# US 11,468,157 B2 · Method for authenticating a user by user identifier and associated graphical password > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,468,157 B2 - Document ID: US11468157B2 - Status: Granted - Kind: B2 - Application number: 16/590,498 - Filed: 2019-10-02 - Published: 2020-04-02 - Granted: 2022-10-11 - Earliest claimed: 2018-10-02 - Assignees: Evidian - Applicants: Evidian - Inventors: Christophe Guionneau; Valérie Clement - Web page: https://patentgrep.com/patent/US11468157B2 ## CPC - G06F 21/36: by graphic or iconic representation - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F 21/46: by designing passwords or checking the strength of passwords - G06F 21/602: {Providing cryptographic facilities or services} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04W 12/06: Authentication - G06F 2221/2103: Challenge-response - H04W 12/77: Graphical identity - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed is a method for authenticating a user by user identifier and associated graphical password. The graphical password includes a sequence of several images belonging to a group of images. The user provides a user identifier to an application, and graphically selects a sequence of several images in this group of images, the image order being randomly displayed by the application with each authentication of the user. The application identifies the position of each selected image in the sequence, establishes the correspondence between the sequence of the positions and the sequence of the identifiers of the selected images, compares the sequence of the selected images identifiers with the registered sequence, the application being the only entity able to establish this correspondence and/or the application being the only entity able to make this comparison, and authenticates the user if the comparison is positive but refuses authentication for negative comparison. ## Claims ### Claim 1 Method for authenticating a user (17) by user identifier and associated graphical password (6), where the graphical password (6) comprises a first part obtained by a first selection of a group of images (1-5) from several groups of images (1-5), and a second part obtained by a second selection of a sequence of several images (A-Y) in the selected group of images (1-5), the method comprising: requesting the user (17) give a user identifier to an application (12), and graphically select: a first selection of a group of images (1-5) in a set of several groups of images (1-5), the order of the groups of images (1-5) in this set of groups of images (1-5) being randomly displayed by the application (12) with each new authentication of said user (17), a second selection of a sequence of several images (A-Y) in this group of images (1-5), the order of the images (A-Y) in this group of images (1-5) being randomly displayed by the application (12) with each new authentication of said user (17), identifying the position of the selected group of images (1-5) in said set of groups of images (1-5) and identifying the position of each selected image (A-Y) in said sequence, establishing (14) the correspondence between the position of the selected group of images (1-5) and the identifier of the selected group of images (1-5), and between the sequence of the positions of the selected images (A-Y) and the sequence of the identifiers of the selected images (A-Y), comparing (15-16) the identifier of the group of selected images (1-5) with the identifier of the group of images (1-5) of the password (6) registered for said user (17) identifier, and comparing the sequence of the identifiers of the selected images (A-Y) with the sequence of the identifiers of the images (A-Y) of the password (6) registered for said user (17) identifier, the application (12) being the only entity able to establish this correspondence and/or the application (12) being the only entity able to make this comparison; and authenticating (15) said user (17) if said comparison is positive but refusing (16) to authenticate said user (17) if said comparison is negative; wherein said order of the groups of images (1-5) in this set of groups of images (1-5) is randomly displayed by the application (12) with each new authentication of said user (17), in the form a carousel (19) of image grids (1-5). ### Claim 2 (depends on 1) Authentication method according to claim 1, wherein said order of the images (A-Y) in this group of images (1-5) is randomly displayed by the application (12) with each new authentication of said user (17), in the form of a grid of images (1-5) distributed into rows and columns. ### Claim 3 (depends on 1) Authentication method according to claim 1, wherein the number of groups of images (1-5) in the set of groups of images (1-5) is at least two or even at least five times smaller than the number of images (A-Y) in a group of images (1-5), regardless of whether all the groups (1-5) have the same number of images (A-Y). ### Claim 4 (depends on 1) Authentication method according to claim 1, wherein the images (A-Y) are divided into the groups of images (1-5) by theme. ### Claim 5 (depends on 1) Authentication method according to claim 1, further comprising: sending the number of the selected group (1-5) and/or the coordinates of each selected image (A-Y) in said sequence to an authentication function (8) which establishes the correspondence between said number and the identifier of the selected group (1-5) and/or between the sequence of said coordinates and the sequence of the identifiers of the selected images (A-Y), the authentication function (8) being the only entity able to establish this correspondence comparing (15-16), in a database (9), the identifier of the selected group (1-5) and the sequence of the identifiers of the selected images (A-Y) respectively with the