A system and method is presented for authentication, so as to control access to a resource. A set of objects (for example, a set of images) is established in advance between the user and the service for which the user is to be authenticated. During the authentication, the user, instead of inputting an alpha-numeric password, will be sent several sets (e.g., tables) containing the previously specified objects (e.g., images) in some arrangement (e.g., spatial pattern) among other objects (images). In order to authenticate, the user is shown additional tables, and must determine, as to each, whether it contains the same set of specified objects in the same spatial relationship as in the first table shown. After the user has correctly identified which tables reflect the specified objects in the requisite pattern, the user will be considered authenticated, and will then be granted access to the requested resource (for example, a bank account).