WO2015127256A1 - Continuous authentication with a mobile device - Google Patents
Continuous authentication with a mobile device Download PDFInfo
- Publication number
- WO2015127256A1 WO2015127256A1 PCT/US2015/016887 US2015016887W WO2015127256A1 WO 2015127256 A1 WO2015127256 A1 WO 2015127256A1 US 2015016887 W US2015016887 W US 2015016887W WO 2015127256 A1 WO2015127256 A1 WO 2015127256A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- authentication
- trust
- mobile device
- authentication information
- biometric
- Prior art date
Links
- 238000000034 method Methods 0.000 claims description 49
- 238000004364 calculation method Methods 0.000 claims description 41
- 230000004044 response Effects 0.000 claims description 19
- 230000006870 function Effects 0.000 description 85
- 239000013598 vector Substances 0.000 description 34
- 238000004891 communication Methods 0.000 description 19
- 238000010586 diagram Methods 0.000 description 19
- 238000005516 engineering process Methods 0.000 description 19
- 230000006399 behavior Effects 0.000 description 14
- 230000008859 change Effects 0.000 description 14
- 230000003993 interaction Effects 0.000 description 12
- 230000002688 persistence Effects 0.000 description 10
- 230000001413 cellular effect Effects 0.000 description 9
- 238000013507 mapping Methods 0.000 description 9
- 238000012512 characterization method Methods 0.000 description 8
- 239000002131 composite material Substances 0.000 description 8
- 238000013506 data mapping Methods 0.000 description 7
- 238000010606 normalization Methods 0.000 description 7
- 230000008569 process Effects 0.000 description 7
- 230000001815 facial effect Effects 0.000 description 6
- 238000004422 calculation algorithm Methods 0.000 description 5
- 238000012545 processing Methods 0.000 description 5
- 238000012546 transfer Methods 0.000 description 5
- 238000012795 verification Methods 0.000 description 5
- 230000003542 behavioural effect Effects 0.000 description 4
- 230000007423 decrease Effects 0.000 description 4
- 230000005021 gait Effects 0.000 description 4
- 230000036772 blood pressure Effects 0.000 description 3
- 230000000694 effects Effects 0.000 description 3
- 230000004424 eye movement Effects 0.000 description 3
- 230000037308 hair color Effects 0.000 description 3
- 230000036541 health Effects 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 230000000717 retained effect Effects 0.000 description 3
- 230000000007 visual effect Effects 0.000 description 3
- 230000001133 acceleration Effects 0.000 description 2
- 230000009471 action Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 2
- 238000013459 approach Methods 0.000 description 2
- 238000004590 computer program Methods 0.000 description 2
- 230000003247 decreasing effect Effects 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 239000000284 extract Substances 0.000 description 2
- 239000000835 fiber Substances 0.000 description 2
- 238000003384 imaging method Methods 0.000 description 2
- 239000000203 mixture Substances 0.000 description 2
- 230000006855 networking Effects 0.000 description 2
- 239000002245 particle Substances 0.000 description 2
- 210000001525 retina Anatomy 0.000 description 2
- 238000013077 scoring method Methods 0.000 description 2
- 230000002792 vascular Effects 0.000 description 2
- 230000002730 additional effect Effects 0.000 description 1
- 230000002776 aggregation Effects 0.000 description 1
- 238000004220 aggregation Methods 0.000 description 1
- 230000009118 appropriate response Effects 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008094 contradictory effect Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000003292 diminished effect Effects 0.000 description 1
- VJYFKVYYMZPMAB-UHFFFAOYSA-N ethoprophos Chemical compound CCCSP(=O)(OCC)SCCC VJYFKVYYMZPMAB-UHFFFAOYSA-N 0.000 description 1
- 230000004927 fusion Effects 0.000 description 1
- 239000011521 glass Substances 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 238000000691 measurement method Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000002085 persistent effect Effects 0.000 description 1
- 230000004461 rapid eye movement Effects 0.000 description 1
- 230000002207 retinal effect Effects 0.000 description 1
- 238000010079 rubber tapping Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 210000000707 wrist Anatomy 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/42—User authentication using separate channels for security data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/316—User authentication by observing the pattern of computer usage, e.g. typical user behaviour
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/45—Structures or tools for the administration of authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
- H04W12/065—Continuous authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2139—Recurrent verification
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/082—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying multi-factor authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
Definitions
- the present invention relates to continuous authentication of a user of a mobile device.
- a service provider such as a bank, a credit card provider, a utility, a medical service provider, a vendor, a social network, a service, an application, or another participant may require verification that a user is indeed who the user claims to be.
- a service provider may wish to authenticate the user when initially accessing a service or an application, such as with a username and password. In other situations, the service provider may require authentication immediately prior to executing a transaction or a transferal of information.
- the service provider may wish to authenticate the user several times during a session, yet the user may choose not to use the service if authentication requests are excessive.
- a device may require to authenticate a user.
- an application such as a personal email application on a mobile device may require verification that a user is indeed the rightful owner of the account.
- the user may wish to validate a service provider, service, application, device or another participant before engaging in a communication, sharing information, or requesting a transaction.
- the user may desire verification more than once in a session, and wish some control and privacy before sharing or providing certain types of personal information.
- either or both parties may desire to allow certain transactions or information to be shared with varying levels of authentication.
- the mobile device may perform continuous authentication with an authenticating entity.
- the mobile device may include a set of biometric and non- biometric sensors and a processor.
- the processor may be configured to receive sensor data from the set of sensors, form authentication information from the received sensor data, and continuously update the authentication information.
- FIG. 1 is a block diagram of a mobile device in which aspects of the invention may be practiced.
- FIG. 2 is a diagram of a continuous authentication system that may perform authentication with an authenticating entity.
- FIG. 3 is a diagram illustrating the dynamic nature of the trust coefficient in the continuous authentication methodology.
- FIG. 4 is a diagram illustrating a wide variety of different inputs that may be inputted into the hardware of the mobile device to continuously update the trust coefficient.
- FIG. 5 is a diagram illustrating that the mobile device may implement a system that provides a combination of biometrics and sensor data for continuous authentication.
- FIG. 6 is a diagram illustrating the mobile device utilizing continuous authentication functionality.
- FIG. 7 is a diagram illustrating the mobile device utilizing continuous authentication functionality.
- FIG. 8 is a diagram illustrating a wide variety of authentication technologies that may be utilized.
- FIG. 9 is a diagram illustrating a mobile device and an authenticating entity utilizing a trust broker that may interact with a continuous authentication manager and a continuous authentication engine.
- FIG. 10 is a diagram illustrating a variety of different implementations of the trust broker.
- FIG. 11 is a diagram illustrating privacy vectors (PVs) and trust vectors (TVs) between a mobile device and an authenticating entity.
- PVs privacy vectors
- TVs trust vectors
- FIG. 12 is a diagram illustrating privacy vector components and trust vector components.
- FIG. 13A is a diagram illustrating operations of a trust vector (TV) component calculation block that may perform TV component calculations.
- TV trust vector
- FIG. 13B is a diagram illustrating operations of a data mapping block.
- FIG. 13C is a diagram illustrating operations of a data mapping block.
- FIG. 13D is a diagram illustrating operations of a data normalization block.
- FIG. 13E is a diagram illustrating operations of a calculation formula block.
- FIG. 13F is a diagram illustrating operations of a calculation result mapping block and a graph of example scenarios.
- the term "mobile device” refers to any form of programmable computer device including but not limited to laptop computers, tablet computers, smartphones, televisions, desktop computers, home appliances, cellular telephones, personal television devices, personal data assistants (PDA's), palm-top computers, wireless electronic mail receivers, multimedia Internet enabled cellular telephones, Global Positioning System (GPS) receivers, wireless gaming controllers, receivers within vehicles (e.g., automobiles), interactive game devices, notebooks, smartbooks, netbooks, mobile television devices, mobile health devices, smart wearable devices, or any computing device or data processing apparatus.
- An "authenticating entity” refers to a service provider, a service, an application, a device, a social network, another user or participant, or any entity that may request or require authentication of a mobile device or a user of a mobile device.
- FIG. 1 is block diagram illustrating an exemplary device in which embodiments of the invention may be practiced.
- the system may be a computing device (e.g., a mobile device 100), which may include one or more processors 101, a memory 105, an FO controller 125, and a network interface 110.
- Mobile device 100 may also include a number of sensors coupled to one or more buses or signal lines further coupled to the processor 101.
- mobile device 100 may also include a display 120 (e.g., a touch screen display), a user interface 119 (e.g., keyboard, touch screen, or similar devices), a power device 121 (e.g., a battery), as well as other components typically associated with electronic devices.
- mobile device 100 may be a transportable device, however, it should be appreciated that device 100 may be any type of computing device that is mobile or non-mobile (e.g., fixed at a particular location).
- Mobile device 100 may include a set of one or more biometric sensors and/or non-biometric sensors.
- Mobile device 100 may include sensors such as a clock 130, ambient light sensor (ALS) 135, biometric sensor 137 (e.g., heart rate monitor, electrocardiogram (ECG) sensor, blood pressure monitor, etc., which may include other sensors such as a fingerprint sensor, camera or microphone that may provide human identification information), accelerometer 140, gyroscope 145, magnetometer 150, orientation sensor 151, fingerprint sensor 152, weather sensor 155 (e.g., temperature, wind, humidity, barometric pressure, etc.), Global Positioning Sensor (GPS) 160, infrared (IR) sensor 153, proximity sensor 167, and near field communication (NFC) sensor 169.
