_Please clarify the specific new high-risk technical innovation you are proposing to develop, and explain how you will be able to create a defensible competitive advantage. Many systems of this general type have been studied in the past._

??? of 3,500 characters w/ spaces  
Proposed high-risk technical innovation: 

nKode is an observation-resistant “something-you-know” authentication method that replaces direct entry of a static secret (a PIN or password). The user’s long-term secret is a short sequence of memorable attributes (for example four icons). At each authentication, the terminal displays a randomized layout to protect against key loggers and social engineering attacks, such as shoulder surfing, that groups many attributes into a small number of selectable keys. The user does not enter their secret attributes directly. Instead, they enter the key IDs that currently contain their secret attributes.

Example:

Secret attributes: 😍🤢🤐🥸

 _key1_   _key2_

| 😃😍 |  | 🥸🤩 |

| 😇😎 |  | 🤓🥳 |

 -----          -----

 _key3_   _key4_

| 🥺🤯 |  | 🫥🤥 |

| 😡🥶 |  | 🤢🤐 |

enter: 1,4,4,2

After authentication, the keypad is shuffled.

 _key1_   _key2_

| 🫥😍 |  | 🥸🤥 |

| 😇🤐 |  | 🤢🥳 |

 -----          -----

 _key3_   _key4_

| 😃🤯 |  | 🥺🤩 |

| 😡😎 |  | 🤓🥶 |

 -----          -----

enter: 1,2,1,1

The user experience remains “type four digits,” but the meaning of those digits changes each time based on the on-screen challenge.

Why this is materially different from prior studied approaches:

We recognize that observation-resistant PIN entry methods and graphical password families have been studied extensively. nKode differentiates on two practical dimensions that matter in PoS/ATM settings:

(a) Fast, low-friction entry compatible with checkout throughput. Unlike many shoulder-surfing-resistant schemes that require multiple challenge rounds or complex mental transformations, nKode preserves a “type-a-short-code” interaction: users enter a short sequence of key IDs derived from a single on-screen layout. While we will quantify entry time and error rate in Phase I, prior work on shuffled keypads suggests that small increases in entry time relative to a static keypad can be achieved without fundamentally changing the interaction model.

(b) Designed to remain resistant under multiple recorded observations (not just one). A common limitation of observation-resistant schemes is that they degrade quickly when an attacker can record several sessions. In contrast, based on our work with McCrary, we are targeting nKode configurations in which an attacker must record on the order of 5 or more sequential authentications of the same user’s nKode to recover the underlying secret with high confidence.

Defensible competitive advantage:

Our defensible advantage is that our IP covers a family of nKode implementations, not a single keypad skin. The same mechanism can ship in regulated payment settings as a virtual keypad that mirrors physical keys, and in software and accessibility variants by grouping and reshuffling visual, alphanumeric, audio, or tactile attributes. Because the claims cover both the attribute types and the grouping mechanism that defines the challenge, a fast follower cannot avoid the core invention through cosmetic substitutions (for example, swapping emojis for letters/numbers).

Future Work:

nKode is not limited to PoS and ATMs. It can replace passwords in apps and websites by presenting unique AI-generated icons for each user. This eliminates password reuse, keyloggers, and dictionary attacks. These properties make it a strong candidate for healthcare (where authentication happens frequently on shared or semi-public workstations) and defense (where adversaries may capture keystrokes and recorded logins).