System and method of inkblot authentication

#This invention pertains generally to computer systems, and, more particularly, to computer system user authentication.

#Computer system user authentication, that is, providing evidence of a user's identity to a computer system and then verification of that evidence by the computer system, has become a familiar task for millions of computer system users. User authentication is a cornerstone of computer system security. The ability for a computer system to authenticate user identity enables the enforcement of computer system security policies from simple yes/no data access to sophisticated resource privilege management.

#It is common to classify user authentication into three main types based on how the user provides evidence of their identity to the computer system. In knowledge-based user authentication, the user provides information to the computer system that the user has previously memorized, such as a password. In token-based user authentication, the possession of a particular object, such as a key card incorporating computer-readable media, provides the evidence. In biometric user authentication, the user's biological characteristics, such as the user's fingerprints, are detected by the computer system and compared to the characteristics on record. In addition, combinations of these authentication types are possible, for example, an automated teller machine (ATM) requires a user to provide both a token (an ATM card) and memorized information (a personal identification number or PIN) before it will dispense cash.

#While the appended claims set forth the features of the present invention with particularity, the invention and its advantages are best understood from the following detailed description taken in conjunction with the accompanying drawings, of which:

#FIG. 1 is a schematic diagram generally illustrating an exemplary computer system suitable for implementing an embodiment of the invention;

#FIG. 2 is a block diagram depicting an example modular software architecture suitable for incorporating aspects of the invention;

#The invention is embodied in a computer system that utilizes authentication inkblots to help computer system users first select and later recall authentication information from high entropy information spaces. An inkblot authentication module is configured to generate authentication inkblots from authentication inkblot seeds. On request, a (local or remote) security authority generates, stores and supplies an authentication inkblot seed set for a user. The authentication inkblots are displayed on a graphical output device, and, in response to the authentication inkblot, a user inputs one or more alphanumeric characters. The responses to one or more authentication inkblots serve as authentication information. In general, a longer series of authentication inkblots presented during authentication results in authentication information from a higher entropy information space. It is possible to utilize authentication information thus generated in place of a conventional password, although there are usability advantages to allowing an authentication information match ratio of less than 100%.

#An authentication inkblot is generated from an authentication inkblot seed by initializing a pseudo-random number generator with the authentication inkblot seed and then determining the authentication inkblot parameter values as a function of one or more pseudo-random values. Authentication inkblot parameters include number of blots, blot location, blot size, blot color, blot rotation, blot shape, Perlin noise, axes of symmetry, axis of symmetry angle from vertical, and the like. Suitable authentication inkblots typically have several such parameters.

#A computer system user associates authentication information with each authentication inkblot. A user's natural language description of the authentication inkblot is able to serve as authentication information, however, by utilizing a user-computable hash of the natural language description as the authentication information instead, the authentication process is made more efficient. By utilizing a user-computable hash of the natural language description that results in a constant number of alphanumeric characters, such as, “take the first and last characters of the description”, the authentication process can be made more efficient still, because a low entropy ‘enter’ character is not required to progress the display of an authentication inkblot series.