Graphic pattern-based authentication with adjustable challenge level
Online user account access control includes adjustable authentication challenge levels based on a level of match between observed attributes of a present login attempt and corresponding recorded attributes for the authentic user for the entered user identifier (UID). Login candidates whose attributes sufficiently closely match the recorded attributes for the entered UID are allowed to select an authentication graphic pattern registered for the UID from a set of alternatives, with the degree of complexity of such selection based authentication increasing according to the degree of difference between the observed attributes of the present login attempt and the corresponding recorded values for the UID, while by default, login candidates may be required to produce the registered authentication graphic pattern from blank slate. Accordingly, authentic, but only authentic, users are able to login with high convenience, with underlying graphic pattern-based passcode protected against dictionary-based and brute-force attacks, or capture, by unauthorized parties.
1. A user authentication system comprising:
a login feature collection interface to collect a plurality of observable characteristics for a current login attempt by a login candidate, the current login attempt requesting a login for a given user identifier (UID) of a group of UIDs for a login domain, the plurality of observable characteristics including information characterizing
the login candidate's interaction with a login interface of the login domain, and
at least one additional aspect of the current login attempt;
a login feature data store to maintain, for each UID in the group of UIDs, information indicative of collected observable characteristics from one or more past authenticated login attempts to that UID;
a trained artificial intelligence (AI) risk assessor to, based on the plurality of observable characteristics collected via the login feature collection interface and information maintained in the login feature data store indicative of collected observable characteristics from one or more past authenticated login attempts for the given UID, form an assessment of risk that the login candidate is unauthentic;
variable-challenge-level authentication challenge logic to interact with the login candidate, the variable-challenge-level challenge logic configured to
set, from among a plurality of different challenge levels, a difficulty of challenge level, based at least in part on the assessment of risk formed by the trained AI risk assessor for the current login attempt, and
interact with the login candidate to obtain one or more authentication responses corresponding to the set difficulty of challenge level to determine whether the login candidate is authentic for the given UID; and
an authentication data store to maintain, for each UID of the group of UIDs, at least one registered authentication item created for that UID from input from a respective authentic user of that UID, wherein
the at least one registered authentication item for the given UID comprises a registered graphic pattern, and
the plurality of different challenge levels comprise
a first challenge level that directs the login candidate to reproduce, from a set of basic elements, the registered graphic pattern for the given UID, and
a second challenge level that instructs the login candidate to select, from an array of alternative graphic patterns that excludes the registered graphic pattern, a pattern that is within a threshold difference of matching the registered graphic pattern.
2. The user authentication system of claim 1 , wherein the information characterizing the login candidate's interaction with the login interface comprises device interface input timing and/or movement values collected proximate in time to the current login attempt.
3. The user authentication system of claim 1 , wherein the at least one additional aspect of the current login attempt comprises at least one of hardware specifics for a computing device associated with the current login attempt, operating system specifics for the computing device, web browser identification, network address information, one or more network communication attributes, or browsing history.
4. The user authentication system of claim 1 , wherein:
the information indicative of collected observable characteristics from one or more past authenticated login attempts comprises information from up to a selected threshold number of past authenticated login attempts for each of the group of UIDs; and
the user authentication system is configured to, upon successful authentication by the login candidate for the current login attempt, save information from the collected plurality of observable characteristics to the login feature data store for the given UID.
5. The user authentication system of claim 4 , further configured to, upon unsuccessful authentication by the login candidate for the current login attempt, save information from the collected plurality of observable characteristics to the login feature data store for the given UID along with an indication that the saved information corresponds to an invalid login attempt.
6. The user authentication system of claim 5 , wherein the trained AI risk assessor is configured to form the assessment of risk based further on invalid login attempt information saved for the given UID in the login feature data store.
7. The user authentication system of claim 1 , wherein the at least one registered authentication item comprises one or more graphic patterns.
8. The user authentication system of claim 7 , wherein each respective graphic pattern of the one or more graphic patterns comprises a configuration of plural spatially arranged elements, each of the spatially arranged elements having a color or other distinguishing feature selected from among a plurality of possible colors or other distinguishing features by the respective authentic user when creating the respective graphic pattern.
