Method for producing a data structure for use in password identification

Abstract

Passwords consisting of symbols selected from a third set of third symbols, of which a first set constitutes a subset of the first symbols, can be created from a data structure. The method for obtaining this structure comprises the following steps: preparation of a second set of at least two second symbols; creation of a first number of first lists of the first symbols, each list being contained in a third list constituted of the third symbols; creation of a second list of the second symbols, each symbol appearing in that list only once; association of a first list with each symbol of the second list; association of a second symbol to each symbol of the first lists. With this structure, a multitude of pseudo-random passwords can be created by means of a code comprising a second symbol, a subcode of at least one first symbol, and a reading path of the symbols in the third lists of the structure, starting from a first symbol found by using the second symbol and the subcode.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation-in-part of U.S. patent application Ser. No. 10/181,330, filed Jul. 15, 2002 entitled METHOD FOR PRODUCING A DATA STRUCTURE FOR USE IN PASSWORD IDENTIFICATION which is a U.S. National Stage of application No. PCT/CH01/00031 filed on Jan. 16, 2001, which claims the benefit and priority of Switzerland Application No. 2000 0080/00, filed in Switzerland on Jan. 17, 2000, the contents of which are incorporated by this reference.

FIELD OF THE INVENTION

The present invention relates to a method to identify a user willing to access services through a network by entering a password. The present invention refers to a method and device to allow strong identification of the user.

BACKGROUND ART

Every user of information technology has already been confronted with the problem of choosing an access password. The difficulty is to remember the password. This is why most people use words that are easy to remember, such as proper or common names that are often related to their activities. Furthermore, many people use the same password for a plurality of systems.

In order to ensure a high security in the area of IT networks and business computing, it is advisable or even compulsory to use passwords that are sufficiently long, not trivial (i.e. easy to guess), and where letters, numbers, and other special characters are mixed. In addition, it is necessary to use a different password for each system and to change passwords regularly. Of course, it is highly unadvisable to write down the passwords, they must be memorized. Hence, there is a conflict between the requirements of IT security and the memorizing faculty of users.

BRIEF DESCRIPTION OF THE INVENTION

It is therefore an object of the invention to provide a method for creating a data structure that can be used, e.g. in the form of a readable representation or stored on a disk, in order to create passwords requiring considerably reduced memorizing efforts of the user.

Passwords consisting of symbols selected from a third set of third symbols, of which a first set constitutes a subset of the first symbols, can be created from a data structure. The method for obtaining this structure comprises the following steps: preparation of a second set of at least two second symbols; creation of a first number of first lists of the first symbols, each list being contained in a third list constituted of the third symbols; creation of a second list of the second symbols, each symbol appearing in that list only once; association of a first list with each symbol of the second list; association of a second symbol to each symbol of the first lists. With this structure, a multitude of pseudo-random passwords can be created by means of a code comprising a second symbol, a subcode of at least one first symbol, and a reading path of the symbols in the third lists of the structure, starting from a first symbol found by using the second symbol and the subcode.

The invention is part of a new identification system that allows to create passwords, i.e. sequences of determined symbols, and to memorize them according to a single principle that is valid for all created passwords. The application of the principle used for creating the passwords enables a system to retrieve them. Without knowledge of the principle, this would require high processing power and time.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will be described hereinafter by means of an exemplary embodiment and with reference to the following figures:

FIG. 1: List of symbols.

FIG. 2: “Character” matrix.

FIGS. 3a, 3b: Column of “symbol s” added to matrix.

FIG. 4: Lists of “symbols” and associated letters.

FIG. 5: Encoded matrix.

FIG. 6: Coordinate system of matrix.

FIG. 7: Reading path.

FIG. 8: Search for starting cell.

FIG. 9: Creation of the password according to reading path.

FIG. 10: Same as FIG. 9, but using a matrix including additional characters.

DETAILED DESCRIPTION OF THE INVENTION

The system comprises an encoding system, a password creation system, and an identification system.

Encoding System

The encoding system is based on the list of symbols participating in the composition of the passwords and on a list of arbitrary chosen symbols.

For a better understanding of the following text, the symbols participating in the composition of the passwords are called “characters”, and the arbitrary chosen symbols are called “symbols”.

