System and method for authentication in a social network service

[0001] This application claims the benefit of PPA Ser. No. 60/874,997 filed Dec.16, 2006 by the present inventor, which is incorporated by reference.

[0002] Not applicable

[0003] Not applicable

[0004] 1. Field of the Invention

[0005] This invention relates generally to computer security, in particular to the use of authentication in a social network service on a computer network.

[0006] 2. Prior Art

[0007] A social network service is a computer-based application to assist users of the application in managing their relationships with other users of the application. A social network service application will maintain a database of its users, and enable users to find other users of the application. Users may choose to indicate a social relationship with another user, and this is indicated by a link record in the database underlying the application.

[0008] There are two implementations of a database service typically used as the repository underlying social network services: a relational database, and a directory service.

[0009] In a typical relational database, the data is managed in one or more tables. Each table comprises a set of rows, and each row has values in one or more columns. The relational database model is described in the paper “A Relational Model of Data for Large Shared Data Banks” by E. Codd which appeared in the Communications of the ACM issue 13 (6): 377-387 of 1970.

[0010] In a typical directory service, one or more server computers host instances of directory server software. These directory servers implement the server side of a directory access protocol, such as the X.500 Directory Access Protocol (DAP), as defined in the document ITU-T Rec. X. 519 “Information technology—Open Systems Interconnection—The Directory: Protocol specifications”, or the Lightweight Directory Access Protocol (LDAP), as defined in the document “Lightweight Directory Access Protocol (v3)”, by M. Wahl et al of December 1997. A primary component of the information model of a directory server is the directory information tree. The directory information tree comprises a set of one or more directory entries. Each entry has a distinguished name that is unique amongst the entries in the directory information tree. Each entry comprises a set of one or more attributes. Each attribute has an attribute type, and there is at most one attribute in an entry of each attribute type. Each attribute has one or more values. Each entry has an attribute, objectClass, with one or more values that are names of object classes defining the contents of the entry. A directory schema defines the semantics associated with each object class and attribute type. The schema specifications for an object class include: the attribute types of attributes which must be present in an entry when the entry has that object class, and the attribute types of attributes which may be present in an entry when the entry has that object class. The schema specifications for an attribute type include: the maximum number of values of the type which can be present in an entry, the syntax of the values of the attribute type, and how values of the attribute are compared with each other.

[0011] Social network service applications are typically operated as a centralized service, hosted by an organization with substantial database space available to it, and offered as service to users on the Internet, accessible via the user's web clients. Many social network services encourage users to upload to the service descriptive text, video and digital photographs of themselves, and these are displayed to other users who are viewing that user's information.

[0012] A web client (12) interacts with a social network service application (18) running on a web server (16) through one or more Transport Layer Protocol (TCP) connections carried by an Internet Protocol-based network, such as the Internet. The Hyper-text Transfer Protocol (HTTP), described in the document “Hypertext Transfer Protocol—HTTP/1.1” (IETF RFC 2616) by R. Fielding et al of June 1999, is used to transfer over these connections requests from the web client to the application, and responses from the application to the web client. These responses are typically documents in the HyperText Markup Language (HTML), described in the document “HTML 4.01 Specification” by D. Raggett et al of December 1999.

[0013] A HTTP session is a representation in the memory or storage of the server or application of an association between a web client and the application during a period of time. A session is used to maintain the state of the web client's interaction with the application, including whether the web client has been authenticated to the application. An identifier for a session is provided in each response to a web client, using either a Uniform Resource Locator (URL) parameter or a “cookie”. A web client includes the session identifier in requests to the application which generated it, using either a URL parameter or a cookie. The Uniform Resource Locator is defined in the document “Uniform Resource Identifier (URI): Generic Syntax” (IETF RFC 3986) by T. Berners-Lee et al of January 2005. The HTTP cookie is defined in the document “HTTP State Management Mechanism” (IETF RFC 2109) by D. Kristol et al of February 1997.

[0014] Each time a new session is created, or if a session has not been used in longer than a predetermined period of time, the application will authenticate the user whose web client created the session. At a minimum, in typical prior art social network services, the user will be required to provide their login id and credentials to the web client, which will send these to the application. Typical prior art social network services, such as LinkedIn and Facebook, use a password as login authentication credentials, and compare the password against a record for that user in a database or directory service.

