Single prompt multiple-response user authentication method

A request for authentication from a user of a computer system is received. An authentication prompt is transmitted to the user, wherein the authentication prompt corresponds to a plurality of stored authentication responses, and wherein each of the plurality of stored authentication responses is used to authenticate the user. A first user authentication response is received. Whether to accept the first user authentication response based on a degree of similarity between the first user authentication response is determined and a stored authentication response from the plurality of stored authentication responses. Responsive to accepting the first user authentication response, a security score is calculated representing a level of confidence with respect to verifying the user for authentication, based on a type of authentication response for the first user authentication response. Responsive to determining that the security score is greater than an authentication score the user is authenticated.

BACKGROUND OF THE INVENTION

The present invention relates generally to user authentication, and more particularly to authenticating users based on user responses to a pre-selected authentication prompt.

User authentication is a security measure implemented to protect confidential information provided by a service, or to prevent unauthorized access to service tasks, such as bank wire transfers. A user can provide passwords, gestures, PIN codes, and biometrics as a means for user authentication, where each type of response can have unique strengths and weaknesses in terms of reliability, observability, memorability, efficiency, and usability in different user authentication environments.

SUMMARY

Embodiments of the present invention provide methods, computer program products, and computer system for single-prompt multiple-response user authentication. A request for authentication from a user of a computer system is received. An authentication prompt is transmitted to the user, wherein the authentication prompt corresponds to a plurality of stored authentication responses, and wherein each of the plurality of stored authentication responses is used to authenticate the user. A first user authentication response is received. Whether to accept the first user authentication response based on a degree of similarity between the first user authentication response is determined and a stored authentication response from the plurality of stored authentication responses. Responsive to accepting the first user authentication response, a security score is calculated representing a level of confidence with respect to verifying the user for authentication, based on a type of authentication response for the first user authentication response. Responsive to determining that the security score is greater than an authentication score the user is authenticated.

DETAILED DESCRIPTION

Web services such as online banking services, online social media services, and online shopping services may require user authentication prior to granting a user access to content provided by the web services. Furthermore, web services may also require user authentication prior to granting the user access to manage (e.g., initiate, monitor, modify) web service tasks. For example, if an authentication system successfully authenticates a user of a computer system for access to an online banking service, then the user may use the computer system to view and/or edit sensitive personal and financial information, as well as perform various online banking service tasks, such as initiate money transfers. User authentication is implemented to prevent non-authorized persons from accessing content provided by the web services and to prevent non-authorized persons from performing various tasks using the web services. For example, if an authentication system does not authenticate a user of a computer system for access to an online banking service, then the user may not view and/or edit sensitive personal and financial information not perform any of the various online banking tasks.

In certain instances, each web service or web service task, may require a distinctive user authentication process for verifying a user's identity. For example, an online social media service may rely on a user authentication process requiring a user's log-in name and password. In another example, an online banking service may rely on a user authentication process requiring a user to provide the user's log-in name, password, as well as an additional response, such as biometric feedback (e.g., a fingerprint). In this example, if the user is authenticated via an authentication process, granted access to the online banking service, and then subsequently requests to make a money transfer, then the online banking service may rely on an additional authentication process, whereby verifying that the attempted money transfer is requested by the previously authenticated user.

An authentication environment can be implemented to authenticate a user of a computer system before granting the user access to a web service, such that an authenticated user has access to content provided by the web service and/or the authenticated user can manage web service tasks. An authentication environment can involve two process, an initial enrollment process and a subsequent authentication process. For example, an enrollment process can be used to collect user enrollment information for a particular web service and/or web service task, where the enrollment information may include identifiers for the web service and web service task, one or more authorization prompts for the web service and web service tasks, and one or more responses for each authorization prompt, as described in greater detail below. Subsequently, an authentication process can be used to authenticate a user of a computer system prior to granting the user access to a particular web service and/or web service tasks, based on the previously collected user enrollment information for the particular web service and/or web service tasks. For example, the authentication process may initiate when a user attempts to access a web service and/or web service task, and subsequently may involve prompting the user with a pre-selected authentication prompt that corresponds to a respective web service and/or web service task. In this example, after the user is prompted with the authentication prompt, the computer system can then receive responses for the pre-selected authentication prompt, and determine whether to authenticate the user based on a comparison between the received responses and the responses included in the previously stored enrollment information, as described in greater detail below.