The encoding system creates a matrix whose dimensions are determined, on one hand, by the number of “characters” and, on the other hand, by the number of “symbols”. Thus, the encoding system creates a matrix comprising a number of columns equal to the number of “characters” and a number of rows equal to the number of “symbols”, or vice-versa. In fact, for the following explanation, the first case will be chosen.

The encoding system arbitrarily distributes all of the “characters” of the list of symbols participating in the composition of passwords on the first row of the matrix. The encoding system repeats the operation with a new list of “characters” on the second row, and so on, until the matrix is full.

The encoding system adds a column to the matrix. All of the “symbols” of the list of arbitrary symbols are distributed on this column. It can also be a simple row index (1, 2, 3 . . . ).

Then, the encoding system associates one of the “symbols” to each one of the “characters” of the matrix exactly once. For this purpose, the encoding system may prepare as many lists of arbitrarily symbols in storage locations as there are “characters”. It arbitrary arranges the “symbols” of each list and associates each one of the latter to one of the “characters”. Then, the encoding system searches every case of the matrix and reads the “character” inscribed therein, and subsequently selects one of the “symbols” contained in the list that is associated to that character. The encoding system repeats this operation on every case of the matrix.

In an alternate embodiment, a row index is added to the top of the column. As a consequence, all characters of one column are linked to a specific row thanks to the row index on the top (or on the bottom) of the column.

The encoding system stores or prints the matrix on a medium of any kind so as to allow it to be transported physically or electronically.

Password Creation System

The password creation system chooses a code composed of one or a plurality of “characters” selected from the list of symbols participating in the composition of passwords. Then, it creates a matrix from which it chooses one of the cases as the so-called starting cell. Subsequently, in the created matrix, it will choose a “reading path” according to which it proceeds in relation to the starting cell. The “reading path” is composed of the sequence of relative coordinates with respect to the position of the starting cell. The “reading path” is not subject to any rule and may be discontinuous.

In order to create a password, the password creation system uses the matrix encoded by the encoding system. It chooses one of the “symbols” as a “starting point”. It searches the row associated to the “starting point symbol” and compares the “characters” in this row to the first “character” it has chosen for its code. When it hits the same “character”, the password creation system reads the “symbol” associated to that “character” in the matrix (or the row index on the top of the column, see alternate embodiment above). It subsequently searches the row to which the new “symbol” is associated and compares the “characters” to the second “character” it has chosen for its code. The operation is repeated until the last “character” it has chosen for its code has been found in the matrix. This point is called the “identification initial point”.

Then, the password creation system reads the characters by moving through the matrix according to the previously created “reading path” and using the cell containing the last located “character” as the starting cell. The created password is composed of the “characters” read according to this procedure.

The created password is transmitted to the identification system.

In an alternate embodiment, the second “character” is not necessary and only one “character” is used. The initial values are then the first “character” and the row index (also called the “symbol”) that determine the “identification initial point”. The reading method from that point is the same as mentioned above. This method is called “one level mode”.

Identification System

In order to be accepted by the identification system, the matrix encoded by the encoding system and the code, the “reading path”, and the “starting point symbol” used by the password creation system must be transmitted to the identification system.

With the provided elements, the identification system applies the same principle as that used for creating the password, and compares the obtained password to that transmitted by the password creation system. If they match, the identification is accepted, otherwise it isn't.

In case that the identification system knows the matrix and the reading path, these two information can be used to check if the password currently received match the previously registered data (matrix and reading path).

Alternatives with Additional Elements

It is possible to enlarge the matrix by including arbitrarily distributed free cells in order to add additional elements such as special characters. These additional elements do not play any role for the encoding system, which ignores them. In contrast, they are taken into account by the password creation system in the readout according to the predefined path. This allows the passwords to include special characters.

Alternatives in Password Creation

The elements required for password creation may be partly determined by the identification system. The latter may transmit a part of the code required for password creation to the password creation system, and this part may be changed at every identification. In the password creation, the password creation system integrates these elements and then transmits the password or passwords to the identification system. The identification system also integrates these elements at identification time.

This allows using a different password for each identification, which may be useful for applications requiring a “challenge-response” or a unique password.

