Authentication system and method based upon random partial digitized path recognition

Claim 2

An interactive method for authentication of a client, comprising: storing data defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including pre-defined locations in the frame of reference having coordinates on the frame of reference; storing a data set in a memory, the data set including a plurality of data fields having respective positions in said data set and having field contents identifying a plurality of said pre-defined locations having an order with coordinates along a digitized directional path known to the client on the frame of reference; identifying to the client via a data communication medium, positions of a random partial subset of data fields in said data set; accepting input data from the client via a data communication medium, corresponding to coordinates on the frame of reference of a partial subset of said plurality of pre-defined locations along said digitized path, the partial subset of said plurality of pre-defined locations being identified by the positions of the data fields in the random partial subset of said data set; and determining whether the input data matches the pre-defined locations identified by the field contents of data fields in the random partial subset, and if the input data matches, signaling successful authentication, and if the input data does not match, signaling failed authentication.

Claim 3

The method of claim 1 , including presenting an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and wherein said input data includes said indicators.

Claim 4

The method of claim 1 , including presenting an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and wherein said input data includes said indicators, wherein said indicators comprise alphanumeric characters.

Claim 5

The method of claim 1 , including presenting an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and said input data includes said indicators, wherein said indicators are randomly or pseudo-randomly generated by a server so that the instance presented uses different indicators in said pre-defined locations than are used in other instances of the graphical representation.

Claim 6

The method of claim 1 , including presenting to the client from a server via a data communication medium, an input construct for entry of data corresponding to field contents of said random partial subset of data fields from the data set, and wherein said accepting input data from the client includes accepting data based on said input construct.

Claim 7

The method of claim 1 , including presenting to the client from a server via a data communication medium, a graphical user interface including an input construct facilitating input of data corresponding to said positions by the client wherein said input construct comprises an instance of a graphical representation of said frame of reference having an array of indicators said pre-defined locations on the frame of reference, and input fields for inserting indicators from said array of indicators corresponding to said random partial subset.

Claim 8

The method of claim 1 , including presenting to the client an input construct for account set up, and accepting data from the client based on the input construct, to set field contents for the data fields in the data set.

Claim 9

The method of claim 1 , including presenting to the client an input construct for account set up, and accepting data from the client based on the input construct, to set field contents for the data fields in the data set, wherein the input construct includes a graphical representation of said frame of reference.

Claim 10

The method of claim 1 , wherein said digitized path on the frame of reference includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, and wherein the field contents of data fields in said data set respectively identify the first set of said pre-defined locations and the additional sets of said pre-defined locations, and the positions of data fields in said data set correspond to said order.

Claim 11

The method of claim 1 , wherein said digitized path includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, wherein said first set of said pre-defined locations and said sequence of additional sets of said pre-defined locations consist of a continuous digitized path on said frame of reference.

Claim 12

The method of claim 1 , wherein said digitized path includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, wherein said first set of said pre-defined locations and said sequence of additional sets of said pre-defined locations consist of a non-continuous digitized path on said frame of reference.

Claim 13

The method of claim 1 , wherein said digitized path on the frame of reference has a predetermined number of sets of said pre-defined locations, and includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order set by the client to define the full digitized path.

Claim 14

The method of claim 1 , including selecting instances of said random partial subset at a server, wherein said instances include a variable number of positions of data fields in said data set.

Claim 15

The method of claim 1 , including identifying positions of data fields for a plurality of random partial subsets of said data set.

Claim 16

The method of claim 1 , including providing a session timer, and including disabling a client session if an elapsed time exceeds a threshold before an authentication event in a client session.

Claim 17

The method of claim 1 , including: displaying an icon during said identifying, accepting and determining, said icon having a first state during said identifying, a second state after said accepting, and a third state after said determining.

Claim 18

The method of claim 1 , including: displaying a stop light icon during said identifying, accepting and determining, said icon displaying a red light during said identifying, displaying a yellow light after said accepting, and displaying a green light after said determining.

