Providing time ratio-based password/challenge authentication

Providing registration for password/challenge authentication includes receiving an access code or pattern inputted by a user, recording a time message associated with each component of the access code or pattern via a processor, generating a data record in combining each component of the access code or pattern with the associated time message, and storing the data record.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the right of priority based on Taiwan Patent Application No. 100135801, entitled “Method and Computer System For Providing Time Ratio-Based Password/Challenge Authentication”, filed on Sep. 30, 2011. The entire content of the aforementioned application is incorporated herein by reference.

BACKGROUND

Daily life requires the use of a wide variety of information devices, such as mobile phones, personal computers, notebook computers, and tablet computers. The information devices may keep users' personal data and identity data. Due to the prevalence of networks, an increasing number of network functions are performed on-line. In particular, servers have to store users' personal data and identity data in order to provide network services, such as social networking services, webpage/email services, mobile commerce services, banking on-line transaction services, database access services, or content and information provider services. Hence, to ensure security and privacy, the servers usually require that, before accessing the services provided by the servers, users have to follow an authentication procedure for recognizing the users' identity. At present, one of the most common authentication procedures is a password-based challenge authentication procedure whereby a server typically requires that, before accessing its services, users ought to enter a username and a password for identity recognition (or known as “login”), in order to prevent user personal data from being stolen or fraudulently changed.

With network coverage and accessibility increasing rapidly, hackers are becoming more likely to target a user's password with a view to faking the user's identity. Therefore, simple passwords no longer provide adequate protection; in view of this, various mechanisms are put forth to provide better protection. For example, users are required to create a password that meets the requirements of password length, complexity, and unpredictability, such that the strength of the password is sufficient to fend off brute-force search attacks and dictionary attacks. Furthermore, users are required to change their passwords regularly to invalidate old passwords, thereby reducing the chance that their passwords will be cracked. The aforesaid mechanisms enhance security and thus help users protect their accounts.

However, referring toFIG. 1, a client end100requests access to different web services and an authentication procedure of a username/password102provided by website A110, website B120, and website C130through a network140by means of a challenge101. In practice, most users usually use different usernames/passwords to log in website A110, website B120, and website C130, respectively. The mechanisms require users to memorize passwords for accessing the web services of different websites, respectively. Furthermore, users usually log in a small number of websites on a daily basis, and thus are unlikely to memorize accurately the passwords of those websites which are seldom visited by them; hence, they have to guess the rarely-used passwords, not to mention that their accounts would be locked out after incorrect password entries.

Therefore, there is a need to assist users in memorizing troublesome passwords while ensuring security. A solution lies in conventional one-time password (OTP) technology. However, OTP technology can provide passwords to users only when additional technology is accessible. In most circumstances, OTP technology requires an electronic device. Chances are the electronic device will get lost, and thus the risk of losing the passwords is always there. Furthermore, it is unlikely for an organization to share its OTP generation mechanism with another organization; hence, to access web services provided by different websites, respectively, a user has to use their respective electronic devices. Therefore, users have to carry multiple portable electronic devices, thereby adding to a loss risk.

Another solution is provided by a password hint mechanism. However, the mechanism works at the cost of undermining password security, because unauthorized persons can also see the password hint and therefore help a hacker crack the password. Furthermore, the mechanism is not effective in giving an appropriate password hint to a complicated password. Therefore, sensitive systems nowadays seldom use the mechanism.

Lots of methods for providing a more secure password-based challenge have been proposed, one of which can be referred to U.S. Pat. No. 7,653,818, which is incorporated herein by its entirety. It disclosed a method of incorporating password with a timing factor, such as time limit of keystrokes, a predetermined length of pause between keystrokes, etc., to enhance security and prevent unauthorized access.

BRIEF SUMMARY

An embodiment can include a method of providing registration for password/challenge authentication. The method includes receiving an access code or pattern inputted by a user, recording a time message associated with each component of the access code or pattern using a processor, generating a data record in combining each component of the access code or pattern with the associated time message, and storing the data record.