For example, the identification system, knowing the matrix and the reading path of the user currently checked, can decide which row is to be used in conjunction with the first character decided by the user. The user will therefore take into account the information given by the system to look at the proper row and uses its personal first character (and second character in a two levels mode) to reach the “identification initial point”. From that point, the password is extracted from the matrix according to the reading path and transmitted to the identification system.

The identification system can also defines the initial row and the first character, the user just needing to remember the reading path.

As described above, the matrix is printed in hard copy and kept by the user for identification purpose. In an alternate embodiment, after the user has entered its username or any indication allowing to retrieve its own password parameters, the identification system displays the matrix for the user.

The identification system can therefore work in three modes:

1. displaying the matrix on the screen,

2. displaying the matrix on the screen and the initial row to start seeking the first pre-defined character, and

3. displaying the matrix on the screen, the initial row to start seeking the first pre-defined character and a first character generated by the identification system.

In the first mode, the password will always be the same at each identification as long as the password parameters are not modified.

In the second mode, the user can generate one different password per row.

In the third mode, the number of different passwords equal the number of characters in the matrix.

To increase the number of possibilities, the matrix can be generated dynamically at the identification step. Only the reading path forms the password parameters for a given user. The matrix presented to the user is unique and the user can apply its reading path as pre-defined during the initialization step.

The above described three modes are also applicable when the matrix is available for the user in paper format instead of being displayed on the screen.

Advantages of the Invention

It is not necessary to transmit the password in encrypted form for identification.

The password creation system may repeatedly use the same principle for creating different passwords by simply exchanging the “starting point symbol” or by exchanging the encoded matrix.

The passwords are not stored or printed in the clear form. It is practically impossible to retrieve them in the encoded matrix without knowing the applied password creation principle.

The encoding system allows creating an almost unlimited number of different encoded matrixes.

The encoding matrix may be printed, and it is possible to find the password manually in order to gain access to simple systems without an automatic identification system.

Realization of the Invention

The realization of the identification system according to the example includes four steps:

1. Choice of the elements

2. Encoding of the matrix

3. Creation of a password

4. Identification

Choice of the Elements

The elements are chosen in function of the systems for which they are used. In our example, we will use a restricted number of elements for the sake of simplicity.

The symbols participating in the composition of the passwords will be chosen among the following symbols 1: “A B C D E” (FIG. 1).

The symbols 3 “hearts”, “diamonds”, “clubs”, and “spades” will serve as arbitrarily chosen symbols.

Encoding of the Matrix

The encoding system creates e.g. a matrix 5 including 5 columns and 4 rows, corresponding to the number of available “characters” 1 and “symbols” 3.

The encoding system arbitrarily distributes the “characters” on the first row 7 of the matrix, for example: “C B A D E”. It repeats the operation on the second row 8, the third row 9 and the fourth row 10. A matrix 5 (“C B A D E”, “A C D B E”, “E C D B A”, “B A C E D”) as described in FIG. 2 is obtained.

The encoding system adds a column 12 to the matrix and distributes the symbols 3 of the list of arbitrarily symbols on the latter, e.g. “hearts diamonds clubs spades” (FIG. 3a).

The encoding system stores five lists of “symbols” 3 (since there are 5 “characters”) in which it arbitrary arranges the symbols 3, e.g. “hearts clubs diamonds spades” 16, “spades diamonds clubs hearts” 17, “clubs hearts spades diamonds” 18, “hearts spades diamonds clubs” 19, and “spades hearts diamonds clubs” 20.

The encoding system associates one of the lists of “symbols” 16-20 to each “character” 1. For example, it associates the first list 16 to character “A” 21, the second list 17 to character “B” 22, the third list 18 to character “C” 23, the fourth list 19 to character “D” 24, and the fifth list 20 to character “E” 25 (FIG. 4).

The encoding system searches the matrix and associates with each “character” 1 the following “symbol” 3 extracted from the associated list 16-19 of “symbols”. Thus, on the first row, it associates “clubs” with “C”, “spades” with “B”, “hearts” with “A”, “hearts” with “D”, and “spades” with “E”. It applies the same method to each row of the table, thus obtaining matrix 27 (FIG. 5).

Alternatively as shown in the FIG. 3b, the symbols are placed on the top of each column. All characters of the column (e.g. ADDC for the third column) are associated with the symbol.

