RU2445685C2 - Method to authenticate users based on graphic password that varies in time - Google Patents

Abstract

FIELD: information technologies.

SUBSTANCE: method to authenticate users with protection against spying, consisting in preliminary generation of a set from N small graphic symbols, giving the choice to the user from the generated set to memorise the group of S secret small graphic symbols s_k, by displaying on the screen those N graphic symbols selected from the set optionally, generation of an invisible secret area A_i, limited with a polygon with tops in centres of secret symbols displayed on the screen K_i, fixation of a point d_i of user's impact at the screen, generation of the positive result of completion of i stage of authenticating information input, besides, additionally the user is given to memorise a selection p_k of a secret template of symbols from the base P_k of secret templates for a k secret graphic symbol s_k, the next selected template is displayed on the graphical symbol s_j, the positive result of completion of the i stage of authenticating information input is formed.

EFFECT: making it possible to authenticate on any screens produced according to different technologies of image display.

4 dwg

Description

The invention relates to methods for authenticating users and can be used to create terminals designed to control access to a protected room, to remotely carry out commercial, managerial and other activities through public networks such as the Internet, as well as to control access to control modern electronic computers , including those located outside controlled territories. The invention allows to protect the authentication information entered by users against leakage through technical channels (for example, from “spying”) and interception with the help of “keyloggers”.

A known method of authenticating users with protection from spying [1]. The method consists in preliminarily generating a set of N small graphic symbols, providing the user with a choice from the generated set for storing group S of secret small graphic symbols s _k , wherein k = 1 ... K, where K is the secret number of graphic symbols in group S moreover, K << N, carry out the i-th step of entering authentication information, with i = 1 ... I, where I is the total number of steps, by displaying N _i graphic characters selected from a set at random, with K << N _i << N, among which an arbitrary IU K _i are arranged secret characters selected from group of characters secret S arbitrarily, and 3≤K _i <K, forming an invisible secret area A _i, bounded by a polygon with vertices at the centers of the screen derived secret K _i of symbols d _i fixed point impact the user to the screen, they form a positive result of the i-th step of entering authentication information when the condition for the fixed point of exposure to the invisible secret area d _i ∈A _{i is} met, and negative otherwise case, they form a positive authentication decision after receiving positive results of all I stages of user input of authentication information and a negative one otherwise.

A significant drawback of this method for user authentication is the need for a large number of consecutive steps for entering authentication information by users (according to [2], at least 10), which takes a considerable amount of time (several minutes) for the user. The reason for the presence of the indicated significant drawback in this method is that when fewer consecutive checks are carried out, there is a greater likelihood of an attacker accidentally selecting a password.

A known method of authenticating users with protection from spying [3]. The method consists in preliminarily generating a set of N small graphic symbols, providing the user with a choice from the generated set for storing group S of secret small graphic symbols s _k , wherein k = 1 ... K, where K is the secret number of graphic symbols in group S moreover, K << N, carry out the i-th step of entering authentication information, with i = 1 ... I, where I is the total number of steps, by displaying N _i graphic characters selected from a set at random, with K << N _i << N, among which an arbitrary IU K _i are arranged secret characters selected from group of characters secret S arbitrarily, and 3≤K _i <K, forming an invisible secret area A _i, bounded by a polygon with vertices at the centers of the screen derived secret K _i of symbols d _i fixed point impact the user to the screen, they form a positive result of the i-th stage of entering authentication information when the condition for the fixed point of exposure to the invisible secret area d _i ∈A _{i is} met, and negative otherwise case, a positive authentication decision is formed after receiving positive results of all I stages of the user entering authentication information, and negative otherwise, they additionally provide the user with a choice of C _k secret ranges of background color for remembering for the k-th secret graphic symbol s _k , during the i-th stage of the input of the authentication information is dynamically modified as the background color of the graphic symbol s _j, while j = 1 ... N _i, at the same time iksirovaniem point d _i influence the user to a screen capture background color b _m each graphic symbol of a secret character the displayed s _m, where m = 1 ... K _i, forming a positive result of the i-th stage of the input of the authentication information under the conditions of affiliation a fixed exposure point the invisible secret region d _i ∈A _i and the fixed background color of the graphic symbol belonging to its secret color ranges b _m ∈C _m and negative otherwise.

The disadvantage of this method for user authentication is the inability to completely level the differences between the color rendering of the screens of modern displays. The reason for the presence of this drawback in the method [1] is that most of the screens currently in use are made on the basis of liquid crystals, a feature of which is the difference in color shades when viewing the image at different angles to the plane of the screen.