Embodiments of the present invention will now be described below with reference to the accompanying Figures (FIGS.). In the following description, elements that are identical are referenced by the same reference numbers in all the FIGS. unless noted otherwise. The configurations explained herein are provided as preferred embodiments, and it should be understood that the technical scope of the present invention is not intended to be limited to these embodiments.

FIG. 1is a functional block diagram illustrating authentication environment100, in accordance with an embodiment of the present invention. Authentication environment100includes computer system110and authentication system130. Computer system110and authentication system130can be desktop computers, laptop computers, specialized computer servers, or the like. In certain embodiments, computer system110and authentication system130represent computer systems utilizing clustered computers and components to act as a single pool of seamless resources when accessed through network120. In certain embodiments, computer system110and authentication system130represent virtual machines. In general, computer system110and authentication system130are representative of any electronic devices, or combination of electronic devices, capable of executing machine-readable program instructions, as described in greater detail with regard toFIG. 5. In other embodiments, computer system110and authentication system130may be implemented in a cloud computing environment, as described in greater detail with regard toFIGS. 6 and 7.

Network120can be, for example, a local area network (LAN), a wide area network (WAN) such as the Internet, or a combination of the two, and include wired, wireless, or fiber optic connections. In general, network120can be any combination of connections and protocols that will support communications between computer system110, authentication system130, and web service140, in accordance with a desired embodiment of the invention.

Computer system110represents a platform configured to exchange information between authentication system130and web service140over network120. A user of computer system110can interact with computer system110to provide various user inputs, or responses, as described in greater detail below. In this embodiment, a user of computer system110uses computer system110to request access to content provided by web service140and/or access to web service140tasks. Furthermore, computer system110includes enrollment program112and authentication prompt112, as described in greater detail below.

Authentication prompt112represents an alert or notification that is initially selected during an enrollment process and subsequently transmitted (e.g., presented, communicated, etc.) to a user of computer system110during an authentication process. Authentication prompt112can include an image, animation, text content, and/or video presented on a display of computer system110, one or more vibrations and/or a vibration pattern performed by computer system110, an audio signal broadcasted on a speaker component of computer system110, one or more light signals and/or a light signal pattern emitted by a camera flash component of computer system110and/or a light status component of computer system110, and/or combinations thereof.

In this embodiment, a user of computer system110selects authentication prompt112during an enrollment process for web service140and/or a web service140task. Subsequently, during an authentication process for web service140and/or the web service140task, computer system110will prompt authentication prompt112, as described in greater detail below. For example, a user of computer system110can select an image stored in computer system110as authentication prompt112. In another example, the user of computer system110can upload an image in combination with an audio file as authentication prompt112. In general, authentication prompt112can be any signal from computer system110user that can notify a user that information is necessary, such as, for example, a visual signal, an audio signal, a tactile signal, or combinations thereof.

In another embodiment, authentication prompt112can be automatically selected by computer system110during an enrollment process. For example, computer system110may automatically select authentication prompt112to be a sequence of five vibrations performed by computer system110followed by a flash of light emitted by the camera flash component of computer system110. In another example, computer system110can automatically select an image stored in computer system110, or another database containing generic images, as authentication prompt112.

Enrollment program114represents a software program configured to receive enrollment information during an enrollment process. In this embodiment, enrollment program114receives enrollment information by requesting a user of computer system110to select authentication prompt112for web service140and/or a web service140task, designate an authentication mode, and provide a response (e.g., password) in the designated authentication mode for the selected authentication prompt112, as described in greater detail with regard toFIG. 2. Enrollment program114can store received enrollment information in authorization system130, such that the enrollment information can be used during a subsequent authentication process, as described in greater detail with regard toFIG. 3.

