Patent Application
20120304284
This application claims priority from Australian Patent Application Serial No. 2011202415, filed May 24, 2011, the contents of which are incorporated herein by reference in its entirety.
A computing device, such as a laptop, a desktop, a tablet computer, a handheld device, or a server, may contain sensitive data that a user does not want disseminated to the general public. Similarly, a service, such as an e-mail account, banking service, social network, or remote work computer access, may contain data that may be damaging in malicious hands. Thus, a computing device or service may use password protection to restrict access to only authorized users who can authenticate a right of access to a user session. A login interface may query the user for a password having a series of characters, such as letters, numbers, and signs. An authentication service may deny access to the user if the characters are an improper order, if the letters are in the wrong case, or if the password fails to match the stored password in any way.
The authentication service may give the user a set number of tries at providing the password before that user is blocked from further attempts to access the computing device or service. The user may then contact an administrator to access the service or computing device, after providing some proof of identification. Such proof of identification may be a government identification or a pre-registered set of questions that presumably only the user can answer. Alternately, if the user fails to provide the proper password, a computing device or service may erase any important data.
An issue of password protection may be that a password that is complex enough to provide a proper level of protection may be too difficult for a user to remember. Most users may often use easily determined passwords like “Guest”, a user's name, or other easily divinable passwords. Users that use a properly complex password may often forget the password, leading to a very frustrating user experience.
This Summary is provided to introduce a selection of concepts in a simplified form that is further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.
Embodiments discussed below relate to a picture signature password system may use a picture signature password to determine access to a computing device or service. A display screen may display a personalized digital image. A user input device may receive a user drawing set executed by a user over the personalized digital image. A processor may authenticate access to the user session if the user drawing set matches a library drawing set associated with the user.
In order to describe the manner in which the above-recited and other advantages and features can be obtained, a more particular description is set forth and will be rendered by reference to specific embodiments thereof which are illustrated in the appended drawings. Understanding that these drawings depict only typical embodiments and are not therefore to be considered to be limiting of its scope, implementations will be described and explained with additional specificity and detail through the use of the accompanying drawings.
a-b illustrate, in block diagrams, two picture signature passwords.
a-d illustrate, in block diagrams, a library drawing set record.
Embodiments are discussed in detail below. While specific implementations are discussed, it should be understood that this is done for illustration purposes only. A person skilled in the relevant art will recognize that other components and configurations may be used without parting from the spirit and scope of the subject matter of this disclosure. The implementations may be a machine-implemented method, a tangible machine-readable medium having a set of instructions detailing a method stored thereon for at least one processor, or a picture signature password system for a computing device.
A picture signature password system may increase the complexity of the authentication process while improving usability by implementing a picture signature password. A picture signature password combines a digital image with a series of user selected drawings performed over the digital image. The digital image may be further ingrained in the memory of the user by allowing the user to supply a personalized digital image from the user's own digital image library. Alternatively, the user may select the digital image from a library of default digital images provided with the authentication service. While a display with an integrated touch screen may increase the ease of use by allowing the user to directly apply the drawings with a finger, a user may also apply more traditional input methods such as a mouse, interactive stylus, or keyboard cursor control. Once authenticated, the user may use the service or computing device in a “user session”, or period of authenticated use.
A simple picture signature password may apply a series of “touch points” to the digital image. The word “touch point” refers to selection of a position on the digital image, whether through a touch on a touch screen or by clicking with a mouse or other input. A more complex picture signature password may incorporate a gesture, combining selection of a set of positions with a movement. A gesture may include a simple shape, such as a circle gesture or a straight line gesture, or even more complex freestyle form gestures. A drawing is either a touch point or a gesture. A gesture set may have one or more gestures, while a drawing set may have one or more gestures or touch points. Neither the gesture set nor the drawing set is a null set.
The picture signature password system may improve usability of a picture signature password by visual representing, or “tracing”, the drawing set as received over top the digital image as the user enters the drawing set. Thus, the user may check that the drawing set is being received as intended. The picture signature password system may compare the drawing set entered by the user, or “user drawing set”, against a previously entered drawing set stored on the system, or “library drawing set”.
In one embodiment, a picture signature password system may use a picture signature password to determine access to a computing device or service. A display screen may display a personalized digital image. A user input device may receive a user drawing set executed by a user over the personalized digital image. A processor may authenticate access to a user session if the user drawing set matches a library drawing set associated with the user.