The problem to which this invention is directed, is to enable authentication on screens made using various image reproduction technologies.

The technical result of the claimed invention is the ability to authenticate on any screens with different colors, including monochrome screens with a level of protection of the authentication system from various kinds of attacks not less than in methods [1] and [3].

The specified technical result is achieved in that in the known method of user authentication with anti-spying protection, which consists in pre-forming a set of N small graphic characters, providing the user with a choice from the generated set to remember the group S of secret small graphic characters s _k , with k = 1 ... K, where K is the secret number of graphic characters in group S, with K << N, during the i-th stage of entering authentication information, with i = 1 ... I, where I is the total number of steps, removing the screen selected from the set arbitrarily N graphic symbols, wherein N K << _i << N, among which are located at an arbitrary position K _i secret characters selected from group of characters secret S arbitrarily, and 3≤K _i <K, forming an invisible secret region A _i limited by a polygon with vertices at the centers of the secret symbols displayed on the screen K _i , fixing a point d _i of the user’s exposure to the screen, forming a positive result of the i-th stage of entering authentication information and when fulfilling the condition of belonging to a fixed point of influence of the invisible secret area d _i ∈ А _i and negative - otherwise, forming a positive authentication decision after receiving positive results of all I stages of user input of authentication information and negative otherwise, according to the invention provided for storing the user the choice P _k secret character template from the database p _k classified patterns for the k-th secret graficheskog symbol s _k, during the i-th stage input authentication information dynamically arbitrarily sorted graphical symbol templates from database P _k, displaying the selected regular pattern on a graphical symbol s _j, wherein j = 1 ... N _i, simultaneously with the fixation point d _i action taken on the screen capture the current template q _m each the displayed s _m a secret graphic symbol, where m = 1 ... K _i, forming a positive result of the i-th stage of the input of the authentication information when performing belongs conditions ezhnosti fixed point of action invisible secret area d _i ∈A _i and q _m conformity fixed current template graphic symbol s _m his secret value q _m = _m p and a negative - otherwise.

These distinctive features in comparison with the prototype allow us to conclude that the proposed technical solution meets the criterion of "novelty."

The invention consists in the following.

The proposed method of user authentication is a graphical password input scheme that is resistant to interception through technical channels, for example, by "spying", covert video recording, and also using "keyloggers". The user does not need to indicate secret graphic symbols unknown to the attacker on the screen. Icons (program icons), images of animals, birds, plants, photographs, letters, numbers can be used as graphic symbols. In this case, unlike the method [1], instead of a static picture, for each graphic symbol displayed on the screen, a special template is displayed that changes in time by sorting from the template database, and the speed, range and scheme (order) of sampling from the template database for various graphic symbols can to be different. As templates, for example, can be used:

- additionally displayed alphanumeric characters, as shown in figure 2;

- the angle of rotation of the graphic symbols, as shown in figure 3;

- the size of the graphic characters, as shown in figure 4;

- any other dynamic changes of graphic symbols.

When creating an account in the identification / authentication system, the user is prompted to select and remember a certain number of characters, which will be his secret authentication information. Additionally, unlike the method [1], the user is prompted for each secret character (or for all characters) to select and remember one or more patterns, which will also constitute his secret authentication information.

In the process of entering authentication information, the user must recognize a certain minimum number of secret characters among a larger number of characters randomly located on the screen. At the next stage of authentication, the user attempts to enter authentication information by narrowly targeting the screen, for example, by clicking with the help of a mouse-type manipulator into an area whose borders are a rectangle with vertices at the centers of graphic symbols displayed on the screen. In this case, unlike the method [1], the user must exert influence on the screen at a time when the corresponding secret patterns will be displayed on secret graphic symbols.

In the process of authentication, the user makes several attempts to enter authentication information and, if correctly executes them, then gets access to the system.

The listed set of essential features in this order provides high resistance to attacks aimed at intercepting authentication information through technical channels (for example, by "peeping", recording on a video camera, intercepting key clicks using directional microphones, etc.) or using "keyloggers ", and also, if necessary, reduces the minimum required number of attempts to enter authentication information through the use of two-factor authentication scheme with flax more options input authentication information than in method [1], and no less than in the method [3].

