GB2522606A

GB2522606A - User authentication system

Info

Publication number: GB2522606A
Application number: GB1320741.0A
Authority: GB
Inventors: Marvin Johnson
Original assignee: Individual
Current assignee: Individual
Priority date: 2013-11-25
Filing date: 2013-11-25
Publication date: 2015-08-05
Also published as: GB201320741D0

Abstract

This is a method for two factor user authentication that uses augmented reality images. An image server supplies a random image (1) to an encrypted database. Then encrypted database then sends an encrypted image to an augmented reality token service (ARTS). A website (13) then adds an ARTS code to the webpages login screen (3). The ARTS then assigns a GPS derived unique identifier code onto the users device (4) and stores the code on the encrypted database. An augmented reality image is presented (5) onto the login screen. The user (12) then scans the AR image with a software application (6). A computer vision algorithm analyses the image and sends the details (8) to the ARTS. The ARTS then creates a keypair and sends it to the encrypted database (9). The ARTS then authenticates the image passcode and if the image features and the unique identifier code match the user gains entry (10). The AR image and passcode are deleted after a single use.

Description

Intellectual Property Office Application No. GB1320741.O RTM Date:29 May 20t5 The following terms are registered trade marks and should be read as such wherever they occur in this document: WiFi Intellectual Property Office is an operating name of the Patent Office www.gov.uk/ipo

USER AUTHENTICATION SYSTEM

FIELD OF INVENTION

This invention relates to the field of methods for user authentication. More specifically it relates to methods for two factor user authentication involving augmented reality image recognition.

BACKGROUND OF INVENTION

In the world of evolving technology, where the vast majority of planet's population are involved in data communication systems, such as packet-switched networks, and where the users connect using optical fiber, LAN, WiFi or similar, and mobile communications, supporting standard protocols such as GPRS, EDGE, WCDMA, GSM or similar, it is getting more and more important to ensure that the connection to such communication systems is as secure as possible and user's personal data and belongings are protected. There are many user authentification systems provided, the simplest and most popular being one factor (IFA) authentication system, where the user, accessing the website, such as a bank account or similar, is prompted to enter long and complex username and password login combination in order to provide the necessary security to access the content.

Unfortunately, with various keylogging or hacking systems on the market, these login credentials are becoming increasingly easier to automatically identify, which poses a risk of having secure personal, financial or similar data being stolen. In addition, users often resort to names, birthdays, family names, pet animals and other personal information to create a username/password combination that is complex, but easy to remember. However, todays hackers are using brute4orce methods with the power of networked computers, which allow to hack said username/password combinations and break into the users account by knowing minimal personal data.

In order to cope with this problem, two factor authentication (2FA) systems are provided, when user has to enter a specific code along with the username and password. Said specific code is consisted of numbers/letters and provided as a picture in the user login screen. However, with the power of today's computing systems, hackers can also easily break this kind of security. As a result it is virtually impossible for the general public to create a hacker safe username/password combination that is both long and complex enough for computers to identify, but easy to remember by human beings. This problem leads to end user to either utilise weak username/password combinations and be open to the attack of malicious software and hackers or at the expense of the webmasters or site owners or similar abandon the sign up process altogether and/or constantly re apply for new passwords, which is seen as a great inconvenience for both parties.

Recent improvements in camera sensors have enabled the creation of more advanced mobile based 2FA authentication systems using quick response (OR) codes. These systems incorporate the OR code which is scanned by the camera of the users mobile device along with the entry of username/password. Scanned encrypted data, combined with the username/password combination, allows the user to gain access to protected websites and provides additional security.