An authentication mode indicates an acceptable format of responses for a selected authentication prompt112. For example, an authentication mode can indicate that an acceptable format of responses includes one or more of: an audio signal (e.g., a spoken phrase), a graphical image (e.g., a captured image of the user's face), a text input (e.g., a user typed response), a screen gesture (e.g., one-touch and multi-touch gestures), a motion path of computer system110(e.g., whole-device gesture), another physical interaction performed by a user of computer system110with computer system110(e.g., tapping the display of computer system110), biometric data, and combinations thereof. For example, enrollment program114may receive enrollment information for web service140, where the designated authentication mode of responses for a selected authentication prompt112is an audio signal, such as a spoken phrase. In this example, enrollment program114will not accept a user-defined motion path of computer system110as a potential response for the selected authentication prompt112, because the user-defined motion path is not in the acceptable format indicated by the designated authentication (i.e., not an audio signal). Accordingly, for this particular authentication mode, enrollment program114will only accept audio signals as responses for the selected authentication prompt112.

In one embodiment, enrollment program114may require confirmation that enrollment information received by enrollment program114is correct. For example, before enrollment program114stores responses provided during an enrollment process, the user may be required to reenter the responses a number of times (e.g., two times) to confirm that the responses are correct. It should be understood that a user of computer system110can designate more than one authentication mode of responses to enrollment program114as well as provide any number of responses for each authentication mode, as described in greater detail below.

Authentication system130represents a platform configured to authenticate a user of computer system110for web service140and/or a web service140task. In certain embodiments, if more than one user interacts with computer system110to access more than one web service140and/or web service140task, then enrollment information stored in authentication system130will include enrollment information for each of the more than one users with respect to each of the more than one web service140and/or web service140task. For example, a first user's enrollment information for a first web service140(e.g., an online banking service) may include a first authentication prompt112(e.g., an image), a first mode of authentication (e.g., audio signals) and corresponding responses (e.g., spoken phrases). In this example, a second user's enrollment information for the first web service140may include a second authentication prompt112(e.g., an audio signal broadcasted by computer system110), a second mode of authentication (e.g., text input) and corresponding response (e.g., text content). Furthermore, in this example, the first user's enrollment information for a web service140task (e.g., uploading an image to a social media service) may include a third authentication prompt112(e.g., a vibration sequence), a third mode of authentication (e.g., multi-touch display interactions), and corresponding responses (e.g., multi-touch gestures). In this embodiment, authentication system130includes assessment module132, as described in greater detail below.

Assessment module132represents a software program configured to determine various metrics for enrollment information, and to determine whether to authenticate a user of computer system110for web service140and/or a web service140task. In this embodiment, assessment module132evaluates each response received during an enrollment process for web service140and/or a web service140task, and determines a confidence metric for the response. A confidence metric of a response is a value that indicates a relative complexity of the response with respect to authenticating a user. For example, assessment module132may determine that a first response (e.g., a three digit password) may be less secure than a second response (e.g., a ten character alpha-numeric password), because the second response is considered is more secure (i.e., more difficult to guess or hack).

In this embodiment, assessment module132is implemented during an authentication process, such that when a user of computer system110provides responses to a presented authentication prompt112, assessment module132determines whether the provided responses match, or match to a degree of similarity, the responses stored during the enrollment process within a specified threshold. A specified threshold for a response is defined by assessment module132during an enrollment process, and is based on the mode of authentication for the respective response. For example, text input responses may have a relatively lower specified threshold (i.e., a smaller acceptable margin of error) because text input responses are easily repeatable. In another example, audio signal responses may have a relatively higher specified threshold (i.e., a larger acceptable margin of error) because audio signals are more difficult to repeat, even if the same user provides the audio signal via a spoken phrase, due to deviations in rhythm, tone, annunciation, pronunciation, etc. Stated differently, assessment module132can compare a response received during an authentication process with a response previously received during an enrollment process for web service140and/or a web service140task, and determine if the response received during the authentication process matches the stored response within a specified threshold that is associated with the stored response. If assessment module132determines that the response received during the authentication process sufficiently matches the stored response, then assessment module132accepts the response and can proceed with determining whether to authenticate the user based on the accepted response, as described in greater detail below.

