Method and apparatus for dynamic personal identification number management

[0001] The present invention relates to the field of computer science. More particularly, the present invention relates to a method and apparatus for dynamic personal identification number management.

[0002] The challenge of identifying or authenticating a person on a local computer, or on the other end of a communication session, or in the role of the sender of a message, is a recurring theme in e-business. A typical solution uses user authentication methods based on passwords or PINs (personal identification numbers). A password or PIN is a word or code used as a security measure against unauthorized access to data. Typically, a user obtains a PIN as part of an enrollment process with a service provider. In this enrollment process, the service provider assesses user-supplied information and decides whether to provide the service to the user. If the service provider decides to provide service, the service provider issues a PIN to the user.

[0003] After enrolling with the service provider, the user uses the PIN to obtain access to the service. The user interface in this case consists of a prompt for a PIN. The user is typically allowed a fixed number of unsuccessful PIN attempts before user access is blocked.

[0004] A PIN or password is typically the primary means by which an individual user indicates authorization based on an intelligent thought process performed by the user. The user must recall the PIN from the user's memory and enter the digits corresponding to the PIN to obtain access to a service. PINs are often difficult to remember, especially when a user uses more than one PIN to access different services. A user may create a written copy of the PIN or PINs in an attempt to remember them. However, such a practice degrades security because the paper containing the PIN or PINs can be stolen or forwarded freely. Thus, static PIN-based user authentication mechanisms provide a relatively low level of security.

[0005] An improved form of user authentication is made possible by using a smart card or a magnetic stripe card in conjunction with a PIN. This is sometimes referred to as two-factor user authentication, combining what you have (the physical card) with what you know (the password needed to use the card). Because both possession of the card and knowledge of the PIN are required, two-factor user authentication can provide a higher level of security than user authentication based on a PIN or on a card alone.

[0006] Unlike a magnetic strip card, a smart card may include a CPU (central processing unit). Such a smart card can process data such as a PIN locally on the card. This processing may include PIN verification. Once a user is authenticated to the card, the card can be used to obtain access to a service.

[0007] FIG. 1 is a block diagram that illustrates a typical mechanism for personal identification number (PIN) management. A service provider 145 maintains a centralized cardholder database 105 that includes a primary account number (PAN) and an associated PIN for each cardholder. A cryptographic algorithm is typically used to generate the PIN based upon a cryptographic key 125, the PAN 110 and possibly other data 130. The PAN for a user 135 is written on a magnetic strip card or smart card 100 and the card 100 is provided to the user 135. If the card 100 is a smart card, it may include additional unique identifying information, such as a card serial number. The user 135 gains access to the account associated with a card 100 by presenting the card 100 to a card reader or card acceptance device (CAD) 140 in communication with the centralized cardholder database 105 and by entering a PIN. The CAD 140 may be implemented in a PC or as a standalone device. The centralized cardholder database 105 grants user 135 access to the account if the PAN on the card 100 matches a PAN 110 in the database 105 and if the PIN entered by the user 135 matches the PIN that is associated with the PAN 110 in the database 105.

[0008] Unfortunately, maintaining a PIN in a centralized database 105 that is beyond user control makes PINs vulnerable to misuse by a service provider 145. It also makes the PIN vulnerable to attack by rogue software running on the service provider's system 145.

[0009] Additionally, static PINs are susceptible to attack by rogue software on a CAD 140. Such a program can create a database of card numbers or PANs and associated PINs previously entered using a particular CAD 140. If a CAD 140 obtains any unique identifying data such as a serial number from the card 100 prior to PIN entry, the unique information may be used to consult the database of previously entered information to obtain an associated PIN. This PIN may be used to obtain unauthorized access to a service before the user 135 has authorized use of the card 100.

[0010] A rogue software program running on a CAD 140 may also reuse a PIN after the PIN has been entered and recognized by the card 100 to obtain further services without user 135 intervention. This CAD-based vulnerability decreases the security afforded by typical two-factor approaches.

[0011] An improvement is made possible by using a certified CAD 140 having a PIN-pad mounted directly on the CAD 140. Such a CAD 140 protects against rogue software running on the CAD 140. However, producing certified CADs and maintaining their operational state is relatively expensive and time-consuming.

[0012] Accordingly, what is needed is a relatively secure user authentication solution having a relatively simple user interface. A further need exists for such a solution that provides relatively limited access to an individual's PIN. Yet another need exists for such a solution where the user authentication data required for subsequent user authentication attempts is dynamic. Yet another need exists for such a solution that is relatively inexpensive.

[0013] A method for dynamic personal identification number (PIN) management includes selecting a PIN comprising at least one picture category ID, determining a correspondence between at least one entry token and the at least one picture category ID and creating a picture category ID list in response to an access request. The picture category ID list includes the at least one picture category ID. The method also includes providing the picture category ID list for displaying a composite image including pictures based on the picture category ID list, receiving an entry token list in response to the providing and granting access to the service based upon whether at least one entry token in the entry token list corresponds to the at least one picture category ID. According to one aspect, the method also includes providing instructions to the user regarding which pictures are based on the PIN.

[0014] The accompanying drawings, which are incorporated into and constitute a part of this specification, illustrate one or more embodiments of the present invention and, together with the detailed description, serve to explain the principles and implementations of the invention.

[0015] In the drawings:

[0016] FIG. 1 is a block diagram that illustrates a typical mechanism for personal identification number (PIN) management.

[0017] FIG. 2 is a block diagram of a computer system suitable for implementing aspects of the present invention.

[0018] FIG. 3 is a block diagram that illustrates an integrated apparatus for dynamic PIN management in accordance with one embodiment of the present invention.

[0019] FIG. 4 is a block diagram that illustrates a composite image including superimposed entry tokens in accordance with one embodiment of the present invention.

[0020] FIG. 5 is a block diagram that illustrates a composite image including superimposed entry tokens in accordance with one embodiment of the present invention.

[0021] FIG. 6 is a block diagram that illustrates a composite image including superimposed entry tokens in accordance with one embodiment of the present invention.

[0022] FIG. 7 is a block diagram that illustrates a composite image including multiple sub-pictures within a picture in accordance with one embodiment of the present invention.