The security of systems [1], [3] and the proposed system, their resistance to various kinds of attacks can be estimated by calculating the probability of selecting (guessing) the user's secret password, i.e. its authentication information. In this case, you can always choose the base of patterns (or a combination of different patterns) of graphic symbols in the proposed system in such a way that the number of consecutive authentication steps in the proposed system is less than in the system [1] and not more than in the system [3], and the security of systems [1], [3] and the proposed system, ceteris paribus, was the same. Potentially, for any system parameters [1] it is possible to select such a base of graphic symbol patterns in order to reduce the number of authentication cycles to one, with the same level of security. Moreover, unlike the method [3], the proposed method is universal - it is possible to select such graphic symbol patterns so that the user’s search for secret graphic symbols is not complicated by the poor color quality of the monitor screen. Examples of such patterns are shown in figures 3 and 4.

It is a new property of the totality of features that leads to a significant reduction in the requirements for display screens with constant resistance to attacks on the authentication system, which allows us to conclude that the proposed technical solution meets the criterion of "inventive step". The proposed method of user authentication with anti-spying protection can be used, including when accessing various systems (Internet banking, ordering through online stores, etc.) through a public network such as the Internet.

The proposed method of authenticating users with anti-spying protection can be implemented programmatically using a computer or a computing device, the structure of which is shown in figure 1, where it is indicated:

1 - block storage control authentication information of users;

2 - unit for reading identification information;

3 - block comparing read identification information with control;

4 - block read coordinates of the point of impact;

5 is a block comparing the read authentication information with the control;

6 - decision block on the success of authentication;

7 - block storage of control identification information of users;

8 - storage unit of the passed number of authentication steps;

9 is a block comparing the values of the passed number of authentication steps with the necessary;

10 - block storage of the required number of authentication steps;

11 - input of authentication information;

12 - input of the coordinates of the point of influence by the user on the screen;

13 - input receipt of requests for identification / authentication of users;

14 - input receipt of identification information;

15 - input receipt of the required number of authentication steps;

16 - the output of the transfer of the decision on the successful completion by the user of identification and authentication procedures;

17 - timer;

18 - input receipt of patterns of graphic symbols;

19 - a storage unit for a base of graphic symbol patterns;

20 is a block for selecting patterns of graphic symbols;

21 - block reading patterns of graphic characters.

The purpose of the blocks is clear from their names.

From input 13 to the input of block 2, a request for identification / authentication of users is received. Using block 2, the identification information of the user is read, after which the read identification information is fed to the input of block 3, where the user-submitted identification information is compared with the control identification information received from block 7. In case of successful identification, the second and fourth outputs of block 3 arrive a request to enter, respectively, blocks 4 and 17 for authentication, from the third output - to the first input of block 8 to reset the number of passed the number of authentication steps, otherwise - from the first output unit 3 to the first input unit 6 receives the result of user authentication. From the output of block 17, the input of block 20 receives signals (clock pulses) for the next change of the graphic symbol patterns displayed on the screen. When the next signal arrives from the output of block 17 using block 20, an arbitrary template is read from the base stored in block 19 and displayed on the screen. Using block 4 from input 12, the coordinates of the user’s point of influence on the screen are read out, and using block 17, when a signal arrives from input 12 on the occurrence of the user’s impact on the screen, patterns of graphic symbols are read. Then, the read authentication information together with information on the patterns of secret graphic symbols is fed to the input of block 5, where the authentication information presented by the user is compared with the verification authentication information received from block 1, as well as the comparison of the current patterns of secret graphic symbols with the corresponding secret patterns of graphic symbols, information about which also comes from block 1. In case of successful completion of the authentication stage from the second output b eye 5 a request to the first input of the unit 9 to determine the set number of authentication steps, otherwise - from the first output unit 5 to the second input unit 6 receives the result of user authentication. When a request is received from block 5 to determine the number of passed authentication steps in block 9, the number of authentication steps passed from block 8 is compared with the number of required number of authentication steps coming from block 10. If the number of authentication steps passed is less than the number of required authentication steps, from the second output of block 9, the second input of block 8 receives a request for a single increase in the number of passed authentication steps, otherwise, from the first you ode unit 9 on a third input unit 6 receives the result of user authentication. After that, in block 6, a decision is taken and the output of block 6 to output 16 is passed on the successful completion of identification and authentication procedures by the user.

Pre-control identification information of all users of the information system comes from input 14 to the input of block 7, control authentication information of all users of the information system comes from input 11 to the input of block 1, from input 15 to the input of block 10, the required number of authentication steps are placed, and from input 18 block 19 receives graphic symbol patterns to fill the graphic symbol base.

