Patent ID: 8881266

Claim:
A computer-executed method for authenticating a user, the method comprising: receiving a request from the user for authentication; extracting, by a server computer, user-behavior information associated with the user from user-specific information stored in an enterprise computer, wherein the extracted user-behavior information includes one or more temporal activities associated with the user, and wherein the user-behavior information is extracted by the server computer so that the user's privacy is not compromised by a clerk of an enterprise information help-desk; generating one or more challenges based on the extracted user-behavior information for the user, wherein generating a respective challenge involves: selecting a behavior-information item from the extracted user-behavior information; generating a question so that the selected behavior-information item is the answer to the question, wherein the question is formulated in a way that the question does not reveal the selected behavior-information item; and formulating the respective challenge using the generated question; receiving respective responses from the user to the challenges; comparing the user's responses to the behavior-information items used to formulate the corresponding challenges; and authenticating the user using the challenges without asking the user to input a password.