Another embodiment can include a method. The method includes calculating a beat ratio from a first ending component of a stored access code or pattern and of a user-inputted access code or pattern using a processor, transforming each component of the stored access code or pattern by means of the beat ratio, calculating an acceptable beat range by means of a predetermined acceptable threshold, and determining whether, within the acceptable beat range, each component of the user-inputted access code or pattern matches the corresponding component of the stored access code or pattern.

Another embodiment can include a system. The system includes a processor configured to initiate executable operations for providing registration for time ratio based password/challenge authentication. The executable operations include receiving an access code or pattern inputted by a user, recording a time message associated with each component of the access code or pattern, generating a data record in combining each component of the access code or pattern with the associated time message, and storing the data record.

Another embodiment can include a system. The system includes a processor configured to initiate executable operations for providing login for time ratio based password/challenge authentication. The executable operations include calculating a beat ratio from a first ending component of a stored access code or pattern and of a user-inputted access code or pattern, transforming each component of the stored access code or pattern by means of the beat ratio, calculating an acceptable beat range by means of a predetermined acceptable threshold, and determining whether, within the acceptable beat range, each component of the user-inputted access code or pattern matches the corresponding component of the stored access code or pattern.

Another embodiment can include a computer program product for providing registration for password/challenge authentication. The computer program product includes a computer-readable storage medium having stored thereon program code that, when executed, configures a processor to perform executable operations. The executable operations include receiving an access code or pattern inputted by a user, recording a time message associated with each component of the access code or pattern, generating a data record in combining each component of the access code or pattern with the associated time message, and storing the data record.

DETAILED DESCRIPTION

Embodiments of the present invention relate to a mechanism for password-based challenge authentication, and more particularly, to a method for dynamically providing time ratio-based password/challenge authentication and a computer system using the method.

In view of the foregoing, one aspect of the present invention is to provide a novel password-based challenge mechanism to identify the user's identity. In addition to the password input sequence, the mechanism also considers keystroke time, pause time between keystrokes, and rhythm, tempo, or beat of entry as a part of the password. In addition to time associated factors, the embodiments of the present invention also consider the tempo of entering password (or referred to as access code) (or pattern inputted through touch screen) to perform a so-called time ratio-based password/challenge authentication method of the present invention. That is, passwords being entered according to different tempo (faster or slower) will be considered as the same password.

Furthermore, the embodiments of the present invention also allow multi-key or multi-touch input as a part of the password to provide a function similar to play on a musical instrument. Accordingly, the embodiments of the present invention are applicable to a variety of input devices, such as keyboard, touch screen, mouse, etc. The user can press the key “A” and the key “B” simultaneously or click the left button and the right button of the mouse simultaneously to serve as a part of the password.

Since the embodiments of the present invention can combine rhythm, pace, or beat and tempo as a part of the password, it is possible to build a more user-friendly and easy memorable password. Moreover, the present invention can also combine audio or visual aides to assist the user in memorizing the password. For example, when entering the password, musical instrument sounds, such as the musical sounds played on pianos or flutes, corresponding to the entering tempo of the password can be provided as a prompt to the user. For touch screen input, it is possible to combine virtual keyboards or simulated piano keyboards to facilitate the entering of password by the user. These kinds of mechanisms increase the complexity of password, thus enhancing security with easy memorable characteristic.

In accordance with one embodiment, a method of providing registration for time ratio based password/challenge authentication is provided. The method includes: receiving an access code or pattern inputted by a user; recording a time message associated with each component of the access code or pattern; generating a data record in combining each component of the access code or pattern with the associated time message; and storing the data record.

In accordance with another embodiment, a method of providing login for time ratio based password/challenge authentication is provided. The method includes: calculating a beat ratio from a first ending component of a stored access code or pattern and of a user-inputted access code or pattern; transforming each component of the stored access code or pattern by means of the beat ratio; calculating an acceptable beat range by means of a predetermined acceptable threshold; and determining whether, within the acceptable beat range, each component of the user-inputted access code or pattern matches the corresponding component of the stored access code or pattern.

In accordance with another embodiment, a computer system providing registration for time ratio based password/challenge authentication is provided. The computer system includes: a host, the host including: a system bus; a memory connected to the system bus, wherein the memory comprises a set of commands; and a processing unit connected to the system bus, wherein the processing unit executes the set of commands to perform the method of registration described above.