[0023] FIG. 8A is a block diagram that illustrates a composite image including randomized superimposed entry tokens in accordance with embodiments of the present invention.

[0024] FIG. 8B is a block diagram that illustrates a composite image without superimposed entry tokens in accordance with one embodiment of the present invention.

[0025] FIG. 8C is a block diagram that illustrates a composite image including noncontiguous superimposed entry tokens in accordance with one embodiment of the present invention.

[0026] FIG. 8D is a block diagram that illustrates a composite image including superimposed entry tokens on a subset of pictures in accordance with one embodiment of the present invention.

[0027] FIG. 9 is a block diagram that illustrates a composite image having pictures that are displayed serially in one-member groups in accordance with one embodiment of the present invention.

[0028] FIG. 10 is a block diagram that illustrates a composite image having pictures that are displayed serially in two-member groups in accordance with one embodiment of the present invention.

[0029] FIG. 11 is a block diagram that illustrates a composite image having pictures that are displayed serially in four-member groups in accordance with one embodiment of the present invention.

[0030] FIG. 12 is a block diagram that illustrates an integrated apparatus for dynamic PIN management that includes providing a user with PIN instructions in accordance with one embodiment of the present invention.

[0031] FIG. 13 is a block diagram that illustrates a distributed apparatus for dynamic PIN management in accordance with one embodiment of the present invention.

[0032] FIG. 14 is a block diagram that illustrates a distributed apparatus for dynamic PIN management using a smart card in accordance with one embodiment of the present invention.

[0033] FIG. 15 is a block diagram that illustrates a distributed apparatus for dynamic PIN management using a smart card to select four of nine picture categories in accordance with one embodiment of the present invention.

[0034] FIG. 16 is a block diagram that illustrates a distributed apparatus for dynamic PIN management using a smart card in and a separate composite image server accordance with one embodiment of the present invention.

[0035] FIG. 17 is a flow diagram that illustrates a method for dynamic PIN management in accordance with one embodiment of the present invention.

[0036] FIG. 18 is a flow diagram that illustrates a method for dynamic PIN management in accordance with one embodiment of the present invention.

[0037] FIG. 19 is a flow diagram that illustrates a method for dynamic PIN management in accordance with one embodiment of the present invention.

[0038] FIG. 20 is a flow diagram that illustrates a method for dynamic PIN management that includes providing a user with PIN instructions in accordance with one embodiment of the present invention.

[0039] Embodiments of the present invention are described herein in the context of a method and apparatus for dynamic personal identification number management. Those of ordinary skill in the art will realize that the following detailed description of the present invention is illustrative only and is not intended to be in any way limiting. Other embodiments of the present invention will readily suggest themselves to such skilled persons having the benefit of this disclosure. Reference will now be made in detail to implementations of the present invention as illustrated in the accompanying drawings. The same reference indicators will be used throughout the drawings and the following detailed description to refer to the same or like parts.

[0040] In the interest of clarity, not all of the routine features of the implementations described herein are shown and described. It will, of course, be appreciated that in the development of any such actual implementation, numerous implementation-specific decisions must be made in order, to achieve the developer's specific goals, such as compliance with application- and business-related constraints, and that these specific goals will vary from one implementation to another and from one developer to another. Moreover, it will be appreciated that such a development effort might be complex and time-consuming, but would nevertheless be a routine undertaking of engineering for those of ordinary skill in the art having the benefit of this disclosure.

[0041] In the context of the present invention, the term network includes local area networks, wide area networks, the Internet, cable television systems, telephone systems, wireless telecommunications systems, fiber optic networks, ATM networks, frame relay networks, satellite communications systems, and the like. Such networks are well known in the art and consequently are not further described here.

[0042] In the context of the present invention, the term randomized describes the result of a random or pseudo-random number generation process. A randomized process describes the application of such a result to a process. Methods of generating random and pseudo-random numbers are known by those skilled in the relevant art.

[0043] In accordance with one embodiment of the present invention, the components, processes and/or data structures may be implemented using C or C programs running on high performance computers (such as an Enterprise 2000 server running Sun Solaris as its operating system. The Enterprise 2000 server and Sun Solaris operating system are products available from Sun Microsystems, Inc. of Palo Alto, Calif.). Different implementations may be used and may include other types of operating systems, computing platforms, computer programs, firmware, computer languages and/or general-purpose machines. In addition, those of ordinary skill in the art will recognize that devices of a less general purpose nature, such as hardwired devices, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), or the like, may also be used without departing from the scope and spirit of the inventive concepts disclosed herein.

[0044] According to embodiments of the present invention, access to a service is controlled based upon user-selection of one or more pictures.

[0045] FIG. 2 depicts a block diagram of a computer system 200 suitable for implementing aspects of the present invention. As shown in FIG. 2, computer system 200 includes a bus 202 which interconnects major subsystems such as a central processor 204, a system memory 206 (typically RAM), an input/output (I/O) controller 208, an external device such as a display screen 210 via display adapter 212, serial ports 214 and 216, a keyboard 218, a fixed disk drive 220, a floppy disk drive 222 operative to receive a floppy disk 224, and a CD-ROM player 226 operative to receive a CD-ROM 228. Many other devices can be connected, such as a pointing device 230 (e.g., a mouse) connected via serial port 214 and a modem 232 connected via serial port 216. Modem 232 may provide a direct connection to a remote server via a telephone link or to the Internet via a POP (point of presence). Alternatively, a network interface adapter 234 may be used to interface to a local or wide area network using any network interface system known to those skilled in the art (e.g., Ethernet, xDSL, AppleTalk).

[0046] Many other devices or subsystems (not shown) may be connected in a similar manner. Also, it is not necessary for all of the devices shown in FIG. 2 to be present to practice the present invention, as discussed below. Furthermore, the devices and subsystems may be interconnected in different ways from that shown in FIG. 2. The operation of a computer system such as that shown in FIG. 2 is readily known in the art and is not discussed in detail in this application, so as not to overcomplicate the present discussion. Code to implement the present invention may be operably disposed in system memory 206 or stored on storage media such as fixed disk 220, floppy disk 224 or CD-ROM 228.