identifier of the group (1-5) of the password (6) registered for said user (17) identifier and with the sequence of the identifiers of the images (A-Y) of the password (6) registered for said user (17) identifier, the database (9) being the only entity able to make this comparison; and authenticating (15) said user (17) if said comparison is positive but refusing (16) to authenticate said user (17) if said comparison is negative. ### Claim 6 (depends on 5) Authentication method according to claim 5, wherein: said graphical interface (7), said authentication function (8), and said database (9) are under the control of at least two independent actors, and when said application (12) runs in client-server mode, said graphical interface (7) is located on the client while said authentication function (8) and said database (9) are located on the server. ### Claim 7 (depends on 6) Authentication method according to claim 6, wherein said graphical interface (7), said authentication function (8), and said database (9) are under the control of three independent actors. ### Claim 8 (depends on 1) Authentication method according to claim 1, wherein: said set of groups of images (1-5) comprises a number of groups of images (1-5) which is between 3 and 10, and/or said groups of images (1-5) each comprise a number of images (A-Y) which is comprised between 10 and 50. ### Claim 9 (depends on 1) Authentication method according to claim 1, wherein several separate applications (12) use the same images (A-Y) but with a different distribution between groups of images (1-5) from one application (12) to another. ### Claim 10 (depends on 1) Authentication method according to claim 1, wherein the graphical password (6) is stored by the application (12) in a non-reversible form. ### Claim 11 (depends on 1) Authentication method according to claim 1, wherein: either no image (A-Y) is common to two groups of images (1-5) that are distinct from each other, or, if one or more images (A-Y) are common to at least two groups of images (1-5) that are distinct from each other, then for at least half of the groups of images (1-5), any two groups of images (1-5) in this half of the groups of images (1-5) always have less than half of their images (A-Y) in common. ### Claim 12 Method for authenticating a user (17) by user identifier and associated graphical password (6), where the graphical password (6) comprises a first part obtained by a first selection of a group of images (1-5) from several groups of images (1-5), and a second part obtained by a second selection of a sequence of several images (A-Y) in the selected group of images (1-5), the method comprising: requesting the user (17) give a user identifier to an application (12), and graphically select: a first selection of a group of images (1-5) in a set of several groups of images (1-5), the order of the groups of images (1-5) in this set of groups of images (1-5) being randomly displayed by the application (12) with each new authentication of said user (17), a second selection of a sequence of several images (A-Y) in this group of images (1-5), the order of the images (A-Y) in this group of images (1-5) being randomly displayed by the application (12) with each new authentication of said user (17), identifying the position of the selected group of images (1-5) in said set of groups of images (1-5) and identifying the position of each selected image (A-Y) in said sequence, establishing (14) the correspondence between the position of the selected group of images (1-5) and the identifier of the selected group of images (1-5), and between the sequence of the positions of the selected images (A-Y) and the sequence of the identifiers of the selected images (A-Y), comparing (15-16) the identifier of the group of selected images (1-5) with the identifier of the group of images (1-5) of the password (6) registered for said user (17) identifier, and comparing the sequence of the identifiers of the selected images (A-Y) with the sequence of the identifiers of the images (A-Y) of the password (6) registered for said user (17) identifier, the application (12) being the only entity able to establish this correspondence and/or the application (12) being the only entity able to make this comparison; and authenticating (15) said user (17) if said comparison is positive but refusing (16) to authenticate said user (17) if said comparison is negative, further comprising: sending the number of the selected group (1-5) and/or the coordinates of each selected image (A-Y) in said sequence to an authentication function (8) which establishes the correspondence between said number and the identifier of the selected group (1-5) and/or between the sequence of said coordinates and the sequence of the identifiers of the selected images (A-Y), the authentication function (8) being the only entity able to establish this correspondence, comparing (15-16), in a database, the identifier of the selected group (1-5) and the sequence of the identifiers of the selected images (A-Y) respectively with the identifier of the group (1-5) of the password (6) registered for said user (17) identifier and with the sequence of the identifiers of the images (A-Y) of the password (6) registered for said user (17) identifier, a database (9) being the only entity able to make this comparison; and authenticating (15) said user (17) if said comparison is positive but refusing (16) to authenticate said user (17) if said comparison is negative, wherein said graphical interface (7), said authentication function (8), and said database (9) are under the control of at least two independent actors. ### Claim 13 (depends on 12) Method according to claim 12, wherein said graphical interface (7), said authentication function (8), and said database (9) are under the control of three independent actors.