generated by a program running on the authentication server 112, or some computing device to which the authentication server 112 is linked. The display of the instruction on the screen 146 and the receipt and communication of user responses to the instruction can be accomplished by an applet running, for example, on the browser employed by the client 116 to navigate the network 110. The display of the instruction and the handling of user responses, or even the entire logon process, can be accomplished by the login window invoking a service to accomplish the same. The practice of the invention is not contemplated to be limited to any particular means of displaying the instruction or handling user responses to the instruction.
An example of an instruction to manipulate a mouse 142 that might be employed in the practice of the invention includes, but is not limited to, presenting the user with an object that moves on the display screen 146 and requiring the user to track the movement of the object with a mouse 142. Another example includes presenting the user with a series of random dots and requiring the user to connect the dots while the dots change position, such as by selecting, with the mouse 142, the area of the screen 146 that connects two series of dots. Another example includes presenting the user with an object on the screen 146 and instructing the user to move the object to some particular area on the screen 146, such as by selecting the object with a mouse 142, “dragging” the object (as is known in the art of manipulation of a mouse) to the target destination, and releasing the object at that destination. As one skilled in the art would recognize, the invention is not limited by the type of instruction presented by the user to be accomplished with a mouse or stylus or the like, so long as the input to be provided by the mouse or stylus or the like is not alphanumeric.
An example of an instruction to type non-alphanumeric information at a keyboard 140 that might be employed in the practice of the invention includes, but is not limited to, requiring the user to move a cursor to a prescribed location using the arrow keys, or the like. Another example of using a keyboard 140 in the practice of the invention includes requiring the user to type certain non-alphanumeric characters, such as press a particular function key, such as “F2.” An example of an instruction to touch a touch screen display that might be employed in the practice of the invention includes, but is not limited to, requiring the user to touch the screen at a prescribed location, such as to touch, e.g., with a stylus in the case of a PDA, an object blinking on a display screen 146.
In each such example of instructions presented to the user, the data processing system 120 captures the user's movement of the mouse 142, input on the keyboard 140, or touch on a touch screen, as applicable, and sends such response over the network 110 to authentication device 112, which in turn determines in Step 218, whether the user has successfully complied with the instruction in terms of accuracy and timing. For example, if the instruction presented to the user requires the user to track the movement of an object with a mouse 142, the user's accuracy in tracking the movement is determined and compared to a threshold level of compliance, with the threshold being set by the system administrator. Thus, this approach focuses on capturing a non-alphanumeric response based on an instruction displayed on a screen 146. If the user's accuracy in complying with the instruction is sufficient as determined in Step 218, the user is provided with another opportunity to enter his or her user ID and password (i.e., the user will be prompted with the logon page again), with “N” being reset to zero in Step 220. It is noted that an optional step may be included that allows only a certain number of resets of “N” before disabling logon.
If the user's accuracy in complying with the instruction is insufficient as determined in Step 218, and the user has not yet made at least M unsuccessful attempts (with “M” being set by the system administrator), the authentication server 112 presents the user with another instruction at Step 216. However, if the user has made M+1 attempts to comply with an instruction, the user will not be allowed to make another attempt at Step 216 but is instead the authentication server will disable any further logon attempts by the user at Step 224. Such disablement can be either permanent or time limited in nature, at the option of the system administrator or like decision maker in regard to the system.
In an additional option to the embodiment of the invention, it may be also determined, such as by the authentication device 112, whether a particular requester is an authorized user who is seeking authentication for access to the system, or whether instead the requester is an unauthorized requester who is using, for example, a dictionary attack or the like to improperly hack into the system. Such determination may be made programmatically based upon such factors as the number of attempted logons; the number of times a particular requester attempts to comply with the instruction provided in Step 216; and/or the level of inaccuracy (or perhaps complete lack of compliance) in performing the instruction at Step 218. If a determination is made that the requester is seeking to improperly obtain access to the system, the authentication device 112 or the like can take the further action of disabling future logon from the source of such attempts. The source can be identified using the IP address from which the request originates. Such disablement can be permanent or can be time limited, as preferred by a system administrator or other like decision maker.
For an additional measure of security, the authentication server 112 may provide the instruction to the user in Step 216 in a distorted image, rather than in plain text, thereby rendering it more difficult for a programmatic attack to decipher the instruction.
Turning to
Continuing with
Turning to
Turning to
The invention may be implemented in regard to any secure system to prevent unauthorized access to that system by, for example, a hacker using programmatic guessing of user id's and passwords. A third party or “service provider” may employ the invention in order to accomplish some or all of the foregoing tasks for or on behalf of any such secure system. For these reasons, the steps depicted in
Turning to
The invention can be realized in hardware, software, or a combination of hardware and software. The invention can be realized in a centralized fashion in one computer system, or in a distributed fashion where different elements are spread across several interconnected computer systems. Any kind of computer system or other apparatus adapted for carrying out the methods described herein is suited. A typical combination of hardware and software can be a general purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the methods described herein.
The invention can be embedded in a computer program product, which comprises all the features enabling the implementation of the methods described herein, and which when loaded in a computer system is able to carry out these methods. Computer program in the present context means any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following: a) conversion to another language, code or notation; b) reproduction in a different material form.
While the preferred embodiments of the present invention have been illustrated in detail, the skilled artisan will appreciate that modifications and adaptations to those embodiments may be made without departing from the scope of the present invention as set forth in the following claims.