Claim 19

The method of claim 1 , wherein said client provides input data in a client system coupled to communication media.

Claim 20

The method of claim 1 , wherein said client provides input data in a client system, including a browser coupled to communication media.

Claim 21

The method of claim 1 , including: detecting an attempt to access a network resource by the user; presenting, in response to the detected attempt to access a protected network resource, an interface to the client via a data communication medium, the interface supporting said indicating and said accepting; and if the input data matches, signaling authentication of the client.

Claim 22

The method of claim 20 , wherein said interface includes an instance of a graphical representation of the frame of reference, including an array of indicators at said pre-defined locations in the frame of reference, and said input data includes said indicators.

Claim 23

An authentication system for a client, comprising: data processing resources, including a processor, memory and a communication interface; data stored in said memory defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including pre-defined locations in the frame of reference having coordinates on the frame of reference; user account information stored in said memory, including for respective clients a data set including a plurality of data fields having respective positions in said data set and having field contents a plurality of said pre-defined locations having an order with coordinates along a digitized directional path known to the client on the frame of reference; an authentication server adapted for execution by the data processing resources, including logic to identify to the client via the communication interface, positions in said data set of a random partial subset of data fields from said data set, logic to accept input data from the client via the communication interface, corresponding to coordinates on the frame of reference of a partial subset of said plurality of pre-defined locations, the partial subset of said plurality of pre-defined locations being identified by the positions of the data fields in the random partial subset, and logic to determine whether the input data matches the field contents of corresponding data fields in the random partial subset wherein the authentication server includes logic which if the input data matches, signals successful authentication, and if the input data does not match, signal failed authentication.

Claim 24

An authentication system for a client, comprising: data processing resources, including a processor, memory and a communication interface; data stored in said memory defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including pre-defined locations in the frame of reference having coordinates on the frame of reference; user account information stored in said memory, including for respective clients a data set including a plurality of data fields having respective positions in said data set and having field contents a plurality of said pre-defined locations having an order with coordinates along a digitized directional path known to the client on the frame of reference; an authentication server adapted for execution by the data processing resources, including logic to identify to the client via the communication interface, positions in said data set of a random partial subset of data fields from said data set, logic to accept input data from the client via the communication interface, corresponding to coordinates on the frame of reference of a partial subset of said plurality of pre-defined locations, the partial subset of said plurality of pre-defined locations being identified by the positions of the data fields in the random partial subset, and logic to determine whether the input data matches the field contents of corresponding data fields in the random partial subset wherein the authentication server includes logic which if the input data matches, signals successful authentication, and if the input data does not match, signal failed authentication.

Claim 25

The system of claim 22 , wherein the authentication server includes logic to present an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and said input data includes said indicators.

Claim 26

The system of claim 22 , wherein the authentication server includes logic to present an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and said input data includes said indicators, wherein said indicators comprise alphanumeric characters.

Claim 27

The system of claim 22 , wherein the authentication server includes logic to present an instance of said graphical representation of the frame of reference, including an array of indicators at said pre-defined locations on the frame of reference, and said input data includes said indicators, and logic to randomly or pseudo-randomly generate said array of indicators so that the instance presented uses different indicators than are used in other instances of the graphical representation.

Claim 28

The system of claim 22 , wherein the authentication server includes logic to present said graphical user interface including an input construct facilitating input of data corresponding to said data field positions by the client, wherein said input construct comprises an instance of said frame of reference having an array of indicators at said pre-defined locations on the frame of reference, and input fields for inserting indicators from said array of indicators corresponding to said random partial subset.

Claim 29

The system of claim 22 , including logic to present to the client an input construct for account set up, and to accept data from the client based on the input construct, to set field contents for the data fields in said data set wherein the input construct includes an instance of a graphical representation of said frame of reference.