The processor 120 may include at least one conventional processor or microprocessor that interprets and executes a set of instructions. The memory 130 may be a random access memory (RAM) or another type of dynamic storage device that stores information and instructions for execution by the processor 120. The memory 130 may also store temporary variables or other intermediate information used during execution of instructions by the processor 120. The ROM 140 may include a conventional ROM device or another type of static storage device that stores static information and instructions for the processor 120. The storage device 150 may include any type of tangible machine-readable medium, such as, for example, magnetic or optical recording media and its corresponding drive. The storage device 150 may store a set of instructions detailing a method that when executed by one or more processors cause the one or more processors to perform the method. The storage device 150 may also be a database or a database interface for storing a picture signature password for the user.
The user input device 160 may include one or more conventional mechanisms that permit a user to input information to the computing device 100, such as a keyboard, a mouse 162, an interactive stylus 164, a touch screen 166, a direct motion input device 168, a voice recognition device, a microphone, a headset, etc. An interactive stylus 164 is a stylus, such as a laser pen, that interacts with a display screen allowing a user to select or input data. A touch screen 166 is a display that interacts with a finger of a user to allow the user to directly select or input data. A direct motion input 168 is a camera or other image or motion capture device that may read a motion made by a user. The output device 170 may include one or more conventional mechanisms that output information to the user, including a display screen 172, a printer, one or more speakers, a headset, or a medium, such as a memory, or a magnetic or optical disk and a corresponding disk drive. The display screen 172 may have an integrated interactive touch screen 166, allowing users to select data representations on the display screen 172 by touching them. The communication interface 180 may include any transceiver-like mechanism that enables processing device 100 to communicate with other devices or networks. The communication interface 180 may include a network interface or a mobile transceiver interface. The communication interface 180 may be a wireless, wired, or optical interface. In one embodiment, the communication interface 180 may include a universal serial bus (USB) interface, a Bluetooth® interface, or other such interface that may be used to attach peripheral devices or pair other computing devices.
The computing device 100 may perform such functions in response to a processor 120 executing sequences of instructions contained in a computer-readable medium, such as, for example, the memory 130, a magnetic disk, or an optical disk. Such instructions may be read into the memory 130 from another computer-readable medium, such as the storage device 150, or from a separate device via the communication interface 180.
The picture password enrollment user experience 212 may send the text password, image path, and drawing set to a picture password enrollment local process 220 executing a picture enrollment class 222. The picture enrollment class 222 may process the drawing set and digital image to create the picture signature password. The picture enrollment class 222 may send the picture signature password and the text password to a system vault 230 which securely stores that data.
The next time that a user seeks to authenticate a session, a login user interface (UI) local process 240 may execute a picture verification class 242 to receive the authentication information from the user. The picture verification class 242 may retrieve the picture signature password and the text password from the system vault 230. The picture verification class 242 may prompt the user to complete the picture signature password by presenting the digital image to the user. The user may enter a user drawing set to be applied to the digital image to create the picture signature password. If the user fails to properly complete the picture signature password, then the picture verification class 242 may prompt the user for the text password.
A picture signature password system may implement the authentication service 200.
The drawing set may be superimposed on the personalized digital image. The drawing set may include a series of one or more touch points 320 or gestures. A touch point 320 is a touch on a touch screen 166 or a cursor click from another input device 160 at a point on the personalized digital image 310. A touch point 320 has position but no movement vector. Conversely, a gesture has a position and a movement vector. A gesture may be a line gesture 330, circle gesture 340, or freestyle form gesture.
For example, as shown in
A second example of a picture signature password 350 is shown in
A library drawing set is a drawing set stored with the picture signature password system after initial input by the user upon creating an account with a computing device or a service. Additionally, a user drawing set is a drawing set entered to access a session once an account has been created. The library drawing set may be stored in the system vault 230 as a library drawing set record.
Whether a library drawing set or a user drawing set, each member of a drawing set may be identified by a set of position data. The position data set indicates where the user has touched or clicked. For a touch screen, the position data set may include all points touched by the finger of the user, or a representative point, such as the center of the finger.
Similarly, each gesture may be identified by a set of position data and a set of vector data. The vector data set indicates the direction the user moves that touch or click. For a touch point, the vector data set is empty, as no movement occurs.