In accordance with another embodiment, a computer system for providing login for time ratio based password/challenge authentication is provided. The computer system includes: a host, the host including: a system bus; a memory connected to the system bus, wherein the memory comprises a set of commands; and a processing unit connected to the system bus, wherein the processing unit executes the set of commands to perform the method of login described above.

The following description, the appended claims, and the embodiments of the present invention further illustrate the features and advantages disclosed within this specification.

Computer System

FIG. 2is a block diagram of an illustrative hardware environment of a client computer202according to an embodiment of the present invention. In an exemplary embodiment, a server is a universal desktop computer including: a processor for executing various applications; a storage device for storing various information and program code; a display device, a communication device, and an input/output device which function as interfaces for communicating with a user; and a peripheral component or other components serving a specific purpose. In another embodiment, the present invention is implemented in another way and thus having less or more other devices or components. The network can also be implemented in any form of a connection, including a fixed connection, such as a local area network (LAN) or a wide area network (WAN), or getting connected to the Internet through a dial-up connection provided by an Internet service provider (ISP). The network connection is not restricted to cable connection and wireless connection; instead, it can also be implemented by wireless connection in the form of a GSM connection or a Wi-Fi connection for communicating with a client computer. The network further includes other hardware and software components (not shown), such as an additional computer system, router, and firewall.

As shown inFIG. 2, a client computer202includes a processor unit204coupled to a system bus206. Also coupled to system bus206is a video adapter208, which drives/supports a display210. System bus206is coupled via a bus bridge212to an Input/Output (I/O) bus214. Coupled to I/O bus214is an I/O interface216, which affords communication with various I/O devices, including a keyboard218, a mouse220, a Compact Disk-Read Only Memory (CD-ROM)222, a floppy disk drive224, and a flash drive memory226. The format of the ports connected to I/O interface216may be any known to those skilled in the art of computer architecture, including but not limited to Universal Serial Bus (USB) ports.

The client computer202is able to communicate with a service provider server252via a network228using a network interface230, which is coupled to system bus206. Network228may be an external network such as the Internet, or an internal network such as an Ethernet or a Virtual Private Network (VPN). Using network228, the client computer202is able to access service provider server252.

A hard drive interface232is also coupled to system bus206. Hard drive interface232interfaces with a hard drive234. In a preferred embodiment, hard drive234populates a system memory236, which is also coupled to system bus206. Data that populates system memory236includes client computer202's operating system (OS)238and application programs244.

OS238includes a shell240, for providing transparent user access to resources such as application programs244. Generally, shell240is a program that provides an interpreter and an interface between the user and the operating system. More specifically, shell240executes commands that are entered into a command line user interface or from a file. Thus, shell240(as it is called in UNIX®), also called a command processor in Windows®, is generally the highest level of the operating system software hierarchy and serves as a command interpreter. The shell provides a system prompt, interprets commands entered by keyboard, mouse, or other user input media, and sends the interpreted command(s) to the appropriate lower levels of the operating system (e.g., a kernel242) for processing. Note that while shell240is a text-based, line-oriented user interface, one or more embodiments of the present invention will equally well support other user interface modes, such as graphical, voice, gestural, etc. As depicted, OS238also includes kernel242, which includes lower levels of functionality for OS238, including providing essential services required by other parts of OS238and application programs244, including memory management, process and task management, disk management, and mouse and keyboard management.

The hardware framework of a server252is identical or similar to that of the client computer202, or is any conventional basic framework, and the embodiments of the present invention is not limited thereto. For example, the server is a desktop computer, a notebook computer, a personal digital assistant (PDA), or a smartphone. However,FIG. 2and the above examples are not restrictive of the one or more embodiments of the present invention. The client computer202includes a browser. The browser includes a program module and instructions. The program module and commands comply with the Hypertext Transfer Protocol (HTTP) whereby a World Wide Web (WWW) client (i.e., the client computer202) sends and receives web-based messages through the Internet, thereby effectuating communication with the server252.