[0015] However, if the social network service only requires a password to authenticate a user of the service, then should a user's password be stolen or compromised, in particular if the user is re-using this password to authenticate to other services, the user may not detect this password theft for a period of time, and an application which relies solely on the login id and password may inadvertently provide access to sensitive information held within the social network database about users to attackers who have stolen a user's password. Furthermore, such services may be vulnerable to password guessing attacks, in which an attacker provides to a service being attacked a series of requests which include many commonly-used words as the password, in order to find accounts which have easily-guessed passwords.

[0016] To reduce the vulnerability of social network services to attackers impersonating authorized users, this invention combines traditional password-based authentication with a novel system of image-based authentication. In this invention, a social network service application will, at intervals, challenge users to provide not just their password, but also to correctly identify one or more other users of the system, to whom the user being authenticated has indicated they have a link. This authentication challenge check will hinder attackers which have merely obtained access to a user's password, or guessed the password, but do not know other information about the user, from being able to proceed into further use of the application.

• • [0026] 10 User
  • [0027] 12 Web client
  • [0028] 14 Social network service
  • [0029] 16 Web server
  • [0030] 18 Social network service application component
  • [0031] 20 Social network service authentication component
  • [0032] 22 Directory server component
  • [0033] 24 Relational database server component
  • [0034] 26 Administrator interface component
  • [0035] 28 Data source component
  • [0036] 40 Authentication interface
  • [0037] 42 Image 1
  • [0038] 44 Input 1
  • [0039] 46 Image 2
  • [0040] 48 Input 2
  • [0041] 50 Image 3
  • [0042] 52 Input 3
  • [0043] 54 Image 4
  • [0044] 56 Input 4
  • [0045] 58 Submit button
  • [0046] 80 Authentication table
  • [0047] 82 Image use table
  • [0048] 84 Alias table
  • [0049] 86 Image table
  • [0050] 88 Link table
  • [0051] 90 Login table
  • [0052] 100 Group table
  • [0053] 102 Group member table
  • [0054] 110 Root DSE
  • [0055] 112 Organization directory entry
  • [0056] 114 Organizational unit ou=people directory entry
  • [0057] 116 Person directory entry
  • [0058] 118 Person directory entry
  • [0059] 120 Organizational unit ou=groups directory entry
  • [0060] 122 Group directory entry
  • [0061] 124 Group directory entry
  • [0062] 126 Image directory entry
  • [0063] 128 Image directory entry
  • [0064] 400 Organization network
  • [0065] 402 ISP router
  • [0066] 404 Firewall router
  • [0067] 406 DMZ server computer
  • [0068] 408 Router
  • [0069] 410 Internal switch
  • [0070] 412 Database server computer
  • [0071] 414 Application server computer
  • [0072] 416 Administrator workstation computer
  • [0073] 500 Server computer
  • [0074] 502 CPU
  • [0075] 504 Hard disk interface
  • [0076] 506 System bus
  • [0077] 508 BIOS ROM
  • [0078] 510 Hard disk
  • [0079] 512 Operating system software and state on hard disk
  • [0080] 514 Application software and state on hard disk
  • [0081] 516 Random access memory
  • [0082] 518 Operating system software and state in memory
  • [0083] 520 Application software and state in memory
  • [0084] 522 Network interface
  • [0085] 524 LAN switch
  • [0086] 600 Workstation computer
  • [0087] 602 CPU
  • [0088] 604 Video interface
  • [0089] 606 System bus
  • [0090] 608 USB interface
  • [0091] 610 Hard disk interface
  • [0092] 612 BIOS ROM
  • [0093] 614 Hard disk
  • [0094] 616 Operating system software and state on disk
  • [0095] 618 Application software and state on disk
  • [0096] 620 Network interface
  • [0097] 622 Random access memory
  • [0098] 624 Operating system software and state in memory
  • [0099] 626 Application software and state in memory
  • [0100] 628 Monitor
  • [0101] 630 Keyboard
  • [0102] 632 Mouse
  • [0103] 634 LAN switch

[0104] The invention comprises the following components:

• • [0105] a web client (12),
  • [0106] a social network service application component (18),
  • [0107] an authentication component (20),
  • [0108] a directory server (22),
  • [0109] a relational database (24), and
  • [0110] an administrator interface (26).