[0047] Turning now to FIG. 3, a block diagram that illustrates an integrated apparatus for dynamic PIN management in accordance with one embodiment of the present invention is presented. Secure portable device 300 may be any trusted portable device such as a mobile phone or a Java Card technology-enabled smart card, or the like. Java Card technology is described in Z. Chen, Java Card Technology for Smart Cards (2000). Secure portable device 300 includes a stored PIN 305 that comprises at least one picture category ID and a category selector 320 for creating a picture category ID list 370 and an entry token correspondence list 375. The picture category ID list 370 includes a first number (N) of picture category IDs that comprise the stored PIN 305, referred to herein as PIN picture category IDs. The picture category ID list 370 also includes a second number (M) of additional category IDs, referred to herein as filler category IDs. Entry token correspondence list 375 includes at least one entry token that corresponds with the at least one picture category ID. Secure portable device 300 also includes a PIN comparator 315 for comparing an entry token list 360 with the entry token correspondence list 375. Device 300 also includes a picture database 310 for storing categorized pictures and an image generator 325 for generating a composite image 355 that includes pictures corresponding to the picture categories in the picture category ID list 370.

[0048] In operation, a user 330 requests access to a service (345). The requested service includes anything for which restricted access is desired. By way of example, a requested service may provide access to a range of Internet services via an Internet portal. Category selector 320 receives the access request 345 and creates an entry token correspondence list 375 that includes at least one entry token that corresponds with the at least one picture category ID in the PIN 305. Category selector 320 also creates a picture category ID list 370 including picture category IDs comprising the PIN. According to one embodiment of the present invention, the ordering of the picture category IDs within the picture category ID list 370 determines the order the corresponding pictures will be presented to the user 330. The PIN picture category IDs may be interspersed with the filler category IDs within the picture category ID list. Category selector 320 presents the picture category ID list 370 to image generator 325. For each picture category ID in the picture category ID list 370, the image generator 325 selects a picture that belongs to the picture category from the picture database 310. A picture that belongs to a PIN picture category is called a PIN picture. A picture that belongs to a filler category is called a Filler picture. Image generator 325 then combines the selected pictures into a composite image 350.

[0049] According to one embodiment of the present invention, secure portable device 300 comprises a CDMA technology-enabled smart card. CDMA technology-enabled smart cards are described in CDMA Development Group Document 43, entitled Smart Card Stage I Description, Version 1.1, May 22, 1996, available at www.cdg.org.

[0050] According to another embodiment of the present invention, secure portable device 300 comprises a SIM (Subscriber Identity Module card) card. The term SIM card describes the smart card used in GSM (Global System for Mobile Communications) mobile telephones. The SIM includes the subscriber's personal cryptographic identity key and other information such as the current location of the phone and an address book of frequently called numbers. The SIM is described in GSM 11.11-Digital cellular telecommunications system (Phase 2); Specification of the Subscriber Identity Module-Mobile Equipment (SIM-ME) interface (GSM 11.11), available at www.etsi.org.

[0051] According to another embodiment of the present invention, secure portable device 300 comprises a WIM (Wireless Interface Module). A WIM is a smart card in a WAP (Wireless Application Protocol) phone. It is described in Wireless Identity Module Specification, available at www.wapforum.org.

[0052] According to another embodiment of the present invention, secure portable device 300 comprises a USIM (Universal Subscriber Identity Module). A USIM is a smart card for a 3GPP (3^rd Generation Partnership Project) mobile phone. It is described in 3G TS 21.111 Version 4.0.0, USIM and IC Card Requirements, available at www.3gpp.org.

[0053] According to another embodiment of the present invention, secure portable device 300 comprises a UIM (User Identity Module). A UIM is a smart card for a 3GPP Project 2 (3GPP2) mobile phone. The term R-UIM is used when the smart card is removable. A UIM is a super set of the SIM and allows CDMA (Code Division Multiple Access)-based cellular subscribers to roam across geographic and device boundaries. The R-UIM is described in a specification issued by the 3rd Generation Partnership Project 2 (3GPP2) and entitled Removable User Identity Module (R-UIM) for cdma2000 Spread Spectrum Systems (3GPP2 C.S0023-0), Jun. 9, 2000, available at http://3gpp2.org.

[0054] The above description regarding various mobile phone technologies is not intended to be limiting in any way. Those of ordinary skill in the art will recognize that other secure portable devices may be used.

[0055] According to one embodiment of the present invention, the positioning of pictures within the composite image is based upon the corresponding picture category ID's position in the picture category ID list 370. In one exemplary mapping, the first picture category ID in the picture category ID list 370 corresponds to the first picture in the composite image 350 and the second picture category ID in the picture category ID list 370 corresponds to the second picture in the composite image 355. The mapping for other categories in the picture category ID list proceeds in a similar fashion. Those of ordinary skill in the art will recognize that other mappings between the position of a category ID within a picture category ID list and the position within a composite image of a picture corresponding to the picture category are possible.

[0056] Still referring to FIG. 3, at 380 the composite image 350 is presented to the user 330. The composite image 350 may be presented to the user 330 via the user's mobile phone 335, Personal Digital Assistant (PDA) 340 or the like. The composite image 350 may also be displayed to the user 330 via the display device of a PC or workstation (not shown in FIG. 3). The user 330, having previously enrolled with the secure portable device 300, knows which pictures within the composite image 350 are PIN pictures. At 360 the user 330 enters one or more entry tokens corresponding to the PIN pictures within the composite image 350. PIN comparator 315 receives the entry token correspondence list 375 from category selector 320. PIN comparator 315 also receives the entry token list 360 and compares it to the entry token correspondence list 375. The lists match if the entry token list meets correspondence criteria established by the secure portable device 300. If the lists match, access to the service is granted at 365. If the lists do not match, access to the service is denied at 365.

[0057] According to one embodiment of the present invention, the correspondence criteria is such that the user 330 must enter an entry token corresponding to each PIN picture, but additional entry tokens are acceptable.