Additionally, each member of a drawing set may be associated with a set of timing data. For a touch point, the set of timing data may indicate the duration of entry of the touch point. For a gesture, the set of timing data may indicate the speed of entry of the gesture.
For specific drawing types, the picture signature password may use a specific data storage format to represent a library drawing set member. For example, a touch point 320 may be represented by a touch point library drawing set record 400, as shown in
The library drawing set record may have a user identification (ID) 402 to identify the user associated with the library drawing set. The library drawing set record may have a user setting identifier 404 allowing different picture signature passwords or different tolerances for different settings. The user setting describes the location of the user, such as a home location, a work location, or a public location. For example, the picture signature password system may have a user more strictly recreate the library drawing set if the user is accessing the system from a public location as opposed to a home location. The library drawing set record may have an image identifier 406 to identify the digital image that acts as a prompt for the user.
The library drawing set record may have a library drawing set member (LDSM) field 408 identifying a member of the library drawing set. The library drawing set record may have a type field 410 that identifies the library drawing set member 408 as a touch point 320, line gesture 330, circle gesture 340, or freestyle form gesture 370.
A touch point library drawing set record 400 or a general library gesture set record 420 may have a library position set (LPS) field 412 associated with the graphic coordinates of the library drawing set member. The library position set field 412 may indicate points at a pixel or sensor level. The library position set field 412 may have an associated position tolerance (PT) field 414 representing a position tolerance value. The position tolerance value indicates how far the user position set associated with a user drawing set may be from the library position set while still considered to match the library position set.
The library drawing set record may have a timing data set field 416 associated with the speed of entry or duration of entry of the library drawing set member. For a touch point library drawing set record, the timing data set field 416 may indicate the duration that a touch point is held. For a general library drawing set record 420, the timing data set field 416 may indicate the speed that a gesture is entered. The timing data set field 416 may also be used to indicate whether a first member of a drawing set is to be entered concurrent with a second member of the drawing set. For example, a user may hold a touch point 320 while entering a circle gesture 340.
The general library gesture set record 420 may have a library vector set (LVS) field 422 associated with the direction of the library drawing set member. The library vector set field 422 may have an associated vector tolerance (VT) field 424 representing a vector tolerance value. The vector tolerance value indicates how far the user vector set associated with a user drawing set may be from the library vector set while still considered to match the library vector set. The general library gesture set record 420 may be used to indicate a touch point 320 by setting the library vector set field 422 to zero.
For a line gesture 330, a line library gesture set record 440 may store a start point field 442 indicating the beginning of the line gesture 330 and an end point field 444 indicating the end of the line gesture 330, with points in between implied. The start point field 442 may have an associated start point tolerance (SPT) field 446 representing a start point tolerance value and the end point field 444 may have an associated end point tolerance (EPT) field 448 representing an end point tolerance value. The start point tolerance value and the end point tolerance value indicate how far the user start point and user end point associated with a user line gesture 330 may be from the library line gesture 330 while still considered to match the library line gesture 330.
For circle gestures 340, the circle library gesture set record 460 may store a center point field 462 indicating the center of the circle gesture 340. The center point field 462 may have an associated center point tolerance (CPT) field 464 representing a center point tolerance value. The center point tolerance value indicates how far the user center point associated with a user circle gesture 340 may be from the library circle gesture 340 while still considered to match the library circle gesture 340. The circle library gesture set record 460 may store a radius field 466 indicating the radius of the library circle gesture 340. The radius field 466 may have an associated radius tolerance (RT) field 468 representing a radius tolerance value. The radius tolerance value indicates how far the user radius associated with a user circle gesture 340 may be from the library circle gesture 340 while still considered to match the library circle gesture 340. The circle library gesture set record 460 may store a direction field (DIR) 470 indicating the direction that the circle gesture 340 is drawn, such as clockwise or counterclockwise.
If the confirmation library drawing set input matches the initial library drawing set input (Block 610), the picture signature password system may create a library drawing set from the initial library drawing set input (Block 616). The picture signature password system may associate a library drawing set member with a library position set (Block 618). The picture signature password system may associate a library drawing set member with a library vector set (Block 620). The picture signature password system may adjust the position tolerance value for the library position set and the vector tolerance value for the library vector set based on the user profile (Block 622). For example, a child may be given greater tolerance than an adult in recreating the drawing set as a user drawing set.
