Multi-step authentication using objective and subjective credentials

Patent metadata

Field	Value
Publication number	US-10798091-B2
Application number	US-201715844897-A
Country	US
Kind code	B2
Filing date	Dec 18, 2017
Priority date	Oct 25, 2017
Publication date	Oct 6, 2020
Grant date	Oct 6, 2020

Abstract

Multi-step user authentication combines steps of authenticating both objective and subjective credentials. A user selects objective credentials, such as a password, and enters subjective credentials, such as a subjective description of the user's emotional response to a subjective challenge, such as a musical recording or image. The system identifies other content likely to elicit a similar emotional response from the same user. When the user later attempts to log onto a secured system, the user must enter the objective credentials and then describe the user's emotional response to a second subjective challenge that is likely to elicit an emotional response similar to that invoked by the first subjective challenge. If the user enters the correct objective credentials and describes an emotional response consistent with the first subjective description, then the user is given access to the secured system.

First claim

What is claimed is:

1. A method for multi-step authentication using objective and subjective credentials,
the method comprising a setting-up procedure and an authentication procedure,
where the setting-up procedure comprises:
receiving from a user, by a user-authentication system, a selection of an objective log-in credential;
recognizing, by the user authentication system,

an identification by the user of a first subjective challenge; and
further receiving from the user, by the user-authentication system, a first subjective description of an emotional response of the user to the first subjective challenge, where the first subjective description consists of a natural-language description entered by the user in response to an interactive request for such a response made by the user-authentication system; and

where the authentication procedure comprises:
identifying, by the user-authentication system, a request from the user to log onto a secured system;
accepting from the user, by the user-authentication system, the objective log-in credential;
communicating to the user, by the user-authentication system, a second subjective challenge that is different from the first subjective challenge, where the second subjective challenge is correlated with the first subjective challenge;
further accepting from the user, by the user-authentication system, a second subjective description of a user's emotional response to the second subjective challenge;
confirming, by the user authentication system, that the second subjective description is consistent with the first subjective description and,
where the confirming comprises inferring, by the user-authentication system, that the first subjective challenge and the first subjective description share identical objective characteristics with the second subjective challenge and the second subjective description; and
where the first subjective description is associated with the first subjective challenge and the second subjective description is associated with the second subjective challenge; and

granting the user, by the user-authentication system, access to the secured system in response to the confirming.

2. The method of claim 1 , where the second subjective challenge is not distinct from the first subjective challenge.

3. The method of claim 1 ,
where the first subjective description enumerates a first plurality of emotional states induced in the user by the first subjective challenge,
where the second subjective description enumerates a second plurality of emotional states induced in the user by the second subjective challenge, and
where the confirming further comprises:
the user-authentication system inferring a first user sentiment from the first plurality of emotional states,
the user-authentication system inferring a second user sentiment from the second plurality of emotional states, and
the user-authentication system determining that the first user sentiment matches the second user sentiment.

4. The method of claim 1 ,
where the objective log-in credential is a password, and
where the first subjective challenge and the second subjective challenge each comprise at least one item selected from a group consisting of: a live musical performance, an audio recording, a photograph, an animation, a graphical image, text, and a video clip.

5. The method of claim 1 , further comprising:
the user-authentication system selecting the second subjective challenge from a set of candidate subjective challenges, where each subjective challenge of the set of candidate subjective challenges is associated with corresponding values of a set of parameters of the objective characteristics and with a set of subjective user descriptions, the selecting comprising:
the user-authentication system identifying a subset of the set of parameters that correlate with the subjective user descriptions; and
the user-authentication system selecting the second subjective challenge from a subset of the set of candidate subjective challenges, where each subjective challenge of the subset of the set of candidate subjective challenges is associated with values of the subset of parameters that match values of corresponding parameters associated with the first subjective challenge.

6. The method of claim 1 , further comprising providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable program code in the user-authentication system, wherein the computer-readable program code in combination with the the user-authentication system is configured to implement the receiving, the recognizing, the further receiving, the identifying, the accepting, the communicating, the further accepting, the confirming and the granting.

Assignees

• IBM

Inventors

• Anders Kelley
• Dunne Jonathan
• Grant Robert
• Hewitt Trudy L

Classifications

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title