Subsequently, during an authentication process, as a user provides responses to a presented authentication prompt112, assessment module132may sum the confidence levels associated with the provided responses to determine a security score, as described in greater detail below. In one embodiment, a security score may represent a level of confidence with respect to verifying the user for authentication based on a type of response, or confidence level. A confidence level for a particular response is a metric indicating various parameters of the particular response, such as password entropy (i.e., a measurement of how unpredictable a password or response is) and/or password strength (i.e., an indicator of the relative strength of the password/response or how resistant a password/response might be to cracking attempts using brute force and/or dictionary attacks). Assessment module132can also set an authentication score, which represents a required security score to be met during an authorization process, whereby granting a user access to requested information from a particular service140, as described in greater detail below. Furthermore, assessment module132stores the authentication score for each service140in authentication system130.

Service140represents a content provider requiring authentication of a user of computer system110by authorization system130prior to providing content to the user. Service140can be a web service, such as a social media service, an online banking service, product order fulfillment service, or any other web service that can provide a user with privileged, secured, or personal information upon authentication. As previously described, certain content provided by service140and/or service140tasks can have varying authentication scores. For example, the assessment module132may determine service140task, such as money transfers completed using service140(e.g., a financial institution) by a user of computer system110can have varying authentication scores. In this example, it may be determined that money transfers greater than $10,000 require a higher authentication score than a money transfer for $100. Accordingly, the user may provide a number of responses during an authentication process, such that the summed security score of the responses is greater than the specified authentication score, whereby granting the user access to complete the desired money transfer.

FIG. 2is a flowchart illustrating operational steps for enrollment in authentication environment100, in accordance with an embodiment of the present invention. To initiate an enrollment process in authentication environment100, computer system110executes enrollment program114(step202). After enrollment program114is executed, computer system110stores a selected authentication prompt112in authentication system130(step204). In one embodiment, a user of computer system110can select authentication prompt112for the enrollment process, such that the selected authentication prompt112can be presented to the user during a subsequent authentication process. In another embodiment, computer system110automatically selects authentication prompt112, such that the automatically selected authentication prompt112can be presented to the user during a subsequent authentication process. For example, computer system110may automatically select an image as authentication prompt112from a database of generic images stored on either computer system110, authentication system130, or another computer system.

After authentication prompt112is selected and stored, then computer system110receives an authentication mode designated by the user (step206). Once the authentication mode selection is made by the user, computer system110can receive a response (e.g., a user-defined password) for the selected authentication prompt112in the designated authentication mode (step208). Computer system110then stores the response for the selected authentication prompt112in authentication system130along with the designated authentication mode for the response (step210). Subsequently, assessment module132can evaluate the response, assign a confidence level for the response, and store the confidence level for the response in authentication system130(step212).