[0111] The web client (12) is a software component that operates under the control of the user (10) and interacts with the web server application (18) using a protocol such as the Hyper-text Transfer Protocol (HTTP).

[0112] The social network service application component (18) is a software component that implements the processing logic of the social network service. This component accepts incoming connections from web clients, and maintains in an in-memory or on-disk data structure comprising the states of each session with a web client (12) that is currently active. This component communicates with the social network service authentication component (20) when it is necessary for it to authenticate a user.

[0113] The social network service authentication component (20) is a software component that implements the authentication function for the social network service. This component maintains an in-memory data structure comprising a set of records of each recent failed authentication attempt by a web client. This component communicates with a directory server component (22) and a relational database server component (24).

[0114] The directory server component (22) is a software component that implements the server side of a directory access protocol, such as DAP or LDAP. The directory server component maintains a directory information tree of one or more directory entries.

[0115] When the directory server component is being used to maintain the authentication and data for the social network service, each user of the social network service is represented by a directory entry in the directory information tree (116, 118). Each user's entry is located in the directory tree immediately subordinate to an entry with relative distinguished name “ou=people” (114). The entry for a user comprises the following attributes:

• • [0116]

[0117] objectClass: The values of this attribute indicate the object class of this entry, and include the class “person”.

• • [0118] uid: The value of this attribute is a unique identifier for this user.
  • [0119] cn: The value of this attribute is the full name of the user.
  • [0120] mail: The value of this attribute is the electronic mail address of the user.
  • [0121] createTimestamp:
    • [0122] The value of this attribute is the date and time the account for the user was created.
  • [0123] loginName: The value of this attribute is the login name of the user.
  • [0124] lockout: The value of this attribute is a boolean that indicates whether the user is locked out.
  • [0125] userPassword:
    • [0126] The value of this attribute is a one-way hash of the password of the user.
  • [0127] imageuse: Each of the values of this attribute encode, for each image-based authentication event for the user, the login date and time, the date and time that the user was last presented with images in image-based authentication, and the set of the image numbers of the images that were supplied to the user being authenticated in image-based authentication.
  • [0128] linkTo: The values of this attribute each encode, for each link from the user to another user, the unique identifier for that user.
  • [0129] aliasTo: The values of this attribute each encode, for each alias the user has for another user, the unique identifier for that user, and the alias for that user.
  • [0130] loginHistory: The values of this attribute each encode a login attempt by the user.

[0131] When the directory server component is being used to maintain the authentication and data for the social network service, then the images used for authentication are represented by directory entries in the directory tree, with one entry for each image (126, 128). Each image's entry is located in the directory tree immediately subordinate to the entry for the user that is the subject of the image. The entry for an image comprises the following attributes:

• • [0132] objectClass: The values of this attribute indicate the object class of this entry, and include the class “image”.
  • [0133] iid: The value of this attribute is a unique identifier for the image.
  • [0134] uid: The value of this attribute is the unique identifier of the user.
  • [0135] createTimestamp:
    • [0136] The value of this attribute is the date and time the image was created.
  • [0137] jpegPhoto: The values of this attribute each encode an image in JPEG format.

[0138] When the directory server component is being used to maintain the authentication and data for the social network service, then groups of users are represented by entries in the directory service, with one entry for each group (122, 124). Each group's entry is located in the DIT immediately subordinate to an entry with relative distinguished name “ou=groups” (120). Each entry comprises the following attributes:

• • [0139] gid: The value of this attribute is a unique identifier for the group.
  • [0140] cn: The value of this attribute is the name of the group.
  • [0141] createTimestamp:
    • [0142] The value of this attribute is the date and time the group was created.
  • [0143] member: The values of this attribute contain the distinguished names of the entries representing the users that are the members of the group.