However, it is complicated to create software packages, that can identify the scanned encrypted data. Scanning of some kind of picture, for example the OR code or any similar, and identification/analysis of the picture by machine algorithms, is called a machine vision technology. The most common way of realising machine vision is extracting features/interest points (e.g. corners, edges, local extremes) of the image and creating a descriptor for each feature. The two main requirements for a good descriptor are distinctiveness and invariance to image noise, changes in illumination and changes in viewing direction, rotation and scale. This is because the same feature in different images must be described in a similar way with a respect to a similarity measure. The orientation is usually defined by intensity of feature point neighboring pixels. In addition, invariance to rotation is very important characteristic of feature descriptors, but however it often leads to mismatches when the image contains multiple congruent or non-congruent features. Furthermore, the orientation of the scanning device is often heavily constraint, in order to create matching descriptors. Therefore, more beneficial method is created, where the descriptor is provided for at least one feature of an image, comprising the steps of providing an image captured by a capturing device and extracting at least one feature from the image, and assingning a descriptor to the at least one feature, the descriptor depending on at least one parameter, which is indicative of an orientation, wherein the at least one parameter is determined from an absolute or relative orientation of the tracking device. Refer to the USA patent No. US2012219188A1 for more detailed information. There are some previous patented inventions known, describing methods of 2FA authentication.

A USA patent No. U52013167208, published on 2013-06-27 describes a smart phone login using OR code. Systems and methods are disclosed for a user to use a mobile device such as a smart phone to scan a OR (Quick Response) code displayed on a login webpage of a website. The OR code may encode a server URL of the website. The mobile device decodes the OR code and transmits a device ID and other decoded information to a service provider. The service provider locates login credentials of the user linked to the device ID and communicates the login credentials to a website server for user authentication. Alternatively, the mobile device may transmit its device ID to the website server for the website server to locate a user account linked to the device ID for user login. Alternatively, the mobile device may transmit stored login credentials to the website server. Advantageously, a user may access a website without the need to provide any login credentials.

Another USA patent No. US2013219479, published on 2013-08-22, describes another smart phone login using OR code. Systems and methods are disclosed herein for a user to use a trusted device to provide sensitive information to an identity provider via OR (Quick Response) code for the identity provider to broker a website login or to collect information for the website. A user may securely transact with the website from unsecured devices by entering sensitive information into the trusted device. The identity provider may generate the OR code for display by the website on an unsecured device. A user running an application from the identity provider on the trusted device may scan the OR code to transmit the OR code to the identity provider.

The identity provider may validate the OR code and may receive credential information to authenticate the user or may collect information for the website.

Advantageously, the user may perform a safe login to the website from untrusted devices using the trusted device.

An international patent No. W02013063048, published on 2013-05-02, discloses a mobile, wireless biometric identification system, which includes a biometric capture device, associated software and processes which enable a commercially available wireless communication device, such as a smartphone, using a commercially established wireless communication networks, to capture a digital image of a human biometric (iris, fingerprint, etc.) for transmission via a secure connection to a central server. The capture device is designed to focus on the difficult task of capturing the highest possible quality image for encoding and comparison, while the overall system is designed to leverage the existing cellular communication network. At the server level, the server system receives the image, encodes the image to a biometric template, and compares the encoded template to a plurality of reference templates stored in a database to identify the individual. Identification data is then transmitted back to the smartphone device and displayed.

Another US patent, No. U52012171997, published on 2012-07-05, discloses a security system, which includes a software application running in a user1s smartphone and a separately carried visual key that the user can image at will with the smartphone's camera. An effective visual key would typically comprise digital data encoded in a series of colored cells arranged in a colorgram. Such digital data is treated as a what-you-have security factor, and is concatenated with other security factors so users can authenticate themselves to websites, internet services, and even within the smartphone device itself or its applications. In one aspect, when users authenticate themselves to a server, the server returns a short-term supply of one-time-passwords or account numbers for use in secure access and financial transactions on other systems.

Another US patent, No. U52013111208, published on 2013-05-02, describes techniques for authentication via mobile device. A mobile device is pre-registered for website authentication services. A user encounters a website displaying an embedded code as an image alongside a normal login process for that website. The image is identified by the mobile device, encrypted and signed by the mobile device and sent to a proxy. The proxy authenticates the code and associates it with the website. Credentials for the user are provided to the website to automatically authenticate the user for access to the website bypassing the normal login process associated with the website.

While prior art inventions above are improvements to existing single factor security (1FA), image recognition search based methods is the next stage in the evolution of mobile vision technology. Most of the previous patented inventions describe the user authentication involving OR codes. However Quick Response code methods feature some drawbacks. Firstly, OR codes use a specific open standard to contain specific data in the code itself -it can be used to execute a variety of commands, the most common of which being a mobile link. In addition, because OR codes is an open standard, they can interact with many available apps, thus making it vulnerable. Therefore, augmented reality image feature recognition is much safer way for user authentication by virtue of limitless randomness of the image features. Also, it is a more secure technology that can provide not only more information and content than a OR code which is restricted, but without as many of the security risks.