FIG. 3is a flowchart illustrating operational steps for authentication of a user, in accordance with an embodiment of the present invention. Computer system110identifies an authentication score for a type of content requested by a user that is provided by service140and/or a type of service140task (step302). In one embodiment, computer system110can identify the authentication score by accessing a storage repository of authentication system130storing authentication scores previously determined by assessment module132. Subsequently, computer system110presents a corresponding authentication prompt112to a user of computer system110on a display of computer system110(step304). In another embodiment, computer system110and other components therein can present authentication prompt112based on the type. For example, at step304, components of computer system110may vibrate in accordance with a pre-selected authentication prompt112for the particular service140and/or a type of service140task. The user of computer system110then provides a response (e.g., enters the user's password) to the authentication prompt112, and then authentication system130can receive the user-provided response which is transmitted by computer system110(step306). Assessment module132can determine whether the received response is within a specified threshold for a response, where the specified threshold for the response was previously stored during an enrollment process (decision308). If assessment module132determines that the received response is within the specified threshold (‘yes’ branch, decision308), then assessment module132can accept the response for subsequent authentication processing (step310). If assessment module132determines that the received response is not within the specified threshold (‘no’ branch, decision308). Then assessment module132rejects the response for subsequent authentication processing (step322).

It should be understood that more than one response can be provided by a user of computer system110during an authentication process. For example, the user may repeatedly enter the wrong password (i.e., a response is not within the specified threshold) for authentication prompt112, in which case the user can reattempt to enter the correct password, or provide an alternative response that was previously defined by the user during the enrollment process.

In another example, a particular authentication score for user-requested content provided by service140may be relatively high (e.g., an authentication score of 50). In this example, the user of computer system110may be presented with a corresponding authentication prompt112, as described in step304. Subsequently, the user can provide three different passwords as three responses for authentication prompt112. After authentication system130receives the three responses (e.g., passwords), as described in step306, assessment module132can determine if each of the three responses are acceptable based on a respective specified threshold for each of the responses (e.g., a response that is an alphanumeric passwords may require or a near-zero threshold, a response that involves the user selecting a portion of an image of authentication prompt112may have a low threshold, a response that involves the user providing a spoken phrase may have a medium threshold), as described in step310. Subsequent to accepting the three responses, as described in greater detail below, assessment module132may grant the user access to the requested content because the three responses satisfy the authentication score requested content.

A security score is calculated by assessment module132(step312). As previously described, assessment module132calculates a security score by summing confidence levels for each accepted response to authentication prompt112. For example, if three responses were accepted by assessment module132in step310, then the calculated security score is the sum of confidence levels for the three accepted responses. Then, assessment module132determines whether the calculated security score is greater than authentication score identified for the requested content provided by service140and/or the requested service140task (step314). If the security score is not greater than the authentication score (‘no’ branch, decision314), the assessment module132denies the user access to the requested content provided by service140and/or the requested service140task (step316). If the security score is greater than the authentication score (‘yes’ branch, decision314), the assessment module132grants the user access to the requested content provided by service140and/or the requested service140task (step320).

FIGS. 4A and 4Bdepict an example illustration of an example authentication prompt112, in accordance with an embodiment of the present invention. Authentication prompt112depicted inFIG. 4Acan be selected by a user of computer system110during an enrollment process, as previously described. Authentication prompt112inFIG. 4Acan also be presented to the user during a subsequent authentication process, as previously described.

InFIG. 4B, the user may interact with a display that is presenting authentication prompt112and select a portion of the graphical elements (e.g., an image of a sun) as a response to authentication prompt112. Accordingly, assessment module132compares this response (e.g., the selection of the sun) with a response previously stored during the enrollment process, to determine whether to accept the response and eventually authenticate the user.

The present invention implements a more flexible authentication method than typical methods provide, and the present invention provides several significant advantages. First, since a user can select an authentication method which they prefer, authentication environment100is accessible to people with impairments and to people who perform authentication in challenging environments. For example, in an embodiment of the present invention, a person with an impairment that limits hand coordination can select an authentication mode of spoken phrase or face picture. In another embodiment of the present invention, a person who lives in a busy city with lots of noise likely prefers a tap sequence, typed phrase, or screen gesture mode of authentication.