An application244includes a password-based challenge module246of the embodiments of the present invention. The password-based challenge module246includes a program module and commands. The program module and commands can communicate with the server252, so as to recognize a user's identity. The password-based challenge module246is a module in the application, or is implemented in the form of a daemon. In another embodiment, the password-based challenge module246is implemented as a program in another form. The password-based challenge module246includes a code for executing the procedures described below and depicted withFIG. 3andFIG. 5.

Password/Challenge Authentication Procedure

FIG. 3andFIG. 5in combination withFIG. 4illustrate method steps of the password-based challenge module of the present invention.

FIG. 3is a flowchart of a method of providing registration for password/challenge authentication in accordance with one embodiment of the present invention.

Step310: receiving an account number and a password inputted by a user (or pattern inputted through a touch screen).

Step320: recording a time message associated with each component of the password (or pattern). When inputting through keyboard, said each component is each keystroke character of the password entered. When inputting through touch screen, said each component is each keystroke or each stroke of the password entered through a virtual keyboard or a simulated piano keyboard. More details are described later with reference toFIG. 4.

Step330: generating a data record in combining each component of the password (or pattern) with the associated time message.

Step340: storing the data record in a password database350.

It is noted that some authentication mechanisms do not include user account number, only request for password to authorize access. For example, such authentication mechanisms include PIN input or power-on or unlock password input of mobile phones or mobile devices (e.g. tablet computers such as iPad®).

FIG. 4illustrates a diagram showing the relationship between the location of each component of password or pattern and time. When the user intends for registration of password, each component of the password or pattern can be recorded in the following format: [starting time, ending time, XY coordinates]. As shown inFIG. 4, if the user inputs a password in total six seconds, it will be recorded and stored in the password database350as: [0, 1, X3Y5]400, [0, 3, X1Y1]410, [2, 4, X2Y3]420, [3, 4, X3Y5]430, [4, 5, REST]440, [5, 6, X2Y3]450, wherein [0, 3, X1Y1]410means coordinates (X1Y1) is pressed at timing 0 for 3 seconds. Furthermore, [4, 5, REST]440means no key is pressed (or no position is touched through the touch screen) at the fourth second for 1 second. That is, the time for REST also constitutes a part of the password. The complexity of password is increased with the recordation of the time period for REST. Therefore, the establishment of password is not only about what is inputted but also relates to the recordation of nothing is inputted. The time record can be implemented just through the input from a conventional keyboard (or through the touch point of the touch screen), and simultaneously, the timing of touch and the timing of leaving the input device of the computer system can also be read based on the internal clock. It is noted that the password database can be located in a local computer device or a remote server; the present invention is not limited thereto.

When the user intends to login and inputs the password, the time of duration of the first ending component in the password or pattern can serve as a base, which is compared with the duration of time of a corresponding component of the password or pattern stored in the database350to calculate a beat ratio, R. The product of the duration of time of other component of the password multiplied by the beat ratio constitutes the corresponding time of the component of the password entered by the user, i.e. [0R, 1R, X3Y5], [0R, 3R, X1Y1], [2R, 4R, X2Y3], [3R, 4R, X3Y5], [4R, 5R, REST], [5R, 6R, X2Y3]. An acceptable range of the beat ratio is further calculated by means of a predetermined acceptable threshold. Therefore, in one or more embodiments of the present invention, passwords entered in a same input sequence and according to an input beat within the predetermined acceptable threshold range are considered as the same password and the login will be granted. For example, according to the present invention, the sequential input of “Do<press for 4 seconds>”, “<pause for 2 seconds>”, Re<press for 4 seconds>”, <pause for 2 seconds>”, “Mi<press for 4 seconds> is considered the same as the input of “Do<press for 2 seconds>”, “<pause for 1 second>”, “Re<press for 2 seconds>”, “<pause for 1 second>”, “Mi<press for 2 seconds>”. That is, the passwords entered according to different tempo (slower or faster) are considered as the same password.

FromFIG. 4, it can be seen that the embodiments of the present invention also allows multi-key or multi-touch input to provide a function similar to playing on a musical instrument. Therefore, the embodiments of the present invention are applicable to various types of input devices, such as keyboard, touch screen, mouse, etc. The user can press the key “A” and the key “B” simultaneously or click the left button and the right button of the mouse simultaneously to serve as a part of the password.