Claim 30

The system of claim 22 , wherein said a full digitized path on the frame of reference includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, and wherein the field contents of data fields in said data set respectively identify the first set of said pre-defined locations and the additional sets of said pre-defined locations, and the positions of data fields in said data set correspond to said order.

Claim 31

The system of claim 22 , wherein said digitized path includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, wherein said first set of said pre-defined locations and said sequence of additional sets of said pre-defined locations consist of a continuous digitized path on said frame of reference.

Claim 32

The system of claim 22 , wherein said digitized pat includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order, wherein said first set of said pre-defined locations and said sequence of additional sets of said pre-defined locations consist of a non-continuous digitized path on said frame of reference.

Claim 33

The system of claim 22 , wherein said full digitized path on the frame of reference characterized by a predetermined number of sets of said pre-defined locations and includes a first set of said pre-defined locations, and a sequence of additional sets of said pre-defined locations in said order set by the client to define the digitized path.

Claim 34

The system of claim 22 , wherein the authentication server includes logic to generate instances of said random partial subset, wherein said instances include a variable number of positions of data fields in said data set.

Claim 35

The system of claim 22 , wherein the authentication server includes logic to identify positions of data fields for a plurality of random partial subsets of said data set in a client session.

Claim 36

The system of claim 22 , including logic to present to the client an input construct for account set up, and to accept data from the client based on the input construct, to set field contents for the data fields in the data set.

Claim 37

The system of claim 22 , including logic to present to the client a graphical input construct for entry of field contents of said random subset of data fields.

Claim 38

The system of claim 22 , including logic to provide a session timer, and logic to disable a client session if an elapsed time exceeds a threshold before an authentication event in client session.

Claim 39

The system of claim 22 , wherein said authentication server includes logic to display an icon, said icon, having a first state during an initial stage of a client session, a second state after accepting input data, and a third state after determining whether the input data matches.

Claim 40

The system of claim 22 , wherein said authentication server includes logic to display a stop light icon, said icon displaying a red light during an initial stage of a client session, displaying a yellow light after accepting input data, and displaying a green light after determining whether the input data matches.

Claim 41

An article storing computer programs supporting an authentication system for a client, comprising: a machine readable data storage medium storing data defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including pre-defined locations in the frame of reference having coordinates on the frame of reference; a machine readable data storage medium storing user account information, including for respective clients a data set including a plurality of data fields having respective positions in said data set and having field contents identifying a plurality of said pre-defined locations having an order with coordinates along a digitized directional path known to the client on the frame of reference, and a machine readable data storage medium storing computer programs executable by a data processor including logic to identify to the client via the communication interface, positions in said data set of a random partial subset of data fields from said data set, logic to accept input data from the client via the communication interface, corresponding to coordinates on the frame of reference of a partial subset of said plurality of pre-defined locations, the partial subset of said plurality of pre-defined locations being identified by the positions of the data fields in the random partial subset, and logic to determine whether the input data matches the field contents of corresponding data fields in the random partial subset, and if the input data matches, signaling successful authentication, and if the input does not match, signaling failed authentication.

Claim 42

An article storing computer programs supporting an authentication system for a client, comprising: a machine readable data storage medium storing data defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including pre-defined locations in the frame of reference having coordinates on the frame of reference; a machine readable data storage medium storing user account information, including for respective clients a data set including a plurality of data fields having respective positions in said data set and having field contents identifying a plurality of said pre-defined locations having an order with coordinates along a digitized directional path known to the client on the frame of reference, and a machine readable data storage medium storing computer programs executable by a data processor including logic to identify to the client via the communication interface, positions in said data set of a random partial subset of data fields from said data set, logic to accept input data from the client via the communication interface, corresponding to coordinates on the frame of reference of a partial subset of said plurality of pre-defined locations, the partial subset of said plurality of pre-defined locations being identified by the positions of the data fields in the random partial subset, and logic to determine whether the input data matches the field contents of corresponding data fields in the random partial subset, and if the input data matches, signaling successful authentication, and if the input does not match, signaling failed authentication.