The user drawing set may include a user touch point, a user circle gesture, a user line gesture, or a user freestyle form gesture. To increase complexity, the picture signature password system may have the user drawing set have at least one user gesture. The user gesture may be a user circle gesture, a user line gesture, or a user freestyle form gesture. For even higher complexity, the picture signature password system may receive a user gesture set executed by a user over a digital image. The user gesture set may include a user circle gesture, a user line gesture, or a user freestyle form gesture.
The picture signature password system may trace the user drawing set onto the personalized digital image, to illustrate to the user where the user is drawing (Block 712). If the user drawing set matches a library drawing set associated with the user (Block 714), then the picture signature password system may authenticate access to the user session (Block 716). If the user drawing set does not match a library drawing set associated with the user (Block 714), the login attempt counter is incremented (Block 718). If the login attempt counter is less than the maximum number of allowed attempts (MAXA) (Block 720), the picture signature password system may request reentry of the user drawing set (Block 722). If the login attempt counter exceeds the maximum number of allowed attempts (Block 720), the picture signature password system may request a text password (Block 724). If the text password matches the library text password associated with the user (Block 726), then the picture signature password system may authenticate access to the user session (Block 716). If the text password does not match the library text password associated with the user (Block 726), then the picture signature password system may deny access to the user session (Block 728).
If the member score equals a matching score (MS) (Block 822), the picture signature password system may determine the user drawing set and the library drawing set match (Block 824). The matching score may not indicate that every member of a user drawing set matches, as the picture signature password system may determine that the user drawing set matches the library drawing with a majority of user drawing set members matching a majority of library drawing set members. Thus, for example, if a user accurately enters three out of four user drawing set members, the user may be given greater leeway on the fourth and final user drawing set member. The last user drawing set member may be ignored or have the tolerance values for that user drawing set member increased. The picture signature password system may measure the user accuracy in using the authentication service (Block 826). The picture signature password system may adjust the position tolerance value and the vector tolerance value based on the user accuracy (Block 828). Thus, if a user is consistently shown to be highly accurate when entering the user drawing set, the tolerance values for that user may be decreased over time to improve security.
Alternately, a picture signature password system may calculate an individual comparison score for a user drawing set member based on proximity to the library drawing set member. The picture signature password system may aggregate the individual comparison score for each user drawing set member into an aggregate comparison score. The aggregate comparison score represents the total deviation of the user drawing set from the library drawing set. If the aggregate comparison score exceeds a maximum limit for deviation, then the picture signature password system may determine that the user drawing set matches the library drawing set. Thus the picture signature password may determine that the user drawing set matches the library drawing set based on an aggregate comparison score for the entire user drawing set, rather than on an individual user drawing set member basis.
Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms for implementing the claims.
Embodiments within the scope of the present invention may also include non-transitory computer-readable storage media for carrying or having computer-executable instructions or data structures stored thereon. Such non-transitory computer-readable storage media may be any available media that can be accessed by a general purpose or special purpose computer. By way of example, and not limitation, such non-transitory computer-readable storage media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to carry or store desired program code means in the form of computer-executable instructions or data structures. Combinations of the above should also be included within the scope of the non-transitory computer-readable storage media.
Embodiments may also be practiced in distributed computing environments where tasks are performed by local and remote processing devices that are linked (either by hardwired links, wireless links, or by a combination thereof) through a communications network.
Computer-executable instructions include, for example, instructions and data which cause a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. Computer-executable instructions also include program modules that are executed by computers in stand-alone or network environments. Generally, program modules include routines, programs, objects, components, and data structures, etc. that perform particular tasks or implement particular abstract data types. Computer-executable instructions, associated data structures, and program modules represent examples of the program code means for executing steps of the methods disclosed herein. The particular sequence of such executable instructions or associated data structures represents examples of corresponding acts for implementing the functions described in such steps.
Although the above description may contain specific details, they should not be construed as limiting the claims in any way. Other configurations of the described embodiments are part of the scope of the disclosure. For example, the principles of the disclosure may be applied to each individual user where each user may individually deploy such a system. This enables each user to utilize the benefits of the disclosure even if any one of a large number of possible applications do not use the functionality described herein. Multiple instances of electronic devices each may process the content in various possible ways. Implementations are not necessarily in one system used by all end users. Accordingly, the appended claims and their legal equivalents should only define the invention, rather than any specific examples given.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2011202415 | May 2011 | AU | national |