Moreover, the embodiments of the present invention can also combine audio or visual aides to assist the user in memorizing the password. For example, when entering the password, musical instrument sounds, such as the musical sounds played on pianos or flutes, corresponding to the entering tempo of the password can be provided as a prompt to the user. For touch screen input, it is possible to combine virtual keyboard or simulated piano keyboard to facilitate the entering of password by the user. The use of application module of simulated flute (e.g. App on the iPhone) to facilitate the input of password is also possible. By means of flute sounds from the microphone of information devices, it is possible to facilitate the input of password during some circumstances such as unlock before driving. These kinds of mechanisms increase the complexity of password, thus enhancing security with easy memorable characteristic.

FIG. 5illustrates a flowchart of a method of providing login for password/challenge authentication in accordance with one embodiment of the present invention.FIG. 5is incorporated withFIG. 4to show the method steps of login of one or more embodiments of the present invention.

Step510: a user inputting a password (or pattern) for login.

Step520: dynamically comparing the inputted password (or pattern) with a stored password or pattern. The step520is further explained below.

Step522: calculating a beat ratio, R, from a first ending component of the stored password or pattern and of the user-inputted password or pattern.

Step524: transforming each component of the stored access code or pattern by means of the beat ratio. That is, the time of duration of each component of the access code is multiplied by the beat ratio, R, to constitute a corresponding time of the component of the password subsequently entered by the user. For example, the user enters the password with a faster tempo, wherein the first input is [0, 0.5, X3Y5]400. If the beat ratio R is 0.5 (i.e. R=0.5), the subsequent password components must match this beat ratio. Therefore, [0R, 3R, X1Y1] will become [0, 1.5, X1Y1]410. The entire password must be transformed, in accordance with the beat ratio, into a new password.

Step526: calculating an acceptable beat range by means of a predetermined acceptable threshold.

Step528: determining whether, within the acceptable beat range, each component of the user-inputted password or pattern matches the corresponding component of the stored password or pattern.

Step530: granting login access if each component of the user-inputted access code or pattern matches the corresponding component of the stored access code or pattern (Step540).

It is noted that in the disclosure of the embodiments disclosed herein, when the multi-key or multi-touch input through a touch screen is supported, the password can be entered at any desirable location on the touch screen. FromFIG. 4, it can be seen that the password-based challenge module246can analyze the difference in vector coordination of each point, such as from X1Y1 to X2Y3 to X3Y5, and calculate the slope and the angle of each vector. Since each component utilizes a relative vector coordination system, it is possible to enter the password at any location on the touch screen. Different from the conventional password input on the touch screen, the present invention allows the user to input the password without looking at the screen if each component of the password has a correct relative vector coordinate. In sum, the embodiments of the present invention not only consider the password input sequence of the conventional password-based challenge mechanism, but also considers the recordation of input time required for each component, the pause time between keystrokes, and the beat ratio R calculated from the overall keystroke input as a part of the password. Therefore, the password-based challenge module246not only considers the password input sequence, but also considers the beat and its beat ratio, instead of the actual time as in U.S. Pat. No. 7,653,818.

Furthermore, the embodiments of the present invention are also applicable to a wide variety of information devices which are not Web-based, such as mobile phones, personal computers, notebook computers, and tablet computers. The information devices keep users' personal data and identity data, and thus can also provide single-machine application by means of a password-based challenge module of the present invention. The password-based challenge module246can be a module in an application; however, in another embodiment, it can also be implemented as a program in another form, for example, being integrated into an operating system level and adapted to challenge a user when starting the operating system.

The foregoing preferred embodiments are provided to illustrate and disclose the technical features of the embodiments of the present invention, and are not intended to be restrictive of the scope of the embodiments of the present invention. Hence, all equivalent variations or modifications made to the foregoing embodiments without departing from the spirit embodied in the disclosure of the embodiments of the present invention should fall within the scope of the embodiments of the present invention as set forth in the appended claims.