9. The user authentication system of claim 1 , wherein the at least one registered authentication item comprises a hashed and/or encrypted passcode.
10. The user authentication system of claim 9 , wherein the hashed and/or encrypted passcode is generated by the user authentication system from a graphical pattern created by the respective authentic user as the corresponding at least one registered authentication item.
11. The user authentication system of claim 1 , wherein one or more of the plurality of different challenge levels comprises a third challenge level that directs the login candidate to answer one or more operational security questions
derived from past activity of an authentic user for the given UID, and
that an authentic user for the given UID would be expected to be able to answer at least within a defined level of accuracy and/or timeliness.
12. The user authentication system of claim 1 , wherein:
the at least one registered authentication item for the given UID further comprises one or more alternative graphic patterns; and
one or more of the plurality of different challenge levels comprises multiple authentication screens, wherein a difficulty of challenge level is adjusted by at least one of
varying complexity for each screen of a set of one or more authentication screens presented for a corresponding alternative graphic pattern challenge to the login candidate,
varying a number of successive authentication screens presented to the login candidate, or
varying time given to the login candidate to respond to each screen of the set of one or more authentication screens.
13. The user authentication system of claim 1 , wherein the login candidate's interaction with the login interface comprises one or more online interactions with a login domain interface.
14. A method of authenticating logins to a system, the method comprising:
collecting a plurality of observable characteristics for a current login attempt by a login candidate, the current login attempt requesting a login for a given user identifier (UID) of a group of UIDs for a login domain, the plurality of observable characteristics including information characterizing
the login candidate's interaction with a login interface to the domain, and at least one additional aspect of the current login attempt;
maintaining, in a login feature data store and for each UID in the group of UIDs, information indicative of collected observable characteristics from one or more past authenticated login attempts;
supplying input to a trained artificial intelligence (AI) risk assessor, the input comprising
the collected plurality of observable characteristics for the current login attempt, and
information maintained in the login feature data store indicative of collected observable characteristics from one or more past authenticated login attempts for the given UID;
by the trained AI risk assessor and based on the supplied input, forming an assessment of risk that the login candidate is unauthentic;
setting, from among a plurality of different challenge levels available for the given UID, a difficulty of challenge level, based at least in part on the assessment of risk formed by the trained AI risk assessor, and for the current login attempt;
interacting with the login candidate to obtain one or more authentication responses for the set difficulty of challenge level to determine whether the login candidate is an authentic user for the given UID; and
maintaining, in an authentication data store and for each UID of the group of UIDs, at least one registered authentication item created for that UID from input from a respective authentic user of that UID, wherein
the at least one registered authentication item for the given UID comprises a registered graphic pattern; and
the plurality of different challenge levels comprise
a first challenge level that directs the login candidate to reproduce, from a set of basic elements, the registered graphic pattern for the given UID, and
a second challenge level that instructs the login candidate to select, from an array of alternative graphic patterns that excludes the registered graphic pattern, a pattern that is within a threshold difference of matching the registered graphic pattern.
15. The method of claim 14 , wherein the information characterizing the login candidate's interaction with the device interface comprises input timing and/or movement values collected proximate in time to the current login attempt.
16. The method of claim 14 , wherein the at least one additional aspect of the current login attempt comprises at least one of hardware specifics for a computing device associated with the current login attempt, operating system specifics for the computing device, web browser identification, network address information, network communication attributes, or browsing history.
17. The method of claim 14 , wherein the information indicative of collected observable characteristics from past successful login attempts comprises information from up to a selected threshold number of past successful login attempts for each of the group of UIDs, the method further comprising, upon successful authentication by the login candidate for the current login attempt, saving information from the collected plurality of observable characteristics to the login feature data store for the given UID.
18. The method of claim 14 , further comprising, upon unsuccessful authentication by the login candidate for the current login attempt, saving information from the collected plurality of observable characteristics to the login feature data store for the given UID along with an indication that the saved information corresponds to an invalid login attempt.