[0144] The relational database server component (24) is a software component that provides a table-based data storage service to the authentication component (20). When the relational database server component is being used to maintain the authentication data for the social network service, then this component maintains 8 tables: the authentication table (80), the image use table (82), the alias table (84), the image table (86), the link table (88), the login table (90), the group table (100) and the group member table (102).

[0145] The authentication table (80) comprises a set of one or more records. Each record is a single row, and each represents one user of the application. The primary key of this table is the USER ID column. The rows of this table have the following columns:

• • [0146] USER ID: The value in this column is a unique identifier, within the scope of the application, for the user identified by this record.
  • [0147] LOGIN ID: The value in this column is the login name by which the user is identified to the application.
  • [0148] CREDENTIALS: The value in this column is a one-way hash of the user's password.
  • [0149] NAME: The value in this column is the full name of the user.
  • [0150] LOCKOUT: The value in this column is an indication of whether the user's account has been locked out. If the value is not NULL, the user will not be permitted to log in.
  • [0151] EMAIL: The value in this column is the electronic mail address of the user.

[0152] The image use table (82) comprises a set of zero or more records. Each record is a single row that encodes the identifier of the images that were presented to a user being authenticated using image-based authentication. The rows of this table have the following columns:

• • [0153] USER ID: The value in this column is the identifier for the user identified by this record. The value in this column is the same as the value in the user id column for a record in the authentication table.
  • [0154] LAST LOGIN DATE: The value in this column is the last login date and time of the user.
  • [0155] LAST AUTH DATE: The value in this column is the date and time that the user was last presented with images in image-based authentication.
  • [0156] AUTHENTICATION IMAGE NUMBER LIST: The value in this column is a set of the image numbers of the images that were supplied to the user being authenticated in image-based authentication.

[0157] The alias table (84) comprises a set of zero or more records. Each record is one row that represents an alias, such as a nickname, that one user has given for another. There can only be records for a specific pair of user id creator and user id target if there is a corresponding record in the link table (88) for that user id creator and user id target, or if both users have a group in common. The rows of this table have the following columns:

• • [0158] USER ID CREATOR: The value in this column is the identifier for the user who has created the alias.
  • [0159] USER ID TARGET: The value in this column is the identifier for the user who is being assigned this alias.
  • [0160] ALIAS: The value in this column is a short string name for the target user, chosen by the creator user.

[0161] The image table (86) comprises a set of one or more records. Each record is encoded as a single row, which represents an image, from a digital photograph, of a user. The primary key of this table is the combination of the USER ID and IMG NO columns. The rows of this table have the following columns:

• • [0162] USER ID: The value of this column is the identifier for the user represented in this image. The value in this column is the same as the value in the user id column for a record in the authentication table.
  • [0163] IMG NO: The value of this column is a unique identifier for this image. Each record's value for this column must be unique in the image table.
  • [0164] ADD DATE: The value of this column is the date and time that the image was added.
  • [0165] ENCODING: The value in this column is the Multipurpose Internet Mail Extensions (MIME) content-type for the image. A typical value for this column would be “image/jpeg”, for an image in the JPEG format.
  • [0166] CONTENT: The value in this column is the bytes of the encoded image itself.

[0167] The link table (88) comprises a set of one or more records. Each record represents a link from one user to another, and is encoded as a single row in the table. The primary key of this table is the combination of the USER ID CREATOR, USER ID TARGET and LINK TYPE columns. The rows of this table have the following columns:

• • [0168] USER ID CREATOR: The value in this column is the identifier for the user who has created the link.
  • [0169] USER ID TARGET: The value in this column is the identifier for the user who is the target of the link.
  • [0170] LINK TYPE: The value in this column is the type of the link, for use in social network services which have multiple types of links. For example, values of this column might be “friend”, “neighbor”, “relation” or “colleague”.
  • [0171] ADD DATE: The value in this column is the date and time the link was created.
  • [0172] LINK INFO: The value in this column is additional information about the link, for use by the creator of the link.

[0173] The login table (90) comprises a set of records. Each record is encoded by a single row and represents an attempt by a user to log in to the application. The primary key of this table is the combination of the USER ID and DATE columns. The rows of this table have the following columns:

• • [0174] USER ID: The value of this column is the identifier for the user indicated by this login record. The value in this column is the same as the value in the USER ID column for a row in the authentication table.
  • [0175] DATE: The value of this column is the date and time of the login attempt.
  • [0176] RESULT: This column indicates whether the login attempt was successful or unsuccessful.

[0177] The group table (100) comprises a set of records. Each record is encoded by a single row and represents one particular group. The primary key of this table is the GROUP ID column. The rows of this table have the following columns:

• • [0178] GROUP ID: The value in this column is a unique identifier in the application for the group identified by this record. Each record's value for this column must be unique in the group table.
  • [0179] NAME: The value in this column is the name of the group.
  • [0180] ADD DATE: The value in this column is the date and time the group was created.
  • [0181] STATUS: The value in this column is the status of the group.
  • [0182] GROUP TYPE: The value in this column is the type of the group, for social network service applications which support multiple types of groups.

[0183] The group member table (102) comprises a set of records. Each record represents the membership of a user in a group. The primary key of this table is the combination of the GROUP ID and USER ID columns. The rows of this table have the following columns:

• • [0184] GROUP ID: The value in this column is the identifier for the group. A record's value for this column matches the group id column for a record in the group table.
  • [0185] USER ID: The value in this column is the identifier for the user. A record's value for this column matches the user id column for a record in the authentication table.
  • [0186] ADD DATE: The value in this column is the date and time the user was added as a member to the group.

[0187] The administrator interface (26) is a software component that enables the administrator of the social networking service to maintain the configuration of the service and the contents of its database.

[0188] The processing components of this invention can be implemented as application software running on one or more computer systems communicating via a network.

[0189] The diagram of FIG. 7 illustrates an example computer network in which an organization operates an internal organization network (400) which is connected to the Internet via an ISP router (402). A firewall router (404) directs access requests originating from computer systems on the Internet external to the organization to a DMZ server computer (406). The DMZ server computer performs the front-end connection processing and request validation, and forwards the valid requests via a router (408) and an internal switch (410) to an application server computer (414). The application server computer (414) may rely upon a software running on a database server computer (412) which maintains the persistent state of the application. The administrator will interact with the application using client software installed on the administrator workstation computer (416). In this network, the social network service application component (18) and social network service authentication component (20) may be implemented as software running on the application server computer (414), the directory server component (22) and relational database server component (24) may be implemented as software running on the database server computer (414), and the administrator interface component (26) may be implemented as software running on the administrator workstation computer (416).

[0190] The diagram of FIG. 8 illustrates the typical components of a server computer (500). Components of the computer include a CPU (502), a system bus (506), a hard disk interface (504), a hard disk (510), a BIOS ROM (508), random access memory (516) and a network interface (522). The network interface connects the computer to a local area network switch (524). The hard disk (510) stores the software and the persistent state of the operating system (512) and applications (514) installed on that computer. The random access memory (516) holds the executing software and transient state of the operating system (518) and application processes (520).

[0191] The diagram of FIG. 9 illustrates the typical components of a workstation computer (600). Components of the computer include a CPU (602), a system bus (606), a video interface (604) to a monitor (628), a hard disk interface (610), a hard disk (614), a USB interface (608) to a keyboard (630) and a mouse (632), a BIOS ROM (612), random access memory (622) and a network interface (620). The network interface connects the computer to a local area network switch (634). The hard disk (614) stores the software and the persistent state of the operating system (616) and applications (618) installed on that computer. The random access memory (622) holds the executing software and transient state of the operating system (624) and application processes (626).

[0192] During normal operations, the web server (16) will await incoming HTTP connections from the web client (12). When a request arrives on one of these connection, the web server will dispatch the request to a thread of the application component (18).

[0193] The application component (18) comprises one or more threads of control. The behavior of a thread in the application component (18) is illustrated by the flowchart of FIG. 5A and FIG. 5B. Each thread in this component starts processing at step 204.

[0194] At step 204, the thread will wait for an incoming request from the web server (16). At step 206, the thread will parse the incoming request for a session identifier. If the request does not have a valid session identifier, then at step 214 the thread will generate a new session data object, provide the session identifier to the web server to be returned in a subsequent response to the web client, and then the thread will continue processing at step 218. Otherwise, at step 210, the thread will parse the session identifier from the request. If the session identifier is not valid, in particular if it does not identify a session object, the session object it identifies has expired, or if the session object it identifies is not appropriate to the request, then at step 214 the thread will generate a new session data object, provide the session identifier to the web server to be returned in a subsequent response to the web client, and then the thread will continue processing at step 218. Otherwise, at step 220 the thread will check the session object to determine whether the authenticated indicator flag is TRUE. If the session has been authenticated, then at step 224 the thread will perform the request, and will loop back to step 204. Otherwise, at step 232, the thread will parse the request for response parameters from the web client, encoded as an HTML form response, which comprise either a username and credentials or a set of answers to image authentication questions. If the request does not have response parameters, then the thread will continue at step 218. Otherwise, at step 236 the thread will provide these parameters in a call to the authentication component (20) and wait for a response from that component. At step 238, the thread will parse the response to this call to the authentication component. If the response indicated a failure, then at step 242 the thread will reply to the client with an error web page. Otherwise, at step 244 the thread will set the authenticated flag to TRUE in the session, and forward the web server to return the main page of the application. The thread will then loop back to step 204.

[0195] At step 218, the thread will reply to the client with a web page comprising a form which includes basic authentication parameters, in which the user can fill in their username and password, with the intent that once the user fills in this form with the login id and password, the web client will then send a subsequent request to the application with these fields. The thread will then loop back to step 204.

[0196] The authentication component (20) can be implemented as a subroutine called from a thread in the application component. The behavior of a thread in the authentication component (20) is illustrated by the flowchart of FIG. 6A, FIG. 6B, FIG. 6C and FIG. 6D. Each thread in this component starts processing at step 302 when called by step 236 of the flowchart of FIG. 5A and FIG. 5B, and returns a response to the application component.

[0197] At step 302, the thread will retrieve the login id and presented credentials of the web client from the application component. At step 304, the thread will search in the authentication source for a record for a user with that login id. If the authentication component has been configured to use the relational database server component (24) to maintain the authentication data for the social network service, then the thread will instruct the relational database server (24) to search the authentication table (80) for a row with a value of the LOGIN ID column which matches the login id. Otherwise the thread will instruct the directory server (22) to perform a one-level search request of the directory below the “ou=people” entry (114), with a filter that matches for equality the loginName attribute of the entry with the login id supplied by the web client, and subsequent operations involving that user's account would be performed by the authentication component selecting attributes from the returned entry and submitting modify operations for that entry to the directory service. If a record was not found in the authentication source, or if a record is found and the field in the record indicated that the account is locked out, then at step 308 the thread will respond to the application component with a response of “invalid credentials”, and the subroutine will end. Otherwise, at step 312 the thread will compare the credentials provided by the web client with those stored in the record for that user. If the credentials do not match, then the thread will continue processing at step 372. Otherwise, the thread will continue to step 316.

[0198] At step 316 the thread will determine whether test images are available for display to this user. The implementation of this determination procedure depends on how the authentication component has been configured.

[0199] If the authentication component has been configured to use the relational database server component (24) to maintain the authentication data for the social network service, and to use groups to maintain the relationships between users, then the thread will instruct the database server (24) to search the group member table (102) to obtain a list of group ids of groups to which this user is a member, and then search the group member table to obtain a list of user ids of other users of these groups. For each user id found, other than for the user id being authenticated, the authentication component searches the image table (86) with that linked user id, to construct an in-memory set of records obtained from the image table. The authentication component will then instruct the database server (24) to search the image use table (82) with the user id of the user being authenticated, and from records in that table of recent image-based authentications, extract the authentication image number list column. Images found in the image table which are listed in the authentication image number list column of any records from the image use table as used in recent authentications are discarded from the set. If the set is empty, then image-based authentication testing is not possible at this time, and in this situation the authentication component will instruct the database server to add a record to the image use table (82) specifying a login with no images, and the thread will continue processing at step 366. If there is at least one image in the set of records obtained from the image table, then the authentication component will determine the duration since the last image-based authentication derived from subtracting the time in the last auth date column in the record from the image use table from the time in latest last login date column. If there is a record with a recent image-based authentication time and the duration is shorter than a specified period, then no image-based authentication testing is required to be performed at this time, and in this situation the authentication component will instruct the database server to add a record to the image use table specifying a login with no images, and the thread will continue processing at step 366. Otherwise the thread will continue processing at step 332.

[0200] If the authentication component has been configured to use the relational database server component (24) to maintain the authentication data for the social network service, and to use links to maintain the relationships between users, then the thread will instruct the database server (24) to search the link table (88) to obtain a list of user ids of users for which this user has a link, and then for each user id found, search the image table (86) with that linked user id, to construct an in-memory set of records obtained from the image table. The authentication component will then instruct the database server (24) to search the image use table (82) with the user id of the user being authenticated, and from records in that table of recent image-based authentications, extract the authentication image number list column. Images found in the image table which are listed in the authentication image number list column of any records from the image use table as used in recent authentications are discarded from the set. If the set is empty, then image-based authentication testing is not possible at this time, and in this situation the authentication component will instruct the database server to add a record to the image use table (82) specifying a login with no images, and the thread will continue processing at step 366. If there is at least one image in the set of records obtained from the image table, then the authentication component will determine the duration since the last image-based authentication derived from subtracting the time in the last auth date column in the record from the image use table from the time in the latest last login date column. If there is a record with a recent image-based authentication time and the duration is shorter than a specified period, then no image-based authentication testing is required to be performed at this time, and in this situation the authentication component will instruct the database server to add a record to the image use table specifying a login with no images, and the thread will continue processing at step 366. Otherwise the thread will continue processing at step 332.

[0201] If the authentication component has been configured to use the directory server component (22) to maintain the authentication data for the social network service, then the thread will instruct the directory server (22) to perform a subtree search request of the directory below the “ou=people” entry, with a filter that contains the OR of filters for each linked user. Each component of the OR would be an AND of a filter matching objectClass to “image” and a filter matching uid to the unique identifier of the linked user. Images whose identifiers are included in the imageUse attribute of the user being authenticated as used in recent authentications are discarded from the set of images. If the resulting set of images is empty, then image-based authentication testing is not possible at this time, and in this situation the thread will continue processing at step 366. If there is at least one image in the set of records obtained from the image table, then the authentication component will determine the duration since the last image-based authentication derived from subtracting the time in the last auth date field in the imageUse attribute value from the time in the latest last login date field of that value. If the attribute value indicates a recent image-based authentication time and the duration is shorter than a specified period, then no image-based authentication testing is required to be performed at this time, and in this situation the thread will continue processing at step 366. Otherwise the thread will continue processing at step 332.

[0202] At step 332, the thread will select images from the set of records obtained to form a subset with at least one image, at most one image of each linked user, and the maximum number of images limited to a small predetermined value, such as to a maximum of four images. The selection of images from the set for any particular linked user may be performed using a random function. The authentication component will then respond to the web client with a form that includes each of the images in the subset, and a form text field adjoining each image where the user may enter a name. An example of this layout is given in FIG. 2. The web client will display the form to the user, collect the user's input and send a request to the web application, which will forward it to the authentication component. At step 334, the thread will wait for a response from the client or until a predetermined time period (e.g., 30 seconds), is reached. If the thread timed out waiting for a response, then at step 338 the thread will respond to the application component with a response of “invalid credentials”, and the subroutine will end. Otherwise at step 342 the thread will compare the names provided by the web client to the records for the users whose images are being presented. The implementation of how the thread obtains the names for comparison depends on how the authentication component has been configured.

[0203] If the authentication component has been configured to use the relational database server component (24) to maintain the authentication data for the social network service, then the thread will instruct the database server (24) to search the alias table (84) with the user id of the user being authenticated, and the user id of each linked user for which there is an image sent to the web client, to obtain a set of alias names of each linked user as known to the authenticated user.

[0204] If the authentication component has been configured to use the directory server component (22) to maintain the authentication data for the social network service, then the thread will retrieve the set of aliases from the values of the aliasTo attribute of the directory entry of the user being authenticated.

[0205] For each image, the authentication component compares the name in the text string provided in the web client's request for that image with each of the aliases for the user identified in that image. The comparison of the two strings may be performed using either a case-insensitive string comparison algorithm, or by comparing the Soundex codes for each of the two strings. The user will be required to supply a name that matches at least one of the aliases for each of the users being identified. If there are not sufficient matches, then the thread will continue processing at step 384. Otherwise, at step 362 the thread will update the image use record. The implementation of how the thread updates this record depends on how the authentication component has been configured.

[0206] If the authentication component has been configured to use the relational database server component (24) to maintain the authentication data for the social network service, then the thread will instruct the database server (24) to add a record to the image use table (82) specifying a login with the images that were sent to the user in this session, and then the thread will continue processing at step 366.

[0207] If the authentication component has been configured to use the directory server component (22) to maintain the authentication data for the social network service, then the thread will instruct the directory server (22) to update the imageuse attribute of the user being authenticated specifying a login with the images that were sent to the user in this session, and then the thread will continue processing at step 366.

[0208] At step 366, the thread will respond to the application component to permit the web client to proceed to view the main page of social network service application. The subroutine will then end.

[0209] At step 372, the thread will update the invalid credentials count for the user being authenticated, by updating an in-memory data structure for the user, creating that structure if necessary. If fewer than the maximum number of failed authentication attempts have occurred for this user, then the thread will continue processing at step 376. Otherwise, at step 380 the thread will respond to the application component with a response of “invalid credentials”, and then the thread will continue processing at step 396.

[0210] At step 376, the thread will respond to the application component with a response of “invalid credentials”, and then exit the subroutine.

[0211] At step 384, the thread will update the image use record for the user being authenticated. The implementation of how the thread updates this record depends on how the authentication component has been configured.

[0212] If the authentication component has been configured to use the relational database server component (24) to maintain the authentication data for the social network service, then the thread will instruct the database server (24) to add a record to the image use table specifying a failed authentication attempt with the images that were sent to the user in this session, and then the thread will continue processing at step 386.

[0213] If the authentication component has been configured to use the directory server component (22) to maintain the authentication data for the social network service, then the thread will instruct the directory server (22) to update the imageuse attribute of the user being authenticated specifying a failed authentication attempt with the images that were sent to the user in this session, and then the thread will continue processing at step 386.

[0214] At step 386, the thread will update the invalid credentials count for the user being authenticated, by updating an in-memory data structure for the user, creating that structure if necessary. If fewer than the maximum number of failed authentication attempts have occurred for this user, then the thread will continue processing at step 376. Otherwise, the thread will continue processing at step 390.

[0215] At step 390, the thread will determine whether there are test images available for display to the user being authenticated. The thread will determine the set of test images by removing from the set of images determined in step 316 the images selected for display to the user at step 332. Those remaining images are the set of test images. If test images are available, then the thread will continue processing at step 332, using the set of test images as the input to the selection procedure. Otherwise, all of the images in the set have already been sent to a web client in this session or recent sessions with this user: at step 394 the thread will respond to the application component with a response of “invalid credentials”, and then the thread will continue processing at step 396.

[0216] At step 396, the thread will lockout the account for the user. The user will not be permitted to continue into the application until their lockout has been reset by an administrator (26). The implementation of how the thread updates this record depends on how the authentication component has been configured. If the authentication component has been configured to use the relational database server component (24) to maintain the authentication data for the social network service, then the thread will instruct the database server (24) to update the LOCKOUT column in the row in the authentication table (80) for that user, and add a record to the login table (90) indicating this lockout. If the authentication component has been configured to use the directory server component (22) to maintain the authentication data for the social network service, then the thread will instruct the directory server to modify the user's entry by setting the value of the lockout attribute to TRUE. At step 398, the subroutine will end.

[0217] Many different embodiments of this invention may be constructed without departing from the scope of this invention. While this invention is described with reference to various implementations and exploitations, and in particular with respect to systems for authentication in computer networks, it will be understood that these embodiments are illustrative and that the scope of the invention is not limited to them.