Establishing a secure channel with a human user

Abstract

A method of establishing a secure channel between a human user and a computer application is described. A secret unique identifier (“PIN”) is shared between a user and an application. When the user makes a request that involves utilizing the PIN for authentication purposes, the application renders a randomly selected identifier. The randomly selected identifier is in a format that is recognizable to a human but is not readily recognizable by an automated agent. The randomly selected identifier is then presented to the human user. The user identifies the relationship between the randomly selected identifier and the PIN. If the user's input reflects the fact that the user knows the PIN, then the user is authenticated.

We claim: 
     
         1 . A computer system comprising:
 a display screen;   a processor; and   authentication software that, when executed by the processor, displays a first sequence of characters on the display screen, and, in response to user input comprising an indication of a series of locations on the display screen, determines a second sequence of characters from the user input, and conditionally grants the user access to information stored on the computer system based upon a determination that the second sequence of characters correspond to a password.   
     
     
         2 . The computer system of  claim 1 , wherein the computer system is selected from the group consisting of: personal computer, automated teller machine, set-top box, laptop computer, cellular phone, personal digital assistant, and workstation. 
     
     
         3 . The computer system of  claim 1 , wherein the computer system comprises a cellular phone. 
     
     
         4 . A method of controlling access to a computing device, the method comprising:
 displaying a plurality of characters on a display screen;   receiving a first input from a user, the first input comprising an indication of a first location on the display screen of a first character;   receiving a second input from the user, the second input comprising an indication of a second location on the display screen of a second character;   processing said first and second inputs to determine if said first and second locations correspond to the first and second characters of a password; and   conditionally granting the user access to the computing device based, at least in part, on a determination that said first and second locations correspond to first and second characters of a password.   
     
     
         5 . The method of  claim 4 , wherein the computing device is selected from the group consisting of: personal computer, automated teller machine, set-top box, laptop computer, cellular phone, personal digital assistant, and workstation. 
     
     
         6 . The method of  claim 4 , wherein the computing device comprises a cellular phone. 
     
     
         7 . The method of  claim 4 , wherein the plurality of characters are displayed in distorted form. 
     
     
         8 . The method of  claim 4 , wherein the plurality of characters are displayed such that they overlap at least in part.