[0058] According to one embodiment of the present invention, the correspondence criteria is such that the user 330 must enter one or more entry tokens corresponding to at least one PIN picture. In other words, the correspondence criteria are such that access is granted if the value of each of the entry tokens in the entry token list 360 corresponds to a picture category in the PIN 305. In this case, an entry token list is an acceptable response if it includes entry tokens corresponding to less than all of the PIN picture categories. For example, suppose a PIN 305 comprises four PIN picture categories and the correspondence criteria indicate a response including three of the four PIN picture categories is acceptable. If the PIN picture categories are dog, chair, house and flower, a response that includes the dog, house and flower categories but not the chair category would be acceptable.

[0059] According to another embodiment of the present invention, the correspondence criteria is such that access is granted if the value of each of the entry tokens in the entry token list 360 corresponds to a picture category in the PIN 305, and if each picture category ID in the PIN 305 is represented by an entry token in the entry token list 360. In other words, the user must 330 enter an entry token corresponding to each picture category in the PIN 305, and no more.

[0060] According to another embodiment of the present invention, the correspondence criteria is such that access is granted if the value of each of the entry tokens in the entry token list 360 is entered in the order indicated by the entry token correspondence list 375.

[0061] According to another embodiment of the present invention, the correspondence criteria may indicate that the order of entry tokens is irrelevant. For example, if the number of picture category IDs is 9 and the number of PIN picture category IDs is 3, the correspondence criteria may be such that matching all of the three PIN picture category IDs in any order is acceptable. Using FIG. 4 as an example, if the PIN picture categories are cow, dog and rabbit, the acceptable responses are entry token lists that include the three PIN pictures. In the present example, the acceptable responses are the entry token lists 1-5-6, 1-6-5, 5-1-6, 5-6-1, 6-5-1 and 6-1-5.

[0062] Many embodiments described herein assume a required entry order for entry tokens, from lower-valued entry tokens to higher-valued entry tokens, from left to right and from top to bottom. This is not intended to be limiting in any way. Embodiments of the present invention may use a variety of entry orders and other correspondence criteria.

[0063] According to another embodiment of the present invention, the image generator (reference numeral 325 of FIG. 3) uses a randomized selection process to select a picture when more than one picture belongs to the same picture category. For example, if one of the picture categories received by the image generator 325 is the cow category and the picture database 310 includes ten cow pictures, image generator 325 uses a randomized process to select one of the ten cow pictures for inclusion in the composite image 350.

[0064] According to another embodiment of the present invention, the image generator 325 selects a particular picture based in part upon the last time the picture was selected. By way of example, if more than one picture belongs to the same picture category, the least-recently-selected picture may be selected.

[0065] According to embodiments of the present invention, a secure portable device 300 uses a randomized selection process to create the picture category ID list 370. The PIN picture category IDs must appear in each picture category ID list 370, but a randomized process may be used to determine the order of each PIN picture category ID within the picture category ID list 370. A randomized process may be used to determine the identity of filler category IDs within the picture category ID list 370, the order of filler category IDs in the picture category ID list 370, or both. Dynamically changing the picture category ID list 370 means that the user 330 will be presented with a different composite image 350 with each successive access request 345. If the order of a PIN picture category ID within the picture category ID list 370 is changed, the resulting composite image 350 will change, requiring the user 330 to enter a different sequence of entry tokens 360 to access the same service. Thus, monitoring communications between the secure portable device and the user 330 would reveal little useful information because of the difficulty in establishing any correlation between an image presented to a user 330 and a sequence of entry tokens 360 entered by the user 330 in response to the composite image 350.

[0066] Turning now to FIG. 4, a block diagram that illustrates a composite image including superimposed entry tokens in accordance with one embodiment of the present invention is presented. As shown, composite image 400 includes a square grid of nine numbered pictures: a picture of a cow 405 associated with the cow category, a picture of a plane 410 associated with the plane category, a picture of a house 415 associated with the house category, a picture of a flower 420 associated with the flower category, a picture of a dog 425 associated with the dog category, a picture of a rabbit 430 associated with the rabbit category, a picture of a truck 435 associated with the truck category, a picture of a ship 440 associated with the ship category and a picture of a lion 445 associated with the lion category. The ordering of the pictures (405-445) is based upon the picture category ID list generated by the secure portable device. The pictures shown and the associated picture categories are for illustrative purposes only. Those of ordinary skill in the art will recognize that many other picture categories are possible. Furthermore, those of ordinary skill in the art will recognize that many pictures may belong to the same picture category.

[0067] According to one embodiment of the present invention, the entry tokens comprise any character that can be entered using a user-input device such as a keyboard, touch-pad or the like. According to one embodiment of the present invention, the entry tokens comprise numbers. According to another embodiment of the present invention, the entry tokens comprise letters. According to another embodiment of the present invention, the entry tokens comprise non-alphanumeric symbols such as the *, $ and characters and the like. According to another embodiment of the present invention, the entry tokens comprise a combination of numbers, letters and non-alphanumeric symbols.

[0068] According to another embodiment of the present invention, a predetermined sequence of entry tokens is superimposed on pictures in the composite image. Several examples are presented below.

[0069] Turning now to FIG. 5, a block diagram that illustrates a composite image including superimposed entry tokens in accordance with one embodiment of the present invention is presented. Composite image 500 includes all the pictures of composite image 400 in FIG. 4, arranged differently. Given the same set of picture categories comprising a PIN, the entry token list entered in response to composite image 400 of FIG. 4 will differ from the entry token list entered in response to composite image 500 of FIG. 5. By way of example, if the PIN picture categories are the dog, lion, plane and rabbit categories and if all entry tokens must be entered in order, the required entry token list is 5-9-2-6 when presented with composite image 400 of FIG. 4. In contrast, the same user must enter 1-9-4-3 when presented with composite image 500 of FIG. 5.

[0070] Turning now to FIG. 6, a block diagram that illustrates a composite image including superimposed entry tokens in accordance with one embodiment of the present invention is presented. FIG. 6 is similar to FIGS. 4 and 5 except that FIG. 6 includes a square grid of 16 pictures and a single character entry token references each of the pictures. Those of ordinary skill in the art will recognize that other orderings of pictures within composite pictures are possible. Those of ordinary skill in the art will also recognize that other associations between entry tokens and pictures are possible.

[0071] According to one embodiment of the present invention, a picture corresponds with a picture category if at least a sub-picture or part of the picture corresponds with the picture category. This is illustrated more with reference to FIG. 7.

[0072] Turning now to FIG. 7, a block diagram that illustrates a composite image including multiple sub-pictures within a picture in accordance with one embodiment of the present invention is presented. FIG. 7 is similar to FIG. 6 except that FIG. 7 includes a rectangular grid of 12 pictures including four rows of three pictures. FIG. 7 also includes multiple sub-pictures within pictures. Picture 705 corresponds with the dog and rooster picture categories. Picture 715 corresponds with the rabbit and leaf picture categories. Picture 725 corresponds with the mobile phone, cow and satellite dish categories. By way of example, a user whose PIN picture categories are cow-dog-phone-lion would enter the entry token list G-B-G-L when presented with composite image 700. The same entry token list would be entered if PIN picture categories were mobile phone-rooster-satellite dish-lion, since many of the pictures correspond to multiple categories.

[0073] According to another embodiment of the present invention, one or more picture categories overlap with other picture categories. For example, the Animal category may overlap with the dog, lion, rabbit and cow categories illustrated in FIG. 4. As a further example, suppose the PIN is animal-rose-house. In this case, the acceptable responses when presented with the image represented in FIG. 4 are the entry token lists: 1-4-3, 5-4-3, 6-4-3 and 9-4-3.

[0074] According to another embodiment of the present invention, the number of PIN picture categories is less than the number of picture categories represented in the composite image presented to the user.

[0075] According to one embodiment of the present invention, the number of PIN picture categories is the same as the number of filler categories.

[0076] According to another embodiment of the present invention, the number of PIN picture categories is less than the number of filler categories.

[0077] According to another embodiment of the present invention, the number of PIN picture categories is greater than the number of filler categories.

[0078] According to one embodiment of the present invention, the number of PIN picture categories is four and the number of picture categories represented in the composite image presented to the user is nine.

[0079] According to one embodiment of the present invention, the number of PIN picture categories is four and the number of picture categories represented in the composite image presented to the user is sixteen.

[0080] According to embodiments of the present invention, when a user enrolls with a secure portable device, the user provides information that may be used to authenticate the user when the user makes an access request. By way of example, the user may provide his or her own pictures, picture categories, entry tokens, correspondence criteria or any combination thereof. These embodiments are described in more detail below.

[0081] According to another embodiment of the present invention, a user supplies at least one picture category during the enrollment process, when the user enrolls with the secure portable device. At least one picture corresponding to the at least one picture category is stored in a picture database for possible use when the user makes an access request. The at least one picture category may be, by way of example, a My children category or a My siblings category.

[0082] According to another embodiment of the present invention, a user supplies at least one PIN picture for at least one picture category during the enrollment process. The at least one PIN picture is stored in a picture database for possible use when the user makes an access request. The at least one PIN picture may be, by way of example, one or more pictures of the user's family.

[0083] According to another embodiment of the present invention, the user determines the correspondence criteria at enrollment. For example, the user may supply pictures of the user's children, their birth dates and the correspondence criteria to be such that when the user is presented with a composite image, the user must identify pictures of the users' children in the order of their birth.

[0084] According to another embodiment of the present invention, the user indicates at least one entry token to be superimposed on a picture at enrollment. For example, the user may indicate that the entry tokens comprise a set of numbers.

[0085] FIGS. 8A-8D illustrate different ways to indicate the association of a picture with an entry token in accordance with embodiments of the present invention.

[0086] Turning now to FIG. 8A, a block diagram that illustrates a composite image including randomized superimposed entry tokens in accordance with embodiments of the present invention is presented. According to one embodiment, the association between a particular picture and a randomized entry token is established by the picture category ID list provider (such as category selector 320 of FIG. 3). According to another embodiment, the association between a particular picture and a randomized entry token is established by the image generator (such as image generator 325 of FIG. 3) and the image generator provides the association information to the entity that compares the entry token correspondence list with the entry token list (such as PIN comparator 315 of FIG. 3).

[0087] Turning now to FIG. 8B, a block diagram that illustrates a composite image without superimposed entry tokens in accordance with one embodiment of the present invention is presented. The mapping between a picture and an entry token is established when the user enrolls with the secure portable device. For example, the agreed-upon association may be such that pictures are numbered sequentially from left to right and from top to bottom. Thus, when a user is presented with a composite image without superimposed entry tokens, the user identifies at least one PIN picture and associates it with an entry token based upon the agreed-upon mapping established at enrollment.

[0088] Turning now to FIG. 8C, a block diagram that illustrates a composite image including noncontiguous superimposed entry tokens in accordance with one embodiment of the present invention is presented. As shown in FIG. SC, the entry tokens are letters of the alphabet and they increase from left to right and from top to bottom, skipping one or more letters between adjacent pictures.

[0089] Turning now to FIG. 8D, a block diagram that illustrates a composite image including superimposed entry tokens on a subset of pictures in accordance with one embodiment of the present invention is presented. As shown in FIG. 7E, at least one picture has no superimposed entry token. The entry token for a picture that has no superimposed entry token may be inferred from entry tokens superimposed on other pictures in the same composite image.

[0090] FIGS. 9-11 illustrate displaying pictures within a composite picture serially in accordance with embodiments of the present invention. Pictures comprising a composite image are presented in a piecemeal manner until the pictures that comprise the composite image have been displayed.

[0091] Turning now to FIG. 9, a block diagram that illustrates a composite image having pictures that are displayed serially in one-member groups in accordance with one embodiment of the present invention is presented. The user may indicate whether a picture is a PIN picture after each picture is presented (900-940). The user may provide a first response to indicate a picture is a PIN picture or a second response to indicate a picture is not a PIN picture. Upon providing a response, the user is presented with another picture in the composite picture. This process continues until a response has been received for each picture in the composite image (940). Alternatively, the user may indicate whether a picture is a PIN picture after all of the pictures have been presented (940).

[0092] Turning now to FIG. 10, a block diagram that illustrates a composite image having pictures that are displayed serially in two-member groups in accordance with one embodiment of the present invention is presented. The user is presented with pictures comprising the composite image, two pictures at a time. The user may enter one or more entry token to indicate one or more of the two pictures are is a PIN picture. A separate entry token may be used to indicate none of the currently displayed pictures are PIN pictures, thus skipping to the next set of two pictures. Upon providing a response, the user is presented with another two pictures in the composite image. This process continues until all pictures in the composite image (1020) have been presented. Alternatively, the user may indicate whether a picture is a PIN picture after all of the pictures have been presented (1020).

[0093] Turning now to FIG. 11, a block diagram that illustrates a composite image having pictures that are displayed serially in four-member groups in accordance with one embodiment of the present invention is presented. The user is presented with pictures comprising the composite image, four pictures at a time. The user may enter one or more entry token to indicate one or more of the four pictures are is a PIN picture. A separate entry token may be used to indicate none of the currently displayed pictures are PIN pictures, thus skipping to the next set of four pictures. Upon providing a response, the user is presented with another four pictures in the composite image. This process continues until all pictures in the composite image (1115) have been presented. Alternatively, the user may indicate whether a picture is a PIN picture after all of the pictures have been presented (1115).

[0094] Turning now to FIG. 12, a block diagram that illustrates an integrated apparatus for dynamic PIN management that includes providing a user with PIN instructions in accordance with one embodiment of the present invention is presented. FIG. 12 is similar to FIG. 3 except that FIG. 12 includes a PIN selector 1230 for selecting a PIN from a group of one or more PINs and for sending PIN hints or instructions to a user 1260. Secure portable device 1200 includes at least one stored PIN 1205 that comprises one or more picture category IDs. Device 1200 also includes a picture database 1210 for storing categorized pictures and a category selector 1220 for selecting a picture category ID list 1275 and an entry token correspondence list 1280. Device 1200 also includes an image generator 1225 for generating a composite image 1280 that includes pictures corresponding to the picture categories selected by the category selector 1220. Secure portable device 1200 also includes a PIN comparator 1215 for comparing the entry token correspondence list 1280 with an entry token list 1250.

[0095] In operation, a user 1260 requests access to a service (1235). PIN selector 1230 receives the access request 1235 and selects a PIN that comprises at least one picture category ID. Category selector 1220 creates an entry token correspondence list 1280 that includes at least one entry token that corresponds with the at least one picture category ID in the selected PIN 1205. Category selector 1220 also creates a picture category ID list 1275 including picture category IDs comprising the selected PIN 1205. According to one embodiment of the present invention, the ordering of the picture categories IDs within the picture category ID list 1275 determines the order the corresponding pictures will be presented to the user 1260. The picture category ID list 1275 includes PIN picture category IDs and filler category IDs. Category selector 1220 presents the picture category ID list 1275 to image generator 1225. For each picture category ID in the picture category ID list 1275, the image generator 1225 selects a picture that belongs to the picture category from the picture database 1210. Image generator 1225 then combines the selected pictures into a composite image 1280. At 1240, PIN selector 1230 sends PIN instructions or hints to the user 1260. The instructions or hints provide information to help the user 1260 select the correct pictures in the correct order when presented with a composite image 1280.

[0096] Still referring to FIG. 12, at 1245 the composite image 1280 is presented to the user 1260. The composite image 1280 may be presented to the user 1260 via the user's mobile phone 1265, Personal Digital Assistant (PDA) 1270 or the like. The composite image 1280 may also be displayed to the user via the display device of a PC or workstation (not shown in FIG. 12). The user 1260 uses the PIN instructions or hints 1240 to identify PIN pictures within the composite image 1280. At 1250 the user 1260 provides an entry token list 1250 by entering entry tokens corresponding to the PIN pictures within the composite image 1280. PIN comparator 1215 receives the entry token correspondence list 1280 from category selector 1220. PIN comparator 1215 also receives the entry token list 1250 and compares it to the entry token correspondence list 1280. If the lists match, access to the service is granted at 1255. If the lists do not match, access to the service is denied at 1255.

[0097] According to one embodiment of the present invention, PIN selector 1230 selects a PIN from a preconfigured group of PINs and includes the name of the PIN or other prearranged reference to the PIN in the PIN instructions 1240 sent to the user 1260. The preconfigured group of PINs may be established when the user 1260 enrolls with the secure portable device 1200. For example, suppose the user 1260 establishes three PINs at enrollment: an Animal PIN including various animal picture category IDs, a Furniture PIN including various furniture picture category IDs and a People PIN including various people picture category IDs. In this case, the PIN selector 1230 may select one of the preconfigured PINs and include the PIN name in the PIN instructions to the user 1260.

[0098] According to another embodiment of the present invention, the PIN instructions 1240 indicate a PIN by picture category. For example, the instructions 1240 may direct the user 1260 to identify four pictures that include depictions of a horse, a dog, a tree and a car, respectively.

[0099] According to another embodiment of the present invention, the PIN instructions 1240 indicate a PIN by picture category and an entry order of the entry token identifying the PIN picture in the composite picture. Using the example above, the instructions may direct the user 1260 to identify four pictures that include depictions of a horse, a dog, a tree and a car, respectively. The instructions 1240 may further instruct the user 1260 to identify the pictures in reverse order (car-tree-dog-horse).

[0100] According to another embodiment of the present invention, the same PIN instructions 1240 are provided every time an access request 1235 is received. Those of ordinary skill in the art will recognize that other instructions are possible.

[0101] Turning now to FIG. 13, a block diagram that illustrates a distributed apparatus for dynamic PIN management in accordance with one embodiment of the present invention is presented. Secure portable device 1300 includes a stored PIN 1305 that comprises one or more picture category IDs. Secure portable device 1300 also includes a category selector 1310 for selecting a picture category ID list 1375 and an entry token correspondence list 1380. Secure portable device 1300 also includes a PIN comparator 1315 for comparing an entry token list 1350 with the entry token correspondence list 1380.

[0102] Host 1320 includes a picture database 1330 for storing categorized pictures and an image generator 1325 for generating a composite image 1345 that includes pictures corresponding to the picture categories selected by category selector 1310 of secure portable device 1300. According to one embodiment of the present invention, host 1320 comprises a mobile phone. According to one embodiment of the present invention, host 1320 comprises a Web server.

[0103] In operation, user 1360 requests access to a service (1335). Host 1320 receives the access request 1335 and forwards the request 1335 to secure portable device 1300. Category selector 1310 in secure portable device 1300 receives the access request 1335 and creates a picture category ID list 1375. According to one embodiment of the present invention, the ordering of the picture categories IDs within the picture category ID list 1375 determines the order the corresponding pictures will be presented to the user 1360. The picture category ID list 1375 includes PIN picture category IDs and filler category IDs. Category selector 1310 creates an entry token correspondence list 1380 that includes at least one entry token that corresponds with the at least one picture category ID in the PIN 1305. Category selector 1310 also creates a picture category ID list 1375 including picture category IDs comprising the PIN 1305. Category selector 1310 sends the picture category ID list 1375 to host 1320. Image generator 1325 in host 1320 receives the picture category ID list 1375. For each picture category ID in the picture category ID list 1375, the image generator 1325 selects a picture that belongs to the picture category from the picture database 1330. Image generator 1325 then combines the selected pictures into a composite image 1345. According to one embodiment of the present invention, the positioning of pictures within the composite image 1345 is based upon the corresponding picture category ID's position in the picture category ID list 1375. At 1340 the composite image 1345 is presented to the user 1360. At 1350 the user 1360 enters entry tokens corresponding to pictures within the composite image 1345. Host 1320 forwards the entry token list 1350 to secure portable device 1300. PIN comparator 1315 in secure portable device 1300 receives the entry token correspondence list 1380 from category selector 1310. PIN comparator 1315 also receives the entry token list 1350 and compares it to the entry token correspondence list 1380. If the lists match, access to the service is granted at 1355. If the lists do not match, access to the service is denied at 1355.

[0104] According to another embodiment of the present invention, secure portable device 1300 provides the user 1360 with PIN instructions or hints upon receiving the access request 1355. The user 1360 uses the PIN instructions or hints to identify PIN pictures within the composite image 1345.

[0105] Turning now to FIG. 14, a block diagram that illustrates a distributed apparatus for dynamic PIN management using a smart card 1400 in accordance with one embodiment of the present invention is presented. FIG. 14 is similar to FIG. 13 except that the secure portable device 1300 of FIG. 13 corresponds to a smart card 1400 in FIG. 14. The smart card 1400 interfaces with host 1425 via a card acceptance device (CAD) 1420.

[0106] Turning now to FIG. 15, a block diagram that illustrates a distributed apparatus for dynamic PIN management using a smart card in accordance with one embodiment of the present invention is presented. FIG. 15 is a more detailed form of FIG. 14. FIG. 15 illustrates an embodiment where the user 1565 is presented with a composite image 1550 comprising nine pictures and the user 1565 must choose four of the pictures. For example, suppose the PIN picture categories are the dog, rabbit, house and lion categories. In this case, the stored PIN 1505 comprises the four PIN picture category IDs that correspond to the dog, rabbit, house and lion picture categories. When category selector 1510 receives an access request 1540, it determines the filler category IDs and the display order for all pictures. In the present example, the filler categories are the cow, plane, flower, truck and ship categories. Category selector 1510 creates an entry token correspondence list 1585 that includes at least one entry token that corresponds with the at least one picture category ID in the PIN 1505. Category selector 1510 also creates a list of the nine picture category IDs (1580) and sends the picture category ID list 1580 to the host 1525. The picture category ID list 1580 in the present example is cow-plane-house-flower-dog-rabbit-truck-ship-lion.

[0107] Still referring to FIG. 15, image generator 1530 in host 1525 receives the picture category ID list 1580 and generates a composite image 1550 that includes pictures belonging to the picture categories in the picture category ID list 1580 and ordered according to the order specified by the picture category ID list 1580. The composite image 1550 is presented to the user 1565 at 1545. The user 1565 selects pictures according to the agreed-upon PIN. If the agreed-upon PIN specifies that the order of the pictures matters, the user 1565 must enter the entry tokens in the agreed-upon order. For example, if the agreed-upon order is dog-rabbit-house-lion and if composite image 1550 is numbered according to FIG. 4, the user 1565 enters 5-6-3-9. If the composite image 1550 is numbered according to FIG. 5 and order matters, the user 1565 enters 1-3-6-9. If order does not matter, the four numbers may be entered in any order.

[0108] According to embodiments of the present invention, at least one composite image instruction is included with a picture category ID list 1580. The at least one composite image instruction may indicate entry tokens to superimpose over one or more pictures in the composite image 1550. The at least one composite image instruction may also identify a preconfigured set of composite image instructions maintained by the image generator 1530. This is explained in more detail below with reference to FIG. 16.

[0109] Turning now to FIG. 16, a block diagram that illustrates a distributed apparatus for dynamic PIN management using a smart card and a separate composite image server in accordance with one embodiment of the present invention is presented. FIG. 16 is similar to FIG. 14 except that FIG. 16 includes a separate composite image server 1625 in communication with the host 1680 via a network 1685. According to one embodiment of the present invention, host 1680 comprises a mobile phone. According to another embodiment of the present invention, host 1680 comprises a Web server. The composite image server 1625 generates composite images 1650 in response to instructions from host 1680. FIG. 16 also illustrates the inclusion of composite image instructions with the picture category ID list 1690 sent by a secure portable device such as a smart card 1600.

[0110] In operation, user 1665 requests access to a service (1640). Host 1680 receives the access request 1640 and forwards the request 1640 to smart card 1600. Category selector 1610 in smart card 1600 receives the access request 1640 and creates an entry token correspondence list 1695 that includes at least one entry token that corresponds with the at least one picture category ID in the PIN 1605. Category selector 1610 also creates a picture category ID list and at least one composite image instruction 1690. Category selector 1610 sends the picture category ID list and at least one composite image instruction 1690 to host 1680. Host 1680 receives the picture category ID list and the at least one composite image instruction 1690 and forwards them to image generator 1630 in composite image server 1625. For each picture category ID in the picture category ID list 1690, the image generator 1630 selects a picture that belongs to the picture category from the picture database 1635. Image generator 1630 then combines the selected pictures into a composite image 1650 based upon the at least one composite image instruction 1690. Image generator 1630 forwards the composite image 1650 to host 1680. At 1645, host 1680 presents the composite image 1650 to the user 1665. At 1655 the user 1665 enters entry tokens corresponding to pictures within the composite image 1650. Host 1680 forwards the entry token list to the smart card 1600. PIN comparator 1615 in smart card 1600 receives the entry token correspondence list 1695 from category selector 1610. PIN comparator 1615 also receives the entry token list 1655 and compares it to the entry token correspondence list 1695. If the lists match, access to the service is granted at 1660. If the lists do not match, access to the service is denied at 1660.