Second, the user-designed nature of the passwords to authentication prompt112helps users remember how to complete an authentication process. Furthermore, the user-designed nature of passwords to authentication prompt112is of no help to a potential attacker. For example, an image authentication prompt112of a house helps a user remember a spoken phrase password relating to their home, family, or a specific text. Users no longer need to remember number passwords or words containing a certain number or sequence of characters and letters. Since several responses are associated with a single authentication prompt112, the responses can serve to strengthen the user's memory of the response set. An attacker upon seeing an image authentication prompt112would be unaware as to what password is required, in addition to what mode of authentication for the password is required.

Another advantage of the present invention is the user-designed nature of the authentication prompt112serves as an anti-deception mechanism. Currently mobile device users are vulnerable to websites aimed at gaining their sensitive information. Mobile devices permit people to access their emails. It is more difficult on a mobile device to determine if a website is legitimate and users are likely to enter their login information, which usually contains PIN codes or passwords. In the present invention, the user is familiar with the prompt and it is more difficult to deceive the user. Additionally, the input password can be completely unique and contain no intimate information such as usernames, other passwords, or credit card details.

FIG. 5is a block diagram of internal and external components of a computer system500, which is representative the computer systems ofFIG. 1, in accordance with an embodiment of the present invention. It should be appreciated thatFIG. 5provides only an illustration of one implementation and does not imply any limitations with regard to the environments in which different embodiments may be implemented. In general, the components illustrated inFIG. 5are representative of any electronic device capable of executing machine-readable program instructions. Examples of computer systems, environments, and/or configurations that may be represented by the components illustrated inFIG. 5include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, laptop computer systems, tablet computer systems, cellular telephones (e.g., smart phones), multiprocessor systems, microprocessor-based systems, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices.

Computer system500includes communications fabric502, which provides for communications between one or more processors504, memory506, persistent storage508, communications unit512, and one or more input/output (I/O) interfaces514. Communications fabric502can be implemented with any architecture designed for passing data and/or control information between processors (such as microprocessors, communications and network processors, etc.), system memory, peripheral devices, and any other hardware components within a system. For example, communications fabric502can be implemented with one or more buses.

Memory506and persistent storage508are computer-readable storage media. In this embodiment, memory506includes random access memory (RAM)516and cache memory518. In general, memory506can include any suitable volatile or non-volatile computer-readable storage media. Software is stored in persistent storage508for execution and/or access by one or more of the respective processors504via one or more memories of memory506.

Persistent storage508may include, for example, a plurality of magnetic hard disk drives. Alternatively, or in addition to magnetic hard disk drives, persistent storage508can include one or more solid state hard drives, semiconductor storage devices, read-only memories (ROM), erasable programmable read-only memories (EPROM), flash memories, or any other computer-readable storage media that is capable of storing program instructions or digital information.

The media used by persistent storage508can also be removable. For example, a removable hard drive can be used for persistent storage b. Other examples include optical and magnetic disks, thumb drives, and smart cards that are inserted into a drive for transfer onto another computer-readable storage medium that is also part of persistent storage508.

Communications unit512provides for communications with other computer systems or devices via a network (e.g., network120). In this exemplary embodiment, communications unit512includes network adapters or interfaces such as a TCP/IP adapter cards, wireless Wi-Fi interface cards, or 3G or 4G wireless interface cards or other wired or wireless communication links. The network can comprise, for example, copper wires, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. Software and data used to practice embodiments of the present invention can be downloaded through communications unit512(e.g., via the Internet, a local area network or other wide area network). From communications unit512, the software and data can be loaded onto persistent storage508.

One or more I/O interfaces514allow for input and output of data with other devices that may be connected to computer system500. For example, I/O interface514can provide a connection to one or more external devices520, such as a keyboard, computer mouse, touch screen, virtual keyboard, touch pad, pointing device, or other human interface devices. External devices520can also include portable computer-readable storage media such as, for example, thumb drives, portable optical or magnetic disks, and memory cards. I/O interface514also connects to display522.

Display522provides a mechanism to display data to a user and can be, for example, a computer monitor. Display522can also be an incorporated display and may function as a touch screen, such as a built-in display of a tablet computer.

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows: