Call Center Customer Verification by Query-Directed Passwords

We introduce an authentication framework called Query-Directed Passwords (QDP) that is designed to incorporate the convenience of authentication by entrenched (long-term) knowledge questions (such as “What is your favorite marine animal?”), but to offer stronger security than from personal questions as traditionally used. Security is strengthened for this scheme by imposing several restrictions on the questions and answers, and specifying how QDP is implemented in conjunction with other factors. Four QDP implementations are examined for the call center application. We examine the security and convenience of one of these implementations in more detail. This implementation involves client-end storage of questions in a computer file or a wallet card, and follows a basic challenge-response authentication protocol.