Creation of a Password

The password creation system uses the encoded matrix. It creates a coordinate system allowing it to find each cell of matrix 27 by its absolute coordinates. For example, it uses the first case 29 at the top left of matrix 27 as the origin and numbers from 0 on the abscissa and the ordinate (FIG. 6).

The password creation system creates an arbitrary matrix 31, e.g. of 5 rows and 4 columns, and chooses a cell as the starting cell 33 and as the origin (0;0). The end user for which this password is dedicated is requested to choose a “reading path”, e.g. consisting of a displacement from cell 34 above the starting cell by two cells 35-36 to the right, and then by two cells 37-38 down. FIG. 7 describes the “reading path”, starting cell 33 is indicated by an “X”, and cells 34-38 constituting the path are numbered from 1 to 5. The system stores the relative coordinates 39 of each cell 34-38 of the path in relation to starting cell 33.

Then, the password creation system chooses a code composed e.g. of two “characters” 1: “D B”. It also chooses a “symbol” 3 as a “starting point”, e.g. “clubs”. These two characters can be chosen by the end user in lieu of by the creation system.

In order to create a user entry, the initialization system should know the reading path and the two characters decided by the user. For that purpose, the user is requested to identify the matrix by its unique number (generated while producing the matrix) and a user name.

Now the initialization system will request the two characters selected by the user as well as the resulting password.

The initialization system apply the same rules as the user was intended to use to check, on the same matrix the resulting password.

If both passwords match, the user is properly registered.

According to another embodiment, the initialization system gives a symbol that defines a starting row. The user then search the first personal character on this row, to find out the associated symbol. Then, he looks at the row indicated by the symbol and scan that row until the second personal character is found. The password is read from that character according to the pre-defined reading path and communicated to the initialization system.

Due to the redundancy of the characters in the matrix and the high number of possibilities to form the password (contiguous and discontinuous reading method), the initialization system can request several password entries, the initial symbol being modified at each entry. With two or three passwords generated by the user, the initialization system can not only learn the reading path but also the two personal characters.

Finally, the “reading path” and the two personal characters are transmitted to the identification system.

In the alternate embodiment with one personal character, the user scans the line indicated by the symbol until the first personal character is found. From that point, the user generates the password according to its personal reading path. The reading path and this unique personal character is stored after the initialization step.

Identification

In order to proceed to an identification, the identification system must be provided with the encoded matrix 27, which the system will read and store. Furthermore, it must be provided with the code “DB” of our example, with the “starting point symbol” “clubs” and the “reading path” as described in FIG. 7.

These two information are retrieved after a first entry from the user to be identified. This can be done with his name, or any identification data that is unique to that user. The identification system can then load the matrix corresponding to this user.

With the provided elements, the identification system applies the same principle as that used for creating the reference password. It will find a sequence of “characters” and compares it to the password that has been transmitted by the current user willing to identify. If the two sequences of characters match, the identification is successful; in the opposite case it is not.

Example of Application

An exemplary application will be given for the access to an IT workstation (computer). Each user receives a matrix in paper format or on a diskette on which an encoded matrix 27 is stored. Each user must be identified by the system the first time. For this purpose, the user must insert the diskette in the computer with the password creation system installed and create his or her password, i.e. a code (e.g. two letters), a “starting point symbol” and a “reading path” (that can be inscribed in a grid on the screen). Using the method described above, the system stores the created password parameters and transmits it to the identification system.

In case that the matrix is printed, an additional unique number is printed to the support which allows the identification system to retrieve the matrix used by the current user.

An IT application is running on the personal computer of the user. In order to be identified, the user must identify the matrix used, e.g. diskette containing the encoded matrix, by entering the unique number of the matrix's support or by entering an identification such as a username. This matrix is available to the user for the password generation.

The identification system comprises a database of all supported matrix and before the identification starts, the system loads the appropriate matrix into its memory. On his side, the user knows the two pre-defined characters and generates the password thanks to these two characters and the reading path. The identification system generates on its side a reference password based on the knowledge of the matrix, the two characters and the reading path.

The password generated by the user and the reference password are then compared. If they are identical, the system authorizes the user to access the services, otherwise it doesn't.