SUMMARY

An object of the present invention is to provide a method and a system thereof for user authentication, involving augmented reality based two factor authentication images in order to alleviate the problems with the popular OR code user recognition systems/methods mentioned above and increase the efficiency, security and convenience of user authentication. In other words, the invention aims at providing a computer vision based augmented reality single sign on and one-time password mobile authentication system using computer vision algorithms that improves upon existing username-password login systems and, more recent, OR code smart phone login systems. System, provided by the invention, removes the need for the user to enter username and password details into a website, thus removes a weak and often compromised security login system known as I FA or one factor authentication. Said system, provided by the invention, comprises a user operated mobile device and a single sign on (880) augmented reality token service (ARTS).

Said mobile device can be any smart phone, tablet computer, notebook or similar, since they are capable of installing and using mobile software application, and feature a high quality imaging device, such as a digital camera or similar.

Said ARTS SSO uses an image and passcode combination to authenticate the user in the following manner: when a user is willing to register himself with a client website, he will be given a choice to enter a username and a password or use the ARTS. If the choice is ARTS, the user will be shown a screen with an augmented reality image and a weblink to download a software application to his mobile device.

When the user downloads and opens the application, he automatically registers his device with the ARTS server and server generates a unique identification code (4) for users device. In order to proceed with the authentication, the user then should use the application in combination with the imaging device, integrated in his mobile device, to scan the said augmented reality (AR) image (6). The said scanning of an AR image generates a secret image passcode. Said ARTS combines the unique device identification code with the secret image passcode and sends them as a keypair (9) to the encrypted database. Encrypted database verifies if the keypair is valid (9) and refreshes the web browser login page -grants the access to the website (10).

Said image passcode is generated by a computer vision algorithm, featured in the said software application. The said augmented reality image is a rich terrain data image, taken from digital elevation models, it is sub-divided or scaled into smaller random image tiles for display on an end client display medium. These tiles are given a unique universal identification (UUID) filename and can be derived from the combined spatial (Cartesian x, y and z) grid coordinates or alternatively the global positioning system (GPS) longitude, latitude and altitude coordinates that, when combined, are used to create a single value which is given a UUID value to use as a unique image passcode.

DESCRIPTION OF DRAWINGS

In order to understand the invention better and appreciate its practical applications, the following pictures are provided and referenced hereafter. Figures are given as examples only and in no way limit the scope of the invention.

Figure 1. illustrates the most preferred embodiment of the invention, where the invention is realized as an augmented reality based 2FA user authenti-cation system. The exact workflow of the system is demonstrated: Earth image server supplies random earth image (1) to encrypted dB; en-crypted dB sends (2) an encrypted earth image to ARTS; website (13) adds ARTS code to the webpage login screen (3); user registers with ARTS by downloading a software application, ARTS assigns GPS de-rived unique identifier code onto the device (4) and stores said code on encrypted dB; augmented reality earth image is presented (5) onto the login screen; the user (12) scans AR image with a software application (6); scanned image feature details are sent for further analysis (7); computer vision algorithm analyses image features and sends details (8) to ARTS; ARTS creates a keypairfrom device ID and scanned image passcode and sends it to the encrypted dB (9); encrypted dB authenti-cates unique identifier code (9); ARTS authenticates the image passcode; if analysed image features and unique identifier code match, confirmation occurs and login page is refreshed, user gains entry (10); AR image and passcode and deleted after a single use (11).

Figure 2. illustrates the simplified and easily understandable scheme of the most preferred embodiment of the invention: opening of the secure webpage (14), displaying an augmented reality (AR) image (15), scanning of the AR image (16), sending of user login details with AR image details (17), sending of successful login message (18), refreshing the user browser with a secure webpage (19).