The implementation of the proposed method does not cause difficulties, since all the blocks and nodes included in the device that implements the method are well known and widely described in the technical literature. Blocks 1-10 can be implemented as described in the method [1]. Block 17 can be implemented, for example, on the basis of a crystal oscillator and a frequency divider [4, 5], block 19 - on the basis of any computer-readable storage medium [6, 7], blocks 20 and 21 - in the form of specialized devices on microcontrollers according to the principles and to the methods described in [4, 5, 8-10], the interconnection of blocks can be implemented according to standard device connection schemes [11].

The image when entering authentication information may look, for example, as in figures 2-4.

Information sources

1. US Patent Application 20070277224 - Methods and Systems for Graphical Image Authentication. Application Published on November 29, 2007.

2. Susan Wiedenbeck, Jim Waters, Leonardo Sobrado, Jean-Camille Birget. "Design and Evaluation of a Shoulder-Surfing Resistant Graphical Password Scheme." - Proceedings of the working conference on Advanced visual interfaces, Venezia, Italy, 2006, p. 177-184.

3. Application for invention 2009136845 Russian Federation. The method of user authentication with protection from spying / Minakov V.A. (RU), Miroshnikov V.V. (RU), Laminsky E.Yu. (RU), Burushkin A.A. (RU); applicant GNII PTZI FSTEC Russia. - No. 2009136845/09, int. No. 052099; declared 10/05/2009.

4. Belov A.V. We create devices on microcontrollers. - St. Petersburg: Science and Technology, 2007 .-- 304 p.

5. Novikov Yu.V. Basics of digital circuitry. Basic elements and schemes. Design Methods. - M .: Mir, 2001 .-- 379 p.

6. Levin V.I. Storage media in the digital age / Ed. ed. D.G. Kraskovsky. - M .: ComputerPress, 2000. - 256 p.: Ill.

7. Guk M. Disk subsystem PC. - SPb .: Peter, 2001 .-- 336 p .: ill.

8. Design and technological design of electronic equipment. Textbook for high schools. Series: Computer Science at a Technical University. Ed. Shakhnova V.A. - M.: Publishing House of MSTU. N.E.Bauman, 2003 .-- 528 p.: Ill.

9. Suvorova E., Sheinin Yu. Design of digital systems on VHDL. Series "Textbook". - SPb .: BHV-Petersburg, 2003 .-- 576 p .: ill.

10. Ovchinnikov V.A. Algorithmization of combinatorial-optimization problems in the design of computers and systems. Series: Computer Science at a Technical University. - M.: Publishing House of MSTU. N.E.Bauman, 2001 .-- 288 p.: Ill.

11. Drink an. Pairing PCs with external devices. - M.: DMK Press, 2003 .-- 320 p. silt.

Claims (1)

A way to authenticate users with anti-spying protection, which consists in pre-forming a set of N small graphic characters, providing the user with a choice from the generated set to remember the group S of secret small graphic characters s _k , with k = 1 ... K, where K is the secret number of graphic symbols in the S group wherein K << N, conducting i-th stage input authentication information, wherein i = 1 ... i, where i - the total number of steps, by removing the screen selected from the set arbitrarily N _i c fi c symbols, wherein K << N _i << N, among which are located at an arbitrary position K _i secret characters selected from group of characters secret S arbitrarily, and 3≤K _i <K, the formation of an invisible secret area A _i, bounded by a polygon with vertices at the centers deduced on the screen K _i, secret characters, fixing point d _i user exposure to the screen, the formation of a positive result of the i-th stage of the input of the authentication information when the accessories fixed terms of points Exposure to invisible secret area d _i ∈A _i, and negative - otherwise, the formation of a positive decision of the authentication after receiving positive results of all phases of I input user authentication information, and the negative - otherwise, characterized in that it further provides for remembering user choice of p _k secret template characters from a database P _k classified patterns for the k-th secret graphic symbol s _k, during the i-th stage of the input of the authentication Info dynamically arbitrarily sorted graphical symbol templates from database P _k, displaying the selected regular pattern on a graphical symbol s _j, wherein j = 1 ... N _i, simultaneously with the fixation point d _i user feedback on the screen is fixed current template q _m each outputted at screen of a secret graphic symbol s _m , where m = 1 ... K _i , form a positive result of the i-th stage of entering authentication information when the conditions for belonging to a fixed point of influence of an invisible secret domain d _i ∈A _i and the correspondence of the fixed current pattern q _{m of the} graphic symbol s _{m to} its secret value q _m = p _m , and negative otherwise.

Images