[0111] According to another embodiment of the present invention, smart card 1600 provides the user 1665 with PIN instructions or hints upon receiving the access request 1640. The user 1665 uses the PIN instructions or hints to identify PIN pictures within the composite image 1650.

[0112] Turning now to FIG. 17, a flow diagram that illustrates a method for dynamic PIN management in accordance with one embodiment of the present invention is presented. At 1700, a PIN comprising at least one picture category ID is created. The PIN creation may be part of an enrollment process whereby a user authenticates himself or herself to a secure portable device that maintains the PIN. The user interfaces with the secure portable device to establish an agreed-upon one or more PIN picture categories.

[0113] At 1705 an access request is received. At 1710, an entry token correspondence list is created. The entry token correspondence list includes at least one entry token that corresponds with the at least one picture category ID in the PIN. If the one or more PIN picture category IDs comprises more than one category ID, the correspondence criteria may indicate a required order of entry tokens in an entry token list. In other words, The required order defines the order in which an entry token corresponding to a picture must be entered. For example, for a PIN comprising four PIN categories, if the PIN picture categories are the dog, cat, house and flower categories, an exemplary entry order is dog-cat-house-flower. This particular entry order requires that when a user is presented with a composite image comprising multiple pictures where each of the pictures is associated with an entry token, the user must enter the entry token for a picture including a dog, followed by the entry token for a picture including a cat, followed by the entry token for a picture including a house, followed by the entry token for a picture including a flower. Those of ordinary skill in the art will recognize that other required entry orders are possible.

[0114] Still referring to FIG. 17, at 1715 a picture category ID list is provided for displaying a composite image including pictures based on the picture category ID list. The picture category ID list includes the picture category IDs comprising the PIN. According to one embodiment of the present invention, the at least one composite image instruction is provided along with the picture category ID list. At 1720, an entry token list is received in response to providing the picture category ID list. At 1725, the entry token correspondence list is matched with the entry token list. At 1730, a determination is made regarding whether the two lists match. If the lists match, access to the service is granted at 1740. If the lists do not match, access to the service is denied at 1735.

[0115] Turning now to FIG. 18, a flow diagram that illustrates a method for dynamic PIN management in accordance with one embodiment of the present invention is presented. At 1800, a picture category ID list is received. At 1810, a picture is selected for each picture category ID in the picture category ID list. The pictures may be selected from a database that includes categorized pictures. If more than one picture shares that same picture category, a randomized process may be used to determine which picture is selected. At 1815, each of the selected pictures is positioned in a composite image based on the position of the picture category ID in the picture category ID list. At 1820, the composite image is presented to a user. At 1825, an entry token list is received, where at least one entry token corresponds to a position within the composite image of a user-selected picture. At 1830, the entry token list is provided for use in determining whether the user-selected pictures match the PIN picture categories.

[0116] Turning now to FIG. 19, a flow diagram that illustrates a method for dynamic PIN management in accordance with one embodiment of the present invention is presented. At 1900, a picture category ID list and at least one composite image instruction is received. At 1905, a picture is selected for each picture category ID in the picture category ID list. The pictures may be selected from a database that includes categorized pictures. If more than one picture shares that same picture category, a randomized process may be used to determine which picture is selected. At 1910, a determination is made regarding whether an entry token needs to be superimposed on the picture. The at least one composite image instruction may indicate an entry token needs to be superimposed on the picture. Alternatively, the entry tokens to be superimposed may be preconfigured. If an entry token needs to be superimposed on the picture, an entry token is selected at 1915 and superimposed on the picture at 1920. At 1925, each of the selected pictures is positioned in a composite image based on the at least one composite image instruction. At 1930, the composite image is presented to a user. At 1935, an entry token list is received, where at least one entry token corresponds to a user-selected picture. At 1940, the entry token list is provided for use in determining whether the user-selected pictures match the PIN picture categories.

[0117] Turning now to FIG. 20, a flow diagram that illustrates a method for dynamic PIN management that includes providing a user with PIN instructions in accordance with one embodiment of the present invention is presented. FIG. 20 corresponds with FIG. 8. FIG. 20 is similar to FIG. 17, except that FIG. 20 includes sending PIN instructions or hints to a user (2015) before the user selects one or more pictures within the composite image. At 2000, a request for access to a service is received. At 2005, a PIN comprising at least one picture category ID is created. At 2010, an entry token correspondence list is created. The entry token correspondence list includes at least one entry token that corresponds with the at least one picture category ID in the PIN. At 2015, PIN instructions are sent to the user. The instructions or hints provide information to help the user select the correct pictures in the correct order when presented with a composite image. At 2020, a picture category ID list is provided for displaying a composite image including pictures based on the picture category ID list. The picture category ID list includes the picture category IDs comprising the PIN. At 2025, an entry token list is received where at least one entry token corresponds to a position within the composite image of a user-selected picture. At 2030, the entry token correspondence list is matched with the entry token list. At 2035, a determination is made regarding whether the two lists match. If the lists match, access to the service is granted at 2045. If the lists do not match, access to the service is denied at 2040.

[0118] Embodiments of the present invention have a number of advantages. The PIN is dynamic and thus hard to predict, making the PIN more secure. Eliminating the need to remember a numeric PIN also benefits people who have difficulty remembering numbers. The difficulty in predicting a PIN also obviates the need for an expensive CAD certification process.

[0119] While embodiments and applications of this invention have been shown and described, it would be apparent to those skilled in the art having the benefit of this disclosure that many more modifications than mentioned above are possible without departing from the inventive concepts herein. The invention, therefore, is not to be restricted except in the spirit of the appended claims.