Figure 3. illustrates the most preferred embodiment of the present invention, where the three dimensional (Cartesian x, y, z or longitude, latitude, al- titude) terrain image (22) is overlaid (21) with a specific secondary im-age (20) and processed to two dimensional (Cartesian x, y or longitude, latitude) terrain image (23), available for scanning it with a mobile de-vice, capable of imaging, such as webcam (24), augmented reality glasses (25), smartphone (26) or similar and analysing it with computer vision algorithms. Marks, named Point A" represent, that after the pro-cessing, terrain features remain unchanged.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

The most preferred embodiment of the present invention is an augmented reality based two factor user authentication system, comprising at least a mobile device, mobile application and a single sign on (SSO) augmented reality token server (ARTS). Said mobile device in this context is any device that is capable of having a said mobile application installed, such as a smart phone, tablet computer and similar, and features a high resolution imaging device, such as a digital camera or similar.

Said mobile application is adapted to communicate with the imaging device and is also capable of sending/receiving information through data communication systems.

A step by step workflow of the most preferred embodiment is shown in Fig.1 and described in detail below: I When the user is willing to register himself within the client website, he is given a choice of using regular username and password combination or use ARTS 830 (3). If the user chooses ARTS 380, he is shown a screen with an augmented reality (AR) image and a hyperlink to download a mobile software application. $

II When the user downloads the said software application, ARTS assigns and installs GAS derived unique identifier code onto the device (4), i.e. the user is automatically registered -device unique identifier code is stored in the encrypted database.

Ill When the user is willing to log into the secure website (13), he is given a choice of using regular username password or use ARTS SSO (3). If the choice is ARTS SSO, user (12) turns on the said software application and scans said AR earth image with an imaging device (6).

IV Image features are sent to computer vision algorithm for further analysis (7) and then sent to ARTS.

V Augmented reality application algorithm cloud server matches GAS derived unique device identifier code (ID) and returns device ID and said unique image passcode as a keypair to the encrypted database (9).

VI Encrypted database authenticates the GAS derived device ID (9).

VII ARTS server authenticates the image passcode.

VIII If the authentications, mentioned above, are successful, the secure website is refreshed and the user is granted the access (10) to the website (13) IX A single sign on password pair and AR image are deleted and a single use.

In the most preferred embodiment, said augmented reality image, scanned with the mobile software application further in the workflow, is a planar two dimensional (2D) or three dimensional (3D) digital earth image. Digital earth image relates to any image that is derived from the following types of earth data set formats: digital elevation models (DEM), digital terrain models (DTM), GeoTiff image files, RasterTiff image files, digital surface models (DSM), LandXML files, text files containing Cartesian coordinate (x, y and z) terrain data information and similar. It should be taken into consideration that selection of digital earth image file format does not limit the scope of the invention.

In the most preferred embodiment, the said digital earth image is sub-divided or scaled into smaller random image tiles for display on an end client display medium, 4) such as web page, mobile web page, smart phone, tablet computer, notebook, mobile computer kiosk, physical display medium, door entry system or similar.

In the most preferred embodiment, said digital earth image is converted to portable network graphics (PNG) file format or similar, such as JPEG, BMP, etc., and output into cloud based storage server for later retrievial by an augmented reality (AR) image recognition system. Subsequently, in the most preferred embodiment, output PNG or similar format image is overlaid with a specific secondary image in order to increase security of the authentication system. It should be noted, that an overlaid image is adapted to still be recognizable by an AR or computer vision camera system. The aforementioned secondary image is any standard image format, such as PNG, TIFF, JPEG, BMP or similar, and has a different opacity, that, after merging the main digital earth image is still recognizable to AR or computer vision algorithms. It should be noted that selection of first and secondary image formats and opacity does not limit the scope of the invention and the person, skilled in the art, can apply such knowledge creatively for proper realization of this invention. In the most preferred embodiment, the digital earth image is bound by coordinate limits to define vectors by which to crop the source image file to resulting new imagery shape tiles for use in recognition algorithms. Said shape tiles in the most preferred embodiment are given a random and unique universal identification (UUID) filename. Said UUID values can be derived from the combined Cartesian (x, y and z) coordinates or alternatively the global positioning system (GPS) longitude, latitude and altitude coordinates, that when combined are used to create a single value, which is then given a UUID value (image passcode) to use as a unique filename, linked to that particular image or image shape tile.