The user may create new passwords by changing the “starting point symbol” or by exchanging the encoded matrix (by taking a new diskette, for example). It is no longer necessary for the user to remember his passwords, but only the elements required for creating them and which remain identical for all of his passwords, and memorizing problems are eliminated.

Of course, the scope of the invention is not limited to the cited example, and those skilled in the art may conceive modifications without leaving the scope of the invention as defined by the claims. Thus, a password may also be elaborated by the user manually by means of a graphic realization printed on a support of any kind (cardboard, plastics). The password may also be entered to a counter or a computer, etc. having no appropriate drive, by means of a standard alphanumerical keyboard or else by means of a reduced set of keys, e.g. similar to the keypad of a telephone where the keys are furthermore associated to multiple characters.

Furthermore, it is also conceivable to provide one or a plurality of rows in the matrix that are not associated with a symbol, similarly to the alternative with additional elements in one or a plurality of rows.

FIG. 10 shows the example of a matrix 52 containing additional elements 53 (in the present case numbers) that are randomly distributed, and an additional row 55 containing numbers, i.e. additional elements as well. In order to be able to determine the password, a copy 56 of the matrix without column 12 is adjoined.

Additional elements 53 as well as additional row 55 are not taken into account by the encoding system. In contrast, the password creation system takes account of the additional elements in the readout according to the predefined path. The password created when using the method described above thus becomes “DEC2E”.

In the context of manual input, it will be noted that the passwords created by the described system are apparently random sequences of characters and therefore very difficult if not impossible to guess. In particular, the well-known risk of using passwords created on the basis of the name or of other personal dates or data is eliminated.

Although the present invention has been described in relation to particular embodiments thereof, many other variations and modifications and other uses will become apparent to those skilled in the art. It is preferred, therefore, that the present invention be limited not by the specific disclosure herein, but only by the appended claims.

Claims

1. A method for generating an identification code on the basis of a set of characters distributed in the form of a matrix, of a personal first character and of a starting point symbol, the method comprising the following steps:

selecting the starting point symbol defining a line on the matrix,

selecting the personal first character defining a column on the matrix,

determining the identification initial point of the identification code by seeking an intersection of the selected line and the selected column,

from the identification initial point, forming the identification code by reading the characters according to a predefined reading path, in which at least one character of the identification code is not located next right from the previous character of the identification code.

2. The method according to the claim 1, wherein the number of different characters is equal or lower that the number of columns, every line comprising all characters.

3. The method according to the claim 1, wherein when the number of columns is greater than the number of different characters, and the matrix has free cells which are occupied by special characters.

4. The method according to the claim 1, wherein the identification code is a password.

5. The method according to the claim 1, wherein the predefined reading path is discontinuous, wherein a character is located between two characters forming the identification code.

6. The method according to the claim 1, wherein the pre-defined reading path includes at least two reading directions.

7. A support containing a matrix of characters for the execution of the method of generating an identification code, wherein the matrix contains a set of characters distributed in lines and columns, every line including all the characters and every character being unique on the line, every character further containing an associative link with a line of the matrix.

8. The support according to the claim 7, wherein this support contains an index of a line located next to the line and in one of these indexes is placed with every character as an associative link.

9. The support according to the claim 7, wherein the number of columns is greater than the number of characters, and resulting free positions being filled by special characters.

10. An identification method executed by a identification system comprising at least a matrix of characters, a personal first character, a starting point symbol and a reading path, this identification being based on the following steps:

determining the matrix of characters used by the user,

introducing by the user an identification code extracted from the matrix by reading of characters according to the reading path, wherein at least one character of the identification code is positioned not contiguous on the right-hand side to the previous character, the first character on the reading path being determined by the intersection of the line identified by the starting point symbol and the column identified by the personal first character,

generating a reference identification code by the system of identification on the basis of the matrix, the personal first character, the staring point symbol and the reading path,

comparing the identification code introduced by the user and the reference identification code,

accepting the identification if both identification codes are similar.

11. The method of identification according to the claim 10, wherein the personal first character is determined by the identification system and is communicated to the user, and the user uses the starting point symbol and the reading path for the generation of the identification code.

12. The method of identification according to the claim 10, wherein the starting point symbol is determined by the identification system and is communicated to the user, and the user uses the personal first character and the reading path for the generation of the identification code.