Patent ID: 9674177
Date: 2017-06-06
CPC Classifications: G06F,H04L

Claim:
1. A method for authenticating a user attempting to access a protected resource via a processing device without requiring the user to present a predetermined credential, the method comprising the steps of: receiving, from the user, a request to access the protected resource without providing a predetermined credential associated with the user, wherein the protected resource is an internal resource of the processing device accessible via user authentication; extracting one or more characteristics from information stored within the protected resource, wherein the extracted one or more characteristics comprise data associated with activity performed by the user during a previous authenticated access made using the predetermined credential; processing the extracted one or more characteristics to formulate one or more questions for the user; presenting the one or more questions to the user; receiving input from the user responsive to the presenting of the one or more questions; granting or denying access to the protected resource without using the predetermined credential based at least in part on the input received from the user; and responsive to denying access to the protected resource without using the predetermined credential, applying a throttling mechanism requiring the user to wait a predetermined time before being permitted to make a new request to access the protected resource without using the predetermined credential to reduce a likelihood of inferring the extracted one or more characteristics from the one or more questions presented over multiple requests to access the protected resource without using the predetermined credential; wherein the predetermined time is increased after each unsuccessful attempt to access the protected resource without using the predetermined credential; and wherein the information stored within the protected resource comprises information stored entirely in a memory of the processing device in an ordinary course of operation of the protected resource during the previous authenticated access.