In the most preferred embodiment, digital earth image, derived from the digital terrain models, is displayed on the end client display medium as a two dimensional representation of the original three dimensional digital terrain model, using php, htm, HTML or similar programing language to embed the two dimensional images for processing by the computer vision augmented reality systems.

In another preferred embodiment, digital earth image, derived from the digital terrain models, is displayed on the end client display medium as a two dimensional representation of the three dimensional digital terrain model, using php, htm, HTML, webGL, X3D or similar three dimensional model/viewer or other programming language to embed three dimensional models for processing by the computer vision augmented reality systems.

In the most preferred embodiment, the said unique device ID is obtained by extracting OPS or other positional grid coordinates for use as location based passcodes. Said extraction of coordinates is achieved by employing random coordinate extractor tool which uses boundary coordinates as high and low limits to extract a random GPS longitude, latitude, altitude or Cartesian grid coordinates. In the most preferred embodiment, resulting values are given a UUID value to create a passkey.

In the most preferred embodiment of the present invention, said digital earth image UUID and location based passcode is combined to create a computer vision augmented reality protocol or workflow so that a password pair is created, stored and used for mobile device authentication (9:10).

In the most preferred embodiment, a single sing on (SSO) password keypair is deleted after the one-time use (11). 1]

Claims

CLAIMS1. A method for two factor (2FA) user authentication, involving augmented reality (AR)imagesc h a r a c t e r i z e d inthat: -earth image server supplies a random image (1) to the encrypted dB, -encrypted dB sends (2) an encrypted image to ARTS, -website (13) adds ARTS code to the webpage login screen (3), -the user registers with ARTS by downloading a software application into his mobile device, ARTS assigns GPS derived unique identifier code onto the device (4) and stores said code on encrypted dB, an augmented reality earth image is presented (5) onto the login screen onto the end client display medium, -the user (12) scans AR image with a software application (6), -scanned image feature details are sent for further analysis (7), computer vision algorithm analyses image features and sends details (8) to ARTS, -ARTS creates a keypair from device ID and scanned image passcode and sends it to the encrypted dB (9), encrypted dB authenticates unique identifier code, -ARTS authenticates the image passcode; if analyzed image features and the unique identifier code match, confirmation occurs and login page is refreshed, user gains entry (10), -AR image and passcode and deleted after a single use.
2. The method, according to claim 1, c h a r a c t e r i z e d in that augmented reality earth image is any digital earth terrain image that is derived from either digital elevation models (DEM), digital terrain models (DTM), Geoliff image files, RasterTiff image files, digital surface models (DSM), LandXML files, text files containing Cartesian coordinate (x, y and z) terrain data information or similar.
3. Themethod,accordingtooneofclaimslto2,characterized in that said software application is arranged to automatically create a location based unique device passcode.
4. Themethod,accordingtooneofclaimslto3,characterized in that said mobile software application is further arranged to extract global positioning system (GPS) longitude, latitude and altitude and/or Cartesian coordinates (x, y and z) from digital earth imagery, combine it with the location based passcode and send the combined keypair to ARTS and encrypted database.
5. Themethod,accordingtooneofclaimslto4,characterized in that three dimensional (3D) digital images are displayed as a two dimensional (2D) representation, using php, htm, HTML, webGL or similar programming languages.
6. Themethod,accordingtooneofclaimslto5,characterized in that in that encrypted database is arranged to authenticate the location based passcode.
7. Themethod,accordingtooneofclaimslto6,characterized in that in that the said ARTS is arranged to authenticate the keypair passcode and grant/deny user's access to the secure webpage.
8. Themethod,accordingtooneofclaimslto7,characterized in that the said users mobile device is either a smart phone, tablet computer, notebook, augmented reality glasses, webcam or similar.
9. Themethod,accordingtooneofclaimslto8,characterized in that the said mobile device has an implemented imaging device, such as a digital camera or similar.
10. Themethod,accordingtooneofclaimslto9,characte rized in that the said end client display medium is either a web page, mobile web page, smart phone, tablet computer, notebook, mobile computer kiosk, physical display medium, door entry system or similar.