- GPS Global Positioning Sensor
- IR infrared
- NFC near field communication
- sensors/devices may include a microphone (e.g. voice sensor) 165 and camera 170.
- Communication components may include a wireless subsystem 115 (e.g., Bluetooth 166, Wi-Fi 111, or cellular 161), which may also be considered sensors that are used to determine the location (e.g., position) of the device.
- a wireless subsystem 115 e.g., Bluetooth 166, Wi-Fi 111, or cellular 161
- multiple cameras are integrated or accessible to the device.
- a mobile device may have at least a front and rear mounted camera. The cameras may have still or video capturing capability.
- other sensors may also have multiple installations or versions.
- Memory 105 may be coupled to processor 101 to store instructions for execution by processor 101.
- memory 105 is non-transitory.
- Memory 105 may also store one or more models, modules, or engines to implement embodiments described below that are implemented by processor 101.
- Memory 105 may also store data from integrated or external sensors.
- Mobile device 100 may include one or more antenna(s) 123 and transceiver(s) 122.
- the transceiver 122 may be configured to communicate bidirectionally, via the antenna(s) and/or one or more wired or wireless links, with one or more networks, in cooperation with network interface 110 and wireless subsystem 115.
- Network interface 110 may be coupled to a number of wireless subsystems 115 (e.g., Bluetooth 166, Wi-Fi 111, cellular 161, or other networks) to transmit and receive data streams through a wireless link to/from a wireless network, or may be a wired interface for direct connection to networks (e.g., the Internet, Ethernet, or other wireless systems).
- wireless subsystems 115 e.g., Bluetooth 166, Wi-Fi 111, cellular 161, or other networks
- Mobile device 100 may include one or more local area network transceivers connected to one or more antennas.
- the local area network transceiver comprises suitable devices, hardware, and/or software for communicating with and/or detecting signals to/from wireless access points (WAPs), and/or directly with other wireless devices within a network.
- WAPs wireless access points
- the local area network transceiver may comprise a Wi-Fi (802. l lx) communication system suitable for communicating with one or more wireless access points.
- Mobile device 100 may also include one or more wide area network transceiver(s) that may be connected to one or more antennas.
- the wide area network transceiver comprises suitable devices, hardware, and/or software for communicating with and/or detecting signals to/from other wireless devices within a network.
- the wide area network transceiver may comprise a CDMA communication system suitable for communicating with a CDMA network of wireless base stations; however in other aspects, the wireless communication system may comprise another type of cellular telephony network or femtocells, such as, for example, TDMA, LTE, Advanced LTE, WCDMA, UMTS, 4G, or GSM.
- any other type of wireless networking technologies may be used, for example, WiMax (802.16), Ultra Wide Band (UWB), ZigBee, wireless USB, etc.
- WiMax 802.16
- Ultra Wide Band UWB
- ZigBee ZigBee
- wireless USB wireless USB
- position location capability can be provided by various time and/or phase measurement techniques.
- one position determination approach used is Advanced Forward Link Trilateration (AFLT).
- AFLT Advanced Forward Link Trilateration
- device 100 may be a mobile device, wireless device, cellular phone, personal digital assistant, mobile computer, wearable device (e.g., head mounted display, wrist watch, virtual reality glasses, etc.), internet appliance, gaming console, digital video recorder, e-reader, robot navigation system, tablet, personal computer, laptop computer, tablet computer, or any type of device that has processing capabilities.
- a mobile device may be any portable, movable device or machine that is configurable to acquire wireless signals transmitted from and transmit wireless signals to one or more wireless communication devices or networks.
- mobile device 100 may include a radio device, a cellular telephone device, a computing device, a personal communication system device, or other like movable wireless communication equipped device, appliance, or machine.
- the term "mobile device” is also intended to include devices which communicate with a personal navigation device, such as by short-range wireless, infrared, wire line connection, or other connection - regardless of whether satellite signal reception, assistance data reception, and/or position-related processing occurs at the device 100.
- mobile device is intended to include all devices, including wireless communication devices, computers, laptops, etc., which are capable of communication with a server, such as via the Internet, Wi-Fi, or other network, and regardless of whether satellite signal reception, assistance data reception, and/or position-related processing occurs at the device, at a server, or at another device associated with the network. Any operable combination of the above are also considered a “mobile device.”
- circuitry of the device 100 may operate under the control of a program, routine, or the execution of instructions to execute methods or processes in accordance with embodiments of the invention.
- a program may be implemented in firmware or software (e.g. stored in memory 105 and/or other locations) and may be implemented by processors, such as processor 101, and/or other circuitry of device.
- processor microprocessor, circuitry, controller, etc.
- processor may refer to any type of logic or circuitry capable of executing logic, commands, instructions, software, firmware, functionality and the like.
- the functions of each unit or module within the mobile device 100 may also be implemented, in whole or in part, with instructions embodied in a memory, formatted to be executed by one or more general or application- specific processors.
- Sensor inputs may refer to any input from any of the previously described sensors, e.g. a clock 130, ambient light sensor (ALS) 135, biometric sensor 137 (e.g., heart rate monitor, blood pressure monitor, etc.), accelerometer 140, gyroscope 145, magnetometer 150, orientation sensor 151, fingerprint sensor 152, weather sensor 155 (e.g., temperature, wind, humidity, barometric pressure, etc.), Global Positioning Sensor (GPS) 160, infrared (IR) sensor 153, microphone 165, proximity sensor 167, near field communication (NFC) sensor 169, or camera 170.
- GPS Global Positioning Sensor
- biometric sensor inputs may be referred to as "biometric” sensor inputs or biometric sensor information from biometric sensors, which may include a biometric sensor 137 (e.g., heart rate inputs, blood pressure inputs, etc.), fingerprint sensor 152 (e.g., fingerprint input), touch screen 120 (e.g., finger scan or touch input), touch screen 120 (e.g., hand or finger geometry input), pressure or force sensors (e.g., hand or finger geometry), microphone 165 (e.g., voice scan), camera 170 (e.g., facial or iris scan), etc.
- biometric sensor 137 e.g., heart rate inputs, blood pressure inputs, etc.
- fingerprint sensor 152 e.g., fingerprint input
- touch screen 120 e.g., finger scan or touch input
- touch screen 120 e.g., hand or finger geometry input
- pressure or force sensors e.g., hand or finger geometry
- microphone 165 e.g., voice scan
- camera 170 e.g.
- a contextual sensor may be considered to be any type of sensor or combination of sensors that relate to the current context, condition or situation of the mobile device that may relate to contextual sensing information such as light, acceleration, orientation, weather, ambient pressure, ambient temperature, ambient light level, ambient light characteristics such as color constituency, location, proximity, ambient sounds, identifiable indoor and outdoor features, home or office location, activity level, activity type, presence of others, etc.
- contextual sensors may include ambient light sensor 135, accelerometer 140, weather sensor 155, orientation sensor 151, GPS 160, proximity sensor 167, microphone 165, camera 170, etc. These merely being examples of contextual inputs and contextual sensors.
- biometric information and contextual information may be extracted from the same sensor such as a single camera or microphone.
- biometric information and contextual information may be extracted from the same set of sensor data.
- biometric and contextual information may be extracted from different sensors.
- biometric and contextual information may be extracted from different sensor data acquired from the same sensor or from a set of sensors.
- data input may refer to user-inputted data for authentication (e.g., names, IDs, passwords, PINs, etc.) or any other data of interest for authentication.
- biometric sensor information may include raw sensor data or input from one or more biometric sensors, while in other embodiments the biometric sensor information may include only processed data such as fingerprint template information having positions and orientations of various minutiae associated with the fingerprint that allows subsequent recognition of the user yet does not allow recreation of the fingerprint image.
- biometric sensor information may allow the authenticating entity to identify the user, while in other embodiments the matching or authentication is performed locally in a secure environment within the mobile device and only a verification output or an output of an authentication system such as an authentication level or an authentication score is provided to the authenticating entity.
- a sensor scan such as a fingerprint, iris, voice or retina scan, does not imply a particular method or technique of acquiring sensor data, but rather is intended to more broadly cover any method or technique of acquiring sensor input.
- sensor information as used herein may include raw sensor data, processed sensor data, information or features retrieved, extracted or otherwise received from sensor data, information about the type or status of the sensor, aggregated sensor data, aggregated sensor information, or other type of sensor information.
- sensor data may refer to raw sensor data, sensor input, sensor output, processed sensor data, or other sensor information.
- Embodiments of the invention may relate to the determination of a dynamic (continuously time- varying) trust coefficient, or a trust vector as will be described later.
- the trust coefficient may convey the current level of authentication of a user of a mobile device 100 such as a smart phone, tablet, smart watch or other personal electronic device.
- a mobile device 100 such as a smart phone, tablet, smart watch or other personal electronic device.
- high levels of trust indicated by a high trust coefficient may be obtained by a high resolution fingerprint sensor 152 of mobile device 100 or by combining a user-inputted personal identification number (PIN) with the results from a simplified, less accurate sensor (e.g. a finger scan from a touch screen display 120).
- PIN personal identification number
- a high level of trust may be achieved with a high trust coefficient when a voice scan from microphone 165 or other soft biometric indicator is combined with a GPS location (e.g. from GPS 160) of a user (e.g. recognized user at office/home).
- a moderate trust coefficient may be appropriate.
- the trust coefficient may simply convey the level or result of matching (e.g., a matching score or a result of matching) obtained from a fingerprint sensor. Examples of these scenarios will be hereinafter described in more detail.
- Transactions made available to a user may be made to depend on the value of the trust coefficient.
- a user with a high-level trust coefficient may be provided a high level of user access to sensitive information or more may be provided with the authority to execute financial transactions of greater value;
- a user with a medium-level trust coefficient may be provided with the authority to execute only small financial transactions;
- a user with a low- level trust coefficient may only be permitted browser access.
- a detected spoof attempt or other incorrect authentication result may incur a high mistrust value that requires high-level authentication to overcome.
- a trust coefficient may be calculated (e.g., via a method, function, algorithm, etc.). The trust coefficient may decay with time towards a lower level of trust or mistrust.
- a mobile device and/or a server may determine the trust coefficient.
- a continuous authentication engine (CAE), a continuous authentication manager (CAM), and a trust broker (TB) may be configured to dynamically calculate, in real time, a trust coefficient so as to provide continuous or quasi- continuous authentication capability in mobile devices.
- CAE continuous authentication engine
- CAM continuous authentication manager
- TB trust broker
- Embodiments of the invention may relate to an apparatus and method to perform authentication with an authenticating entity that the user wishes to authenticate with, based upon inputs from a plurality of sensors such as biometric sensors and non-biometric sensors, and/or user data input (e.g., user name, password, etc.).
- the processor 101 of a mobile device 100 may be configured to: receive sensor data from the set of sensors, form authentication information from the received sensor data, and continuously update the authentication information to the authenticating entity.
- mobile device 100 under the control of processor 101 may implement this methodology to be hereinafter described.
- a continuous authentication system 200 may be implemented by mobile device 100 to perform authentication with an authenticating entity 250.
- mobile device 100 may include a plurality of sensors such as biometric sensors and non-biometric sensors, as previously described.
- mobile device 100 via processor 101, may be configured to implement a continuous authentication system 200 that includes a preference setting function block 210, an authentication strength function block 220, a trust level function block 230, and a trust coefficient calculation function block 240 to implement a plurality of functions.
- These functions may include receiving an authentication request from an authenticating entity 250 (implementing an application 252) that may include a trust coefficient request or a request for other authentication information, based upon one or more of biometric sensor information, non-biometric sensor data, user data input, or time. Some sensor information may be determined on a continuous basis from data sensed continuously.
- authentication strength function block 220 may retrieve, extract or otherwise receive biometric sensor information from biometric sensors (e.g. hard biometrics and/or soft biometrics), non-biometric sensor data from non-biometric sensors (e.g.
- the trust coefficient may be continuously, quasi-continuously or periodically updated within the mobile device 100.
- the trust coefficient or other authentication information may be transmitted to the authenticating entity 250 for authentication with the authenticating entity in a continuous, quasi-continuous or periodical manner, or transmitted upon request or discreetly in time as required by the authenticating entity, e.g., for a purchase transaction.
- the authentication information may be sent to the authenticating entity 250 based on an interval or elapsing of time, or upon a change in the sensor data or authentication information from the set of sensors.
- the mobile device 100 may provide continuous authentication by calculating the trust coefficient or other authentication information with or without continuously receiving sensor information.
- continuous authentication may be provided on-demand by calculating the trust coefficient or other authentication information with or without accessing sensor information.
- the predefined security and privacy preference settings may be defined by the authenticating entity 250, the mobile device 100, or by the user of the mobile device.
- the predefined security and privacy preference settings may include types of biometric sensor information, non-biometric sensor data, user data input, or other authentication information to be utilized or not utilized in determining the trust coefficient.
- the predefined security/privacy preference settings may include required authentication strengths for biometric sensor information and/or non-biometric sensor data in order to determine whether they are to be utilized or not to be utilized.
- the authentication strength function block 220 may be configured to implement an authentication strength function to determine the authentication strength for a requested hard biometric data input, soft biometric data input, non-biometric data input, sensor data or other authentication information from the corresponding sensor(s) and to pass that authentication strength to the trust coefficient calculation function block 240, which calculates the trust coefficient that may be continuously or non-continuously transmitted to the authenticating entity 250.
- an authenticating entity 250 having associated applications 252 may implement such services as bank functions, credit card functions, utility functions, medical service provider functions, vendor functions, social network functions, requests from other users, etc. These types of authenticating entities may require some sort of verification.
- Embodiments of the invention may be related to continuously updating and transmitting a trust coefficient to an authenticating entity to provide continuous or quasi-continuous authentication.
- a trust coefficient may be a level of trust based upon a data input, such as user data inputs (e.g., username, password, etc.), non-biometric sensor inputs (e.g., GPS location, acceleration, orientation, etc.), biometric sensor inputs (e.g., fingerprint scan from a fingerprint sensor, facial or iris scan from a camera, voiceprint, etc.).
- a trust coefficient may be a composition, aggregation or fusion of one or more data inputs. Also, as will be described, each of these inputs may be given an authentication strength and/or score by authentication strength function block 220 that are used in preparing one or more trust coefficient values by trust coefficient calculation function block 240.
- An authenticating entity 250 may set a risk coefficient (RC) that needs to be met to create, generate or otherwise form a trust level significant enough to allow for authentication of a mobile device 100 for the particular function to be performed. Therefore, authenticating entity 250 may determine whether mobile device 100 has generated a trust coefficient that is greater than the risk coefficient such that the authenticating entity 250 may authenticate the mobile device 100 for the particular function to be performed.
- the term trust coefficient may be a part of the trust vector (TV), as will be described in more detail later.
- continuous authentication system 200 provides a method for continuous authentication.
- block 210 implements a security/privacy preference setting function to establish and maintain preference settings for execution.
- Preference settings as implemented by preference setting function block 210 may include user preferences, institutional preferences, or application preferences.
- the preference settings may be related to security/privacy settings, security/privacy preferences, authentication strengths, trust levels, authentication methods, decay rate as a function of time, decay periods, preferred trust and credential input/output formats, ranges of scores and coefficients, persistence values, etc.
- User preferences may include, for example settings associated with access to different networks (e.g., home network, office network, public network, etc.), geographic locations (e.g., home, office, or non-trusted locations), operational environment conditions, and format settings.
- user preferences may include customizing the functionality itself, for example, modifying the trust coefficient decay rate as a function of time, changing the decay period, etc.
- Institutional preferences may relate to the preferences of an institution, such as a trust broker of a third party service provider (e.g., of the authenticating entity 250), or other party that may wish to impose preferences, such as a wireless carrier, a device manufacturer, the user's employer, etc.
- Application preferences e.g., from applications 252 of authenticating entities 250
- the application preferences may include authentication level requirements and trust level requirements.
- preference setting function block 210 may receive as inputs one or more specified preferences of the user, specified preferences from one or more applications or services from the authenticating entity that the user may wish to interact with, or specified preferences of third party institutions.
- preference setting function block 210 may implement a negotiation function or an arbitration function to negotiate or arbitrate conflicting predefined security and privacy preferences settings between the authenticating entity 250 (e.g., application preferences and institutional preferences) and the mobile device 100 (e.g., user preferences), or to create, generate or otherwise form fused security and privacy preference settings, which may be transmitted to the authentication strength function block 220, trust level function block 230, and the trust coefficient calculation function block 240.
- preference setting function block 210 which receives various user preferences, institutional preferences and application preferences, may be configured to output fused security/privacy preference settings to negotiate or arbitrate contradictory settings among the mobile device preferences, user preferences, application preferences, institutional preferences, etc.
- Preference setting function block 210 may implement an arbitration or negotiation function to arbitrate or negotiate between any conflicting predefined security/privacy preference settings, and may output appropriate fused preference settings to the authentication strength function block 220 and trust coefficient calculation function block 240 (e.g., voice from the microphone and iris scan from the camera).
- Authentication strength function block 220 may be configured to implement an authentication strength function to determine authentication strength based on, for example, hard biometric, soft biometric or non-biometric information input.
- biometric data may be defined into two categories: "hard” biometrics, which may include data for fingerprint recognition, face recognition, iris recognition, etc., and "soft" biometrics that may include clothes color and style, hair color and style, eye movement, heart rate, a signature or a salient feature extracted from an ECG waveform, gait, activity level, etc.
- Non-biometric authentication data may include a username, password, PIN, ID card, GPS location, proximity, weather, as well as any of previously described contextual sensor inputs or general sensor inputs.
- authentication strength function block 220 may receive sensor characterization data, including, for example, a sensor identification number, sensor fault tolerance, sensor operation environment and conditions that may impact the accuracy of the sensor, etc. Some biometrics information and sensor characterization data may change dynamically and continuously.
- authentication strength function block 220 may receive data inputs (hard biometrics, soft biometrics, non-biometrics, etc.) from these various biometric and non-biometric sensors and preference data from preference setting function block 210. Based upon this, authentication strength function block 220 may be configured to output a first metric to the trust coefficient calculation block 240 signifying the strength of the biometric or non-biometric sensor data to be used for user authentication.
- the first metric may be expressed using characterizations such as high, medium, low, or none; a number/percentage; a vector; other suitable formats; etc.
- the value of this metric may change dynamically or continuously in time as some biometrics information and sensor characterization data or preference settings may change dynamically and continuously.
- the strength or reliability of soft and hard biometrics may be dynamic.
- the user may be requested to enroll her biometric information (e.g., a fingerprint) or authenticate her after a certain amount of time following the first enrollment of the biometric information. It may be beneficial to shorten this time interval when/if suspicious use of the mobile could be detected.
- the time interval could be lengthened when/if device autonomously recognizes, on a continuous basis, cues, e.g., consistent patterns of usage and context, to offset the passage of time and delay the need for re-authentication.
- Trust level function block 230 may implement a trust level function to analyze persistency over time to determine a trust level.
- trust level function block 230 may be configured to analyze the persistency over time of selected user behaviors or contexts and other authentication information. For example, trust level function block 230 may identify and/or analyze behavior consistencies or behavior patterns. Examples of behavior consistencies may include regular walks on weekend mornings, persistency of phone numbers called or texted to and from regularly, network behavior, use patterns of certain applications on the mobile device, operating environments, operating condition patterns, etc. Further, trust level function block 230 may identify and/or analyze other contextual patterns such as persistence of geographical locations, repeated patterns of presence at certain locations at regular times (e.g., at work, home, or a coffee shop), persistence of pattern of network access-settings (e.g., home, office, public networks), operating environment patterns, operating condition patterns, etc. Additionally, trust level function block 230 may receive sensor related characterization data, such as a sensor ID, sensor fault tolerance, sensor operation environment and conditions, etc.
- sensor related characterization data such as a sensor ID, sensor fault tolerance, sensor operation environment and conditions, etc.
- trust level function block 230 may receive as inputs persistency of context and behavior and sensor characterization data.
- Trust level function block 230 may be configured to output a second metric to the trust coefficient calculation function block 240 indicating a level of trust.
- the second metric may be expressed using characterizations such as high, medium, low, or none; a number or percentage; components of vector; or other formats. The value of this metric may change dynamically or continuously in time when persistence of context, behavioral patterns, sensor characterization data, or preference settings change.
- trust coefficient calculation function block 240 may implement a trust coefficient calculation function to determine the trust coefficient based upon the authentication strength of the received input data from the biometric and non-biometric sensors and the trust level received based on the input data from the biometric and non-biometric sensors.
- Trust coefficient calculation function block 240 may be configured to receive the first metric of authentication strength from authentication strength function block 220, a second metric of trust level from trust level function block 230, preference settings from preference setting function block 210, as well as time/date input, to determine the trust coefficient.
- Trust coefficient calculation function block 240 may be configured to continuously or quasi-continuously, or discreetly and on demand, output a trust coefficient to authenticating entity 250 in order to provide continuous, quasi- continuous or discrete authentication with authenticating entity 250.
- trust coefficient calculation function block 240 may perform processes such as data interpretation and mapping based on a preset look-up table to map the input data and data format into a unified format; data normalization into a predetermined data range; calculations based on a method/formula that may be in accordance with a default or that may be changed based on preference setting changes requested over time by one or more requestors; mapping the calculation results and preferred formats in accordance with preference settings; etc.
- the trust coefficient may include composite trust coefficients or trust scores having one or more components.
- the trust coefficients, scores or levels may be configured as part of a multi-field trust vector.
- trust coefficient calculation function block 240 may be configured to output trust coefficient components and include the credentials or other information used to authenticate the user or the device, or to provide other data used to complete a transaction (e.g., data verifying the user is not a computer or robot).
- trust coefficient calculation function block 240 may output a trust coefficient that is utilized by another system element, such as a trust broker, to release credentials or provide other data used to complete a transaction.
- the output format can be defined or changed.
- the trust coefficient components may change from one time to another due to preference setting changes.
- the trust coefficient components may change from one request to another due to differences between preference settings and different requestors.
- an application preference or an institutional preference may be used to provide parameters to formulas that may configure or control the generation of trust coefficient components to meet specific requirements, such as required for the use of particular authentication methods or for altering the time constants of trust coefficient decay.
- FIG. 3 illustrates the dynamic nature of the trust coefficient in the continuous authentication methodology.
- the y- axis illustrates a dynamic trust coefficient with various levels (e.g., level 4 - complete trust; level 3 - high trust; level 2 - medium trust; level 1 - low trust; level 0 - mistrust; and level -1 - high mistrust) and the x-axis represents time.
- the mobile device may begin an authentication process with a non- initialized status and a trust coefficient level of zero (identified at the border between level 1 low trust and level 0 low mistrust).
- the mobile device begins high-level authentication.
- high-level authentication has been achieved (e.g., with a fingerprint scan from a fingerprint sensor and a user ID and password).
- a completely trusted status has been acquired (e.g. level 4 complete trust).
- the trust level begins to decline as time progresses.
- re-authentication of the trust coefficient is needed as the trust level has decreased down to level 3 trust.
- another input may be needed such as an eye scan via a camera. Based upon this, at point d'), the completely trusted status has been re-acquired.
- the trust level again decays.
- re- authentication is needed to bring the trust coefficient back to level 4 complete trust.
- the completely trusted status has been reacquired based upon an additional sensor input. For example, a previous sensor input may be re-inputted (e.g., an additional fingerprint scan) or a new input may be acquired such as a voice scan through a microphone, which again brings the trust coefficient back to a complete level of trust. As previously described, the previous authentication has brought the dynamic trust coefficient back and forth to the level of complete trust.
- the trust level begins to decay significantly all the way to point h), to where the dynamic trust coefficient has completely fallen out of trusted status to a level zero trust level (low mistrust) and re-authentication needs to reoccur.
- a completely trusted status has been re-acquired.
- the user may have inputted a fingerprint scan via a fingerprint sensor as well as a user ID and password.
- the trust level may begin to decay back to point j), a low trust level.
- request for service provider access may only need a medium trust level (e.g. level two), so at point j '), a medium trust level is acquired, such as, by just a low-resolution touchscreen finger sensor input.
- a medium trust level is acquired, such as, by just a low-resolution touchscreen finger sensor input.
- the dynamic trust coefficient trust level declines all the way back to a level zero low mistrust (point 1) where the trust coefficient is maintained at a baseline level of mistrust.
- point 1 medium level authentication begins and at point 1" medium level trusted status is re-acquired (e.g. by a touch-screen finger scan).
- the trust level begins to decay as time proceeds down to the baseline low mistrust level at point n).
- An attempted spoofing attack may be detected at point o).
- the spoofing has failed and a completely mistrusted status has occurred (e.g. level -1 high mistrust), where it is retained for a time until point p).
- a completely mistrusted status e.g. level -1 high mistrust
- the decay is stopped at the baseline mistrusted status.
- medium level authentication begins again.
- the medium level authentication has failed and a low mistrusted status level has been acquired (e.g. level 0). For example, the finger scan via the touch-screen may have failed.
- the trust level is retained for a time, then begins to decay at point s) back to the baseline level of mistrust at point t).
- the trust level is retained at a low level of mistrust until point u).
- a low level of authentication may begin at point u).
- a low level authentication such as a GPS location may be acquired at point u') such that there is at least a low level of trust until a point w).
- the level of the dynamic trust coefficient begins to decline to point x), a low level trust, however, the decline may be stopped at point x') (at a baseline low-level trusted status).
- the process may begin again with requesting a high level of authentication, such as a fingerprint scan via a fingerprint sensor or a username and password, such that, at point y'), a completely trusted status is again acquired and the dynamic trust coefficient has been significantly increased.
- a high level of authentication such as a fingerprint scan via a fingerprint sensor or a username and password
- the trust level again begins to decay to a baseline low-level trusted status at point aa).
- the trust coefficient is dynamic and as the trust coefficient decreases with time, the user/mobile device may need to re- authenticate itself to keep the trust coefficient at a high enough level to perform operations with various authenticating entities.
- FIG. 4 illustrates a wide variety of different inputs 400 that may be inputted into the hardware 420 of the mobile device to continuously or quasi-continuously update the trust coefficient.
- a variety of hard biological biometrics 402 may be utilized as biometric sensor inputs with appropriate biometric sensors 422 of hardware 420.
- hard biological biometrics may include a fingerprint scan, palm print, facial scan, skin scan, voice scan, hand/finger shape imaging, etc.
- FIG. 4 illustrates that a wide variety of soft biometrics 408 may be utilized as biometric sensor inputs with appropriate biometric sensors 422 of hardware 420, such as skin color, hair style/color, beard/mustache, dress color, etc.
- various behavior biometrics 404 and psychological biometrics 406 may be determined from sensor inputs with appropriate sensors 422 of hardware 420. Examples of these sensor inputs may include voice inflections, heartbeat variations, rapid eye movements, various hand gestures, finger tapping, behavior changes, etc. Further, as previously described, time history 410 may also be utilized as an input. These types of biometrics may be determined, registered, recorded, etc., in association with appropriate sensors 422 of the hardware 420 of the mobile device for generating trust coefficients, as previously described. Such sensors include biometric sensors and non-biometric sensors, as previously described. Examples of these sensors 422 include all of the previously described sensors, such as a fingerprint sensor, camera sensor, microphone, touch sensor, accelerometer, etc.
- the hardware 420 may include one or more processing engines 424 and awareness engines 426 to implement analytical models 442 that may analyze the input from the variety of sensors in order to perform continuous or quasi-continuous authentication of the user.
- These analytical models 442 may take into account security and privacy settings (e.g., predefined security/privacy preference settings).
- types of analytical models 422 utilized may include identification models, multimodal models, continuous identification models, probabilistic-based authentication models, etc.
- These analytical models may be utilized for continuous authentication by the generation of trust coefficients for use with external sites, authenticating entities, applications or other users with which the user of the mobile device wishes to interact with.
- Examples of these types of application 450 interactions may include access control 452 (e.g., device access, application access, cloud access, etc.), e-commerce 454 (e.g., credit card transactions, payment methods, ATM, banking, etc.), personalized services 546 (e.g., user-friendly applications, personal health monitoring, medical applications, privacy guards, etc.), or other functions 458 (e.g., improvement of other applications based on customized biometric information, etc.).
- access control 452 e.g., device access, application access, cloud access, etc.
- e-commerce 454 e.g., credit card transactions, payment methods, ATM, banking, etc.
- personalized services 546 e.g., user-friendly applications, personal health monitoring, medical applications, privacy guards, etc.
- functions 458 e.g., improvement of other applications
- the mobile device may implement a system 500 that allows biometrics 502 of a variety of types (e.g. biological, behavioral, physical, hard, soft, etc.) to be combined with or derived from sensor data 504 including location, time history, etc., all of which may be collected and processed to perform strong authentication via a trust coefficient for continuous authentication. These types of measurements may be recorded and utilized for one or more machine learning processes 506. Based upon this collection of data, the continuous authentication process 508 may be utilized, as previously described.
- biometrics 502 of a variety of types (e.g. biological, behavioral, physical, hard, soft, etc.) to be combined with or derived from sensor data 504 including location, time history, etc., all of which may be collected and processed to perform strong authentication via a trust coefficient for continuous authentication.
- sensor data 504 including location, time history, etc.
- machine learning processes 506 Based upon this collection of data, the continuous authentication process 508 may be utilized, as previously described.
- various features may be provided, such as continuous authentication of the user, better utilization of existing sensors and context awareness capabilities of the mobile device, improved accuracy in the usability of biometrics, and improved security for interaction with service providers, applications, devices and other users.
- a mobile device utilizing the previously described functionality for continuous authentication with a trust coefficient will be hereinafter described, with reference to FIG. 6.
- a conventional system that provides authentication when a matching score passes a full access threshold typically uses only one biometric input (e.g. a fingerprint sensor) for a one-time authentication, and each access is independently processed every time.
- the one-time authentication e.g. fingerprint sensor
- the full access threshold not being passed
- no access occurs.
- biometrical information may be adaptively updated and changed.
- various access controls may be continuously collected and updated, and, as shown in graph 614, based upon this continuous updating for continuous authentication (e.g. first a fingerprint scan, next a facial scan from a camera, next a GPS update, etc.), access control can reach 100% and access will be authenticated. Further, historic information can be collected to improve recognition accuracy.
- detection of intruders may be improved by utilizing a continuous authentication system.
- a continuous authentication system Utilizing conventional biometrics, once the full access threshold is met (graph 702), access control is granted (graph 704) and use by a subsequent intruder may not be identified.
- inputs may be continuously collected (e.g. GPS location, touch screen finger scan, etc.), and even through access control is met (graph 714) and access is granted, an intruder may still be detected. For example, an intruder designation may be detected (e.g., an unknown GPS location), access control will drop and access will be denied, until a stronger authentication input is requested and received by the mobile device, such as a fingerprint scan.
- upper-tier traditional authentication technologies may include username, password, PIN, etc.
- Medium-tier traditional authentication technologies shown in block 812 may include keys, badge readers, signature pads, RFID tags, logins, predetermined call-in numbers, etc.
- low-tier traditional authentication technologies may include location determinations (e.g., at a work location), questions and answers (e.g., Turing test), general call-in numbers, etc. It should be appreciated that the previously described mobile device utilizing continuous authentication to continuously update a trust coefficient may utilize these traditional technologies, as well as the additional authentication technologies to be hereinafter described.
- embodiments of the invention related to continuous authentication may include a wide variety of additional biometric authentication technologies.
- upper-tier biometric authentication technologies may include fingerprint scanners, multi- fingerprint scanners, automatic fingerprint identification systems (AFIS) that use live scans, iris scans, continuous fingerprint imaging, various combinations, etc.
- medium-tier biometric authentication technologies may include facial recognition, voice recognition, palm scans, vascular scans, personal witness, time history, etc.
- lower-tier biometric authentication technologies may include hand/finger geometry, cheek/ear scans, skin color or features, hair color or style, eye movements, heart rate analysis, gait determination, gesture detection, behavioral attributes, psychological conditions, contextual behavior, etc. It should be appreciated that these are just examples of biometrics that may be utilized for continuous authentication.
- a trust coefficient may convey the current level of authentication of a user of a mobile device 100.
- mobile device 100 and/or authenticating entity 250 may determine the trust coefficient.
- a continuous authentication engine CAE
- CAM continuous authentication manager
- a trust broker TB
- the term trust coefficient (TC) may be included as a component of a trust vector (TV).
- the TV may include a composition of one or more data inputs, sensor information, or scores.
- each of the TV inputs may be given authentication strengths and/or scores.
- the mobile device 100 may include a local trust broker (TB) 902 and the authenticating entity 250 may include a remote trust broker (TB) 922.
- local TB 902 may transmit a privacy vector (PV) to the authenticating entity 250 that includes predefined user security preferences such as types of user approved biometric sensor information, non-biometric sensor data, and/or user data input that the user approves of.
- remote TB 922 of the authenticating entity 250 may transmit a privacy vector (PV) to the mobile device 100 that includes predefined security preferences such as types of biometric sensor information, non- biometric sensor data, and/or user data input that the authenticating entity approves of.
- local TB 902 of the mobile device may negotiate with the remote TB 922 of the authenticating entity 250 to determine a trust vector TV that incorporates or satisfies the predefined user security preferences, as well as the predefined security preferences of the authenticating entity 250, such that a suitable TV that incorporates or satisfies the authentication requirements of the authenticating entity 250 and the mobile device 100 may be transmitted to the authenticating entity 250 to authenticate mobile device 100.
- mobile device 100 may include a continuous authentication engine 906 that is coupled to a continuous authentication manager 904, both of which are coupled to the local TB 902.
- the local TB 902 may communicate with the remote TB 922 of the authenticating entity 250.
- the continuous authentication manager 904 may consolidate on-device authentication functions such as interaction with the continuous authentication engine 906, and may interact with application program interfaces (APIs) on the mobile device 100 for authentication-related functions.
- the local TB 902 may be configured to maintain user security/privacy preferences that are used to filter the data offered by the local TB 902 in external authentication interactions with the remote TB 922 of the authenticating entity 250.
- local TB 902 may interact with the remote TB 922, manage user credentials (e.g. user names, PINs, digital certificates, etc.), determine what types of credentials or information (e.g., user data input, sensor data, biometric sensor information, etc.) are to be released to the remote TB 922 of the authenticating entity (e.g., based on privacy vector information and negotiations with the remote TB 922), assemble and send trust and privacy vectors (TVs and PVs), manage user security/privacy settings and preferences, and/or interface with the continuous authentication manager 904.
- user credentials e.g. user names, PINs, digital certificates, etc.
- determine what types of credentials or information e.g., user data input, sensor data, biometric sensor information, etc.
- TVs and PVs trust and privacy vectors
- manage user security/privacy settings and preferences e.g., user security/privacy settings and preferences, and/or interface with the continuous authentication manager 904.
- the continuous authentication manager 904 may perform functions including interacting with the local TB 902, controlling how and when trust scores for the trust vectors (TVs) are calculated, requesting specific information from the continuous authentication engine 906 when needed (e.g., as requested by the local trust broker 902), providing output to APIs of the mobile device 101 (e.g., device-level trust controls, keyboard locks, unauthorized use, etc.), and/or managing continuous authentication engine 906 (e.g., issuing instructions to or requesting actions from the continuous authentication engine to update trust scores and/or check sensor integrity when trust scores fall below a threshold value, etc.).
- TVs trust vectors
- the local trust broker 902 may determine, in cooperation with the continuous authentication manager 904 and the continuous authentication engine 906, one or more sensor data, biometric sensor information, data input, sensor data scores, biometric sensor information scores, data input scores, trust coefficients, trust scores, credentials, authentication coefficients, authentication scores, authentication levels, authentication system outputs, or authentication information for inclusion in the trust vector.
- the continuous authentication engine 906 may perform one or more functions including responding to the continuous authentication manager 904; generating trust vector (TV) components; calculating TV scores, values or levels; providing raw data, template data or model data when requested; generating or conveying conventional authenticators (e.g., face, iris, fingerprint, ear, voice, multimodal biometrics, etc.), times/dates, hard biometric authenticators, soft biometric authenticators, hard geophysical authenticators, or soft geophysical authenticators; and accounting for trust- level decay parameters.
- TV trust vector
- Hard biometric authenticators may include largely unique identifiers of an individual such as fingerprints, facial features, iris scans, retinal scans or voiceprints, whereas soft biometric authenticators may include less unique factors such as persisting behavioral and contextual aspects, regular behavior patterns, face position with respect to a camera on a mobile device, gait analysis, or liveness.
- the continuous authentication engine 906 may calculate TV scores based upon TV components that are based upon data inputs from one or more non-biometric sensors, biometric sensors, user data input from a user interface, or other authentication information as previously described.
- sensors that may provide this type of sensor data such as one or more cameras (front side and/or backside), microphones, proximity sensors, light sensors, IR sensors, gyroscopes, accelerometers, magnetometers, GPS, temperature sensors, humidity sensors, barometric pressure sensors, capacitive touch screens, buttons (power/home/menu), heart rate monitors, ECG sensors, fingerprint sensors, biometric sensors, biometric keyboards, etc.
- cameras front side and/or backside
- microphones proximity sensors
- light sensors IR sensors
- gyroscopes gyroscopes
- accelerometers magnetometers
- GPS GPS
- temperature sensors temperature sensors
- humidity sensors temperature sensors
- barometric pressure sensors capacitive touch screens
- buttons power/home/menu
- heart rate monitors ECG sensors
- fingerprint sensors fingerprint sensors
- biometric sensors biometric keyboards
- local TB 902 may periodically, continuously or quasi-continuously update one or more components of the TV in the authentication response to the remote TB 922 of the authenticating entity to allow for continuous authentication of the mobile device 100 with the authenticating entity.
- each device e.g., Device A - mobile and Device B - authenticating entity such as another mobile device, e.g., peer-to-peer
- each device may include a trust broker that interacts with a continuous authentication manager (CAM) and a continuous authentication engine (CAE) on each device.
- CAM continuous authentication manager
- CAE continuous authentication engine
- a trust-broker interaction 1020 conveys an interaction between a user device and a remote (cloud-based) service or application.
- Both sides include a trust broker; the continuous authentication manager function and the continuous authentication engine function are enabled on the user device side, but are optional on the service/application device side.
- the continuous authentication engine and continuous authentication manager may be used on the application/service device side to configure the remote trust broker or to provide the ability for the user device to authenticate the application/service device.
- a cloud-based trust-broker interaction 1030 may be utilized.
- the trust broker associated with a mobile device may be located partially or completely away from the mobile device, such as on a remote server.
- the trust- broker interaction with the continuous authentication manager and/or continuous authentication engine of the user device may be maintained over a secure interface.
- the continuous authentication manager function and the continuous authentication engine function may be optional on the application/service device side.
- local trust broker (TB) 902 of mobile device 100 may be configured to exchange one or more privacy vectors (PVs) and trust vectors (TVs) with authenticating entity 250 for authentication purposes.
- the PVs and TVs may be multi-field messages used to communicate credentials, authentication methods, user security/privacy preferences, information or data.
- the TV may comprise a multifield data message including sensor data scores, biometric sensor information scores, user data input, or authentication information to match or satisfy the authentication request from the authenticating entity 250.
- the PVs may be used to communicate the availability of authentication information and/or to request the availability of authentication information.
- the TVs may be used to request or deliver specific authentication data, information and credentials.
- the TV may include one or more trust scores, trust coefficients, aggregated trust coefficients, authentication system output, or authentication information.
- authenticating entity 250 may initiate a first PV request 1100 to mobile device 100.
- the PV request 1100 may include a request for authentication and additional data (e.g., authentication credentials, authentication methods, authentication data requests, etc.). This may include specific types of sensor data, biometric sensor information, user input data requests, user interface data, or authentication information requests.
- the PV request 1100 may occur after an authentication request has been received by the mobile device 100 from the authenticating entity 250. Alternatively, an authentication request may be included with the PV request 1100.
- mobile device 100 may submit a PV response 1105 to the authenticating entity 250. This may include the offer or availability of user authentication resources and additional data (e.g.
- the authenticating entity 250 may submit a TV request 1110 to the mobile device 100.
- the TV request 1110 may request authentication credentials, data requests (e.g. sensor data, biometric sensor information, user data input, etc.), and supply authentication parameters (e.g. methods, persistence, etc.).
- mobile device 100 may submit a TV response 1115.
- the TV response 1115 may include authentication credentials, requested data (e.g.
- the trust broker of the mobile device 100 may negotiate with the trust broker of the authenticating entity 250 to determine a TV response 1115 that incorporates or satisfies both the predefined user security/privacy preferences and the authentication requirements of the authenticating entity via this back and forth of PVs and TVs.
- Authentication parameters may include, for example, parameters provided by the authenticating entity that describe or otherwise determine which sensor inputs to acquire information from and how to combine the available sensor information.
- the authenticating parameters may include a scoring method and a scoring range required by the authenticating entity, how to calculate a particular trust score, how often to locally update the trust score, and/or how often to provide the updated trust score to the authenticating entity.
- a persistence parameter may include, for example, a number indicating the number of seconds or minutes in which a user is authenticated until an updated authentication operation is required.
- the persistence parameter may be, for example, a time constant in which the trust coefficient or trust score decays over time.
- the persistence parameter may be dynamic, in that the numerical value may change with time, with changes in location or behavior of the user, or with the type of content requested.
- the local trust broker 902 of the mobile device 100 may determine if the PV request 1100 matches, incorporates, or satisfies predefined user security/privacy preferences and if so, the trust broker may retrieve, extract or otherwise receive the sensor data from the sensor, the biometric sensor information from the biometric sensor, the user data input, and/or authentication information that matches or satisfies the PV request 1100. The mobile device 100 may then transmit the TV 1115 to the authenticating entity 250 for authentication with the authenticating entity.
- the local trust broker may transmit a PV response 1105 to the authenticating entity 250 including predefined user security/privacy preferences having types of user-approved sensor data, biometric sensor information, user data input and/or authentication information.
- the authenticating entity 250 may then submit a new negotiated TV request 1110 that matches or satisfies the request of the mobile device 100.
- the trust broker of the mobile device 100 may negotiate with the trust broker of the authenticating entity 250 to determine a TV that matches or satisfies the predefined user security/privacy preferences and that matches or satisfies the authentication requirements of the authenticating entity 250.
- the PV and TV requests and responses may be used to exchange authentication requirements as well as other data.
- the PV is descriptive, for example, it may include examples of the form: "this is the type of information I want", or "this is the type of information I am willing to provide”.
- the PV may be used to negotiate authentication methods before actual authentication credentials are requested and exchanged.
- the TV may be used to actually transfer data and may include statements of the form: “send me this information, using these methods” or "this is the information requested”.
- the TV and PV can be multiparameter messages in the same format. For example, a value in a field in a PV may be used to indicate a request for or availability of a specific piece of authentication information. The same corresponding field in a TV may be used to transfer that data.
- a value of a field of the PV may be used to indicate availability of a particular sensor on a mobile device such as a fingerprint sensor, and a corresponding field in the TV may be used to transfer information about that sensor such as raw sensor data, sensor information, a trust score, a successful authentication result, or authentication information.
- the TV may be used to transfer data in several categories as requested by the PV, for example 1) credentials that may be used to authenticate, e.g., user name, password, fingerprint matching score, or certificate; 2) ancillary authentication data such as specific authentication methods or an updated trust coefficient; 3) optional data such as location, contextual information, or other sensor data and sensor information that may be used in authentication, such as a liveness score or an anti-spoof score; and/or 4) parameters used to control the continuous authentication engine, such as sensor preferences, persistence, time constants, time periods, etc.
- credentials e.g., user name, password, fingerprint matching score, or certificate
- ancillary authentication data such as specific authentication methods or an updated trust coefficient
- optional data such as location, contextual information, or other sensor data and sensor information that may be used in authentication, such as a liveness score or an anti-spoof score
- parameters used to control the continuous authentication engine such as sensor preferences, persistence, time constants, time periods, etc.
- requests and responses may be at different levels and not always include individual identification (e.g., "is this a real human?", “is this device stolen?", “is this user X?”, or "who is this user?”).
- various entities that may request authentication may each have their own respective, flexible authentication schemes, but the trust broker in negotiation using PVs and TVs allows the use of user security and privacy settings to negotiate data offered before the data is transmitted.
- TV components 1202 and PV components 1204 will be described. In particular, a better understanding of the aforementioned features of the PVs and the TVs, according to some examples, may be seen with reference to FIG. 12. For example, various TV components 1202 may be utilized.
- TV components 1202 TCI; TC2; TC3 . . . TCn are shown.
- these components may form part or all of a multi-field data message.
- the components may be related to session information, user name, password, time/date stamp, hard biometrics, soft biometrics, hard geophysical location, soft geophysical location, authentication information, etc. These may include user data input, sensor data or information and/or scores from sensor data, as previously described in detail.
- indications as to whether the component is absolutely required, suggested, or not at all required. For example, this may be a value from zero to one.
- sensor fields may be included to indicate whether the specific sensors are present or not present (e.g. one or zero) as well as sensor data, sensor information, scoring levels, or scoring values.
- scoring values may be pass or not pass (e.g. one or zero) or they may relate to an actual score value (e.g. 0 - 100 or 0 - 255). Therefore, in some embodiments, the TV may contain specific authentication requests, sensor information or data, or other authentication information.
- the PV components 1204 may describe the request for the availability of authentication devices or authentication information, and indicate permission (or denial) of the request to provide data or information associated with each device.
- various fields may include required fields (e.g., 0 or 1), pass/fail (e.g., 0 or 1), values, level requirements, etc.
- the fields may include available fields (e.g., 0 or 1), preferences, user-approved preferences or settings that can be provided (e.g., 0 or 1), enumeration of levels that can be provided, etc.
- the TV may include a wide variety of different types of indicia of user identification/authentication. Examples of these may include session ID, user name, password, date stamp, time stamp, trust coefficients or trust scores based upon sensor device input from the previously described sensors, fingerprint template information, template information from multiple fingerprints, fingerprint matching score(s), face recognition, voice recognition, face location, behavior aspects, liveness, GPS location, visual location, relative voice location, audio location, relative visual location, altitude, at home or office, on travel or away, etc. Accordingly, these types of TV types may include session information, conventional authorization techniques, time/date, scoring of sensor inputs, hard biometrics, soft biometrics, hard geophysical information, soft geophysical information, etc.
- visual location may include input from a still or video camera associated with the mobile device, which may be used to determine the precise location or general location of the user, such as in a home office or out walking in a park.
- Hard geophysical information may include GPS information or video information that clearly identifies the physical location of the user.
- Soft geophysical information may include the relative position of a user with respect to a camera or microphone, general location information such as at an airport or a mall, altitude information, or other geophysical information that may fail to uniquely identify where a user is located.
- TV components may be utilized with a wide variety of different types of sensor inputs and the TV components may include the scoring of those TV components. Additional examples may include one or more TV components associated with sensor output information for iris, retina, palm, skin features, cheek, ear, vascular structure, hairstyle, hair color, eye movement, gait, behavior, psychological responses, contextual behavior, clothing, answers to questions, signatures, PINs, keys, badge information, RFID tag information, NFC tag information, phone numbers, personal witness, and time history attributes, for example.
- the trust vector components may be available from sensors that are installed on the mobile device, which may be typical or atypical dependent on the mobile device. Some or all of the sensors may have functionality and interfaces unrelated to the trust broker.
- an example list of sensors contemplated may include one or more of the previously described cameras, microphones, proximity sensors, IR sensors, gyroscopes, accelerometers, magnetometers, GPS or other geolocation sensors, barometric pressure sensors, capacitive touch screens, buttons (power/home/menu), heart rate monitor, fingerprint sensor or other biometric sensors (stand alone or integrated with a mouse, keypad, touch screen or buttons). It should be appreciated that any type of sensor may be utilized with aspects of the invention.
- the local trust broker 902 of the mobile device 100 utilizing the various types of TVs and PVs may provide a wide variety of different functions.
- the local trust broker may provide various responses to authentication requests from the authenticating entity 250. These various responses may be at various levels and may not always include individual identifications. For example, some identifications may be for liveness or general user profile.
- the local trust broker may be utilized to manage user credentials and manage authentication privacy.
- functions controlled by the trust broker may include storing keys and credentials for specific authentication schemes, providing APIs to change user security/privacy settings in response to user security and privacy preferences, providing an appropriate response based on user security/privacy settings, interacting with a CAM/CAE, interacting with an authentication system, or not revealing personal identities or information to unknown requests.
- Local trust broker functionality may also provide responses in the desired format. For example, the TV may provide a user name/password or digital certificate in the desired format.
- the local trust broker functionality may also include managing the way a current trust coefficient value affects the device. For example, if the trust coefficient value becomes too low, the local trust value may lock or limit accessibility to the mobile device until proper authentication by a user is received.
- Trust broker functionality may include requesting the continuous authentication manager to take specific actions to elevate the trust score, such as asking the user to re-input fingerprint information.
- the trust broker functionality may include integrating with systems that manage personal data. For example, these functions may include controlling the release of personal information or authentication information that may be learned over time by a user profiling engine, or using that data to assist authentication requests. It should be appreciated that the previously described local trust broker 902 of the mobile device 100 may be configured to flexibly manage different types of authentication and private information exchanges. Requests and responses may communicate a variety of authentication-related data that can be generic, user specific, or authentication-method specific.
- TV component calculation block 240 may perform TV component calculations. It should be noted that one or more trust coefficients, levels or scores may be included as a component in the trust vector, so that the term TV is used in place of trust coefficient hereinafter.
- inputs from the authentication strength block 220, inputs from preference settings block 210, inputs from trust level block 230, and times/dates may be inputted into the TV component calculation block 240.
- one or more TV component values 273 and TV composite scores 275 may be outputted to an authenticating entity for continuous authentication.
- TV component values 273 and TV component scores 275 may be calculated and transmitted as needed to the authenticating entity. It should be appreciated that the output format of the TV component values 273 and TV component scores 275 may be defined and/or changed from one time to another due to preference setting changes and/or may change from one request to another request due to differences between preference settings of different requestors and/or may change or otherwise be updated based on one or more continuous authentication parameters such as time constant, time delay, sensor data, sensor information, or scoring method.
- the preference settings block 210 may implement a negotiation function or an arbitration function to negotiate or arbitrate conflicting predefined security/privacy preference settings between the authenticating entity and the mobile device, or to form fused preference settings.
- TV component values 273 and TV composite scores 275 may be calculated continuously and transmitted as needed to an authenticating entity for continuous, or quasi-continuous, or discrete authentication with the authenticating entity.
- inputs from the elements of the continuous authentication system 200 including preference settings, authentication strengths, trust levels, and time may be mapped into a required or unified format, such as by the use of a look-up table or other algorithm to output a trust vector (TV) or trust vector components in a desired format.
- Resulting data may be normalized into a predetermined data range before being presented as inputs to the calculation method, formula or algorithm used by the TV component calculation block 240 to calculate components of the trust vector output including TV component values 273 and TV composite scores 275.
- authentication strengths, trust levels, time and preference settings may be inputted into data mapping blocks 1310 that are further normalized through data normalization blocks 1320, which are then transmitted to the calculation method/formula block 1330 (e.g., for calculating TV values including TV component values 273 and TV composite scores 275) and through calculation result mapping block 1340 for mapping, and the resulting TV including TV component values 273 and TV composite scores 275 are thereby normalized and mapped and outputted.
- the calculation method/formula block 1330 e.g., for calculating TV values including TV component values 273 and TV composite scores 275
- calculation result mapping block 1340 for mapping
- data mapping 1310 data mapping may be based on a preset look-up table to map the inputs of data formats into a unified format.
- data normalization 1320 different kinds of input data may be normalized into a predetermined data range.
- the calculation method 1330 of the TV component calculation block 240 a default calculation formula may be provided, the calculation formula may be changed based on the preference setting changes over time, the calculation formula may be changed based upon preference settings from the mobile device and/or different requestors, etc.
- calculation result mapping 1340 the calculated results for the TV including TV component values 273 and TV composite scores 275 may mapped to predetermined preference setting data formats.
- authentication strengths may be mapped into a format that represents level strengths of high, medium, low, or zero (no authentication capability) [e.g., Ah, Am, Al and An].
- Trust levels may be mapped into a format representing high, medium, low or zero (non- trusted level) [e.g., Sh, Sm, SI and Sn].
- There may a time level of t.
- Preference setting formats may also be used to provide inputs relating to a trust decay period (e.g., a value between -1 and 1).
- These values may be mapped to values over a defined range and utilized with time data including data representing time periods between authentication inputs. Example of these ranged values may be seen with particular reference to FIG. 13C. Further, with additional reference to FIG. 13D, after going through data mapping 1310, these data values may also be normalized by data normalization blocks 1320. As shown in FIG. 13D, various equations are shown that may be used for the normalization of authentication strengths, trust levels and time. It should be appreciated that these equations are merely for illustrative purposes.
- the previously described data, after mapping and normalizing, may be used to form or otherwise update a trust vector (TV) (including TV component values 273 and TV composite scores 275).
- the TV may vary according to the inputs (e.g., authentication strengths, trust levels, time and/or preference settings) and may vary over time between authentication events.
- FIG. 13E shows an example of a calculation formula to be used by calculation formula block 1330 for generating an example trust vector or trust coefficient in response to the various authentication system inputs.
- these authentication inputs may include normalized time, normalized trust levels, normalized authentication strengths, etc. It should be appreciated that these equations are merely for illustrative purposes.
- FIG. 13F includes a graphical representation of an example trust vector (TV) that has been calculated by calculation formula block 1330 and mapped/normalized by calculation mapping block 1340 such that the TV has a value varying between 1 (high trust) and -1 (high mistrust) [y- axis] over time [x-axis] and illustrates how the trust vector may change in discrete amounts in response to specific authentication inputs (e.g., such as recovering to a high trust level after the input and identification of an authentication fingerprint). Between authentication events, the TV may vary, such as decaying according to time constant parameters that are provided.
- TV trust vector
- Inputs may trigger discrete steps in values lowering the trust value (e.g., such as the user connecting from an un-trusted location) or may trigger a rapid switch to a level representing mistrust, such as an event that indicates the device may be stolen (e.g., several attempts to enter a fingerprint that cannot be verified and the mobile device being at an un-trusted location).
- lowering the trust value e.g., such as the user connecting from an un-trusted location
- a rapid switch to a level representing mistrust such as an event that indicates the device may be stolen (e.g., several attempts to enter a fingerprint that cannot be verified and the mobile device being at an un-trusted location).
- the trust level may go to - 1, in which case further authentication is required or no additional action for authentication may be taken.
- TVs trust vectors
- the trust broker previously described may be used in conjunction with techniques disclosed in applicant's provisional application entitled “Trust Broker for Authentication Interaction with Mobile Devices", application number 61/943,428 filed February 23, 2014, the disclosure of which is hereby incorporated by reference into the present application in its entirety for all purposes.
- processors of the mobile device and the authenticating entity may implement the functional blocks previously described and other embodiments, as previously described.
- circuitry of the devices including but not limited to processors, may operate under the control of a program, routine, or the execution of instructions to execute methods or processes in accordance with embodiments of the invention.
- a program may be implemented in firmware or software (e.g. stored in memory and/or other locations) and may be implemented by processors and/or other circuitry of the devices.
- processor, microprocessor, circuitry, controller, etc. refer to any type of logic or circuitry capable of executing logic, commands, instructions, software, firmware, functionality, etc.
- the devices when they are mobile or wireless devices, they may communicate via one or more wireless communication links through a wireless network that are based on or otherwise support any suitable wireless communication technology.
- the wireless device and other devices may associate with a network including a wireless network.
- the network may comprise a body area network or a personal area network (e.g., an ultra-wideband network).
- the network may comprise a local area network or a wide area network.
- a wireless device may support or otherwise use one or more of a variety of wireless communication technologies, protocols, or standards such as, for example, 3G, LTE, Advanced LTE, 4G, CDMA, TDMA, OFDM, OFDMA, WiMAX, and WiFi.
- a wireless device may support or otherwise use one or more of a variety of corresponding modulation or multiplexing schemes.
- a wireless device may thus include appropriate components (e.g., air interfaces) to establish and communicate via one or more wireless communication links using the above or other wireless communication technologies.
- a device may comprise a wireless transceiver with associated transmitter and receiver components (e.g., a transmitter and a receiver) that may include various components (e.g., signal generators and signal processors) that facilitate communication over a wireless medium.
- a mobile wireless device may therefore wirelessly communicate with other mobile devices, cell phones, other wired and wireless computers, Internet web-sites, etc.
- the teachings herein may be incorporated into (e.g., implemented within or performed by) a variety of apparatuses (e.g., devices).
- a phone e.g., a cellular phone
- PDA personal data assistant
- a tablet computer e.g., a mobile computer, a laptop computer
- an entertainment device e.g., a music or video device
- a headset e.g., headphones, an earpiece, etc.
- a medical device e.g., a biometric sensor, a heart rate monitor, a pedometer, an ECG device, etc.
- a user I/O device e.g., a computer, a wired computer, a fixed computer, a desktop computer, a server, a point-of-sale device, a set-top box, or any other suitable device.
- These devices may have different power and data requirements.
- DSP digital signal processor
- ASIC application specific integrated circuit
- FPGA field programmable gate array
- a general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine.
- a processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
- a software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
- An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium.
- the storage medium may be integral to the processor.
- the processor and the storage medium may reside in an ASIC.
- the ASIC may reside in a user terminal or mobile device.
- the processor and the storage medium may reside as discrete components in a user terminal or mobile device.
- the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
- Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
- a storage media may be any available media that can be accessed by a computer.
- such computer- readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.
- any connection is properly termed a computer-readable medium.
- the software is transmitted from a web site, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave
- DSL digital subscriber line
- wireless technologies such as infrared, radio, and microwave
- Disk and disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above are also included within the scope of computer-readable media.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- General Health & Medical Sciences (AREA)
- Health & Medical Sciences (AREA)
- Social Psychology (AREA)
- Biomedical Technology (AREA)
- Computing Systems (AREA)
- Telephone Function (AREA)
- Collating Specific Patterns (AREA)
Abstract
Description
Claims
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201580008776.0A CN106030599A (en) | 2014-02-23 | 2015-02-20 | Continuous authentication with a mobile device |
JP2016552902A JP2017515178A (en) | 2014-02-23 | 2015-02-20 | Continuous authentication with mobile devices |
EP15712447.0A EP3108636A1 (en) | 2014-02-23 | 2015-02-20 | Continuous authentication with a mobile device |
KR1020167025678A KR20160124834A (en) | 2014-02-23 | 2015-02-20 | Continuous authentication with a mobile device |
Applications Claiming Priority (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201461943435P | 2014-02-23 | 2014-02-23 | |
US201461943428P | 2014-02-23 | 2014-02-23 | |
US61/943,428 | 2014-02-23 | ||
US61/943,435 | 2014-02-23 | ||
US14/523,689 | 2014-10-24 | ||
US14/523,689 US20150242605A1 (en) | 2014-02-23 | 2014-10-24 | Continuous authentication with a mobile device |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2015127256A1 true WO2015127256A1 (en) | 2015-08-27 |
Family
ID=52811184
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2015/016887 WO2015127256A1 (en) | 2014-02-23 | 2015-02-20 | Continuous authentication with a mobile device |
Country Status (6)
Country | Link |
---|---|
US (1) | US20150242605A1 (en) |
EP (1) | EP3108636A1 (en) |
JP (1) | JP2017515178A (en) |
KR (1) | KR20160124834A (en) |
CN (1) | CN106030599A (en) |
WO (1) | WO2015127256A1 (en) |
Cited By (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2017144768A1 (en) * | 2016-02-26 | 2017-08-31 | Nokia Technologies Oy | Behavioural biometric authentication |
WO2017195218A1 (en) * | 2016-05-12 | 2017-11-16 | Credext Technologies Pvt. Ltd. | Biometric face recognition based continuous authentication and authorization system |
WO2018172016A1 (en) * | 2017-03-20 | 2018-09-27 | Bundesdruckerei Gmbh | Method and system for the behaviour-based authentication of a user |
WO2018198110A1 (en) | 2017-04-25 | 2018-11-01 | Ix-Den Ltd. | System and method for iot device authentication and secure transaction authorization |
EP3471002A1 (en) * | 2017-10-16 | 2019-04-17 | Bundesdruckerei GmbH | Behaviour-based authentication taking into account environmental parameters |
EP3477981A1 (en) * | 2017-10-26 | 2019-05-01 | Bundesdruckerei GmbH | Behaviour-based authentication taking into account environmental parameters |
WO2019212263A1 (en) | 2018-05-02 | 2019-11-07 | Samsung Electronics Co., Ltd. | System and method for resource access authentication |
WO2019243474A1 (en) * | 2018-06-21 | 2019-12-26 | Bundesdruckerei Gmbh | Automatic adaptive calibration of authentication requirements |
EP3842967A1 (en) * | 2019-12-26 | 2021-06-30 | Koa Health B.V. | Method, system and computer programs for validating a user |
EP3926498A1 (en) * | 2020-06-17 | 2021-12-22 | Irdeto Canada Corporation | System and method for continuous user authentication |
US11514142B2 (en) | 2018-04-26 | 2022-11-29 | ID R&D, Inc. | System and method for multi-modal continuous biometric authentication for messengers and virtual assistants |
IT202100019634A1 (en) * | 2021-07-23 | 2023-01-23 | Cleafy Spa | Method for confirming the identity of a user in a browsing session of an online service |
Families Citing this family (174)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8513832B2 (en) | 2007-03-30 | 2013-08-20 | Ips Group Inc. | Power supply unit |
WO2010071972A1 (en) | 2008-12-23 | 2010-07-01 | J.J.Mackay Canada Limited | Low power wireless parking meter and parking meter network |
US8749403B2 (en) * | 2009-09-04 | 2014-06-10 | Ips Group Inc. | Parking meter communications for remote payment with updated display |
CA3178279A1 (en) | 2011-03-03 | 2012-09-03 | J.J. Mackay Canada Limited | Parking meter with contactless payment |
US9127964B2 (en) | 2011-07-25 | 2015-09-08 | Ips Group Inc. | Low power vehicle detection |
US9887983B2 (en) | 2013-10-29 | 2018-02-06 | Nok Nok Labs, Inc. | Apparatus and method for implementing composite authenticators |
US9305298B2 (en) | 2013-03-22 | 2016-04-05 | Nok Nok Labs, Inc. | System and method for location-based authentication |
US10270748B2 (en) | 2013-03-22 | 2019-04-23 | Nok Nok Labs, Inc. | Advanced authentication techniques and applications |
WO2015126744A1 (en) * | 2014-02-18 | 2015-08-27 | Secureauth Corporation | Fingerprint based authentication for single sign on |
US10032008B2 (en) | 2014-02-23 | 2018-07-24 | Qualcomm Incorporated | Trust broker authentication method for mobile devices |
US11288346B1 (en) * | 2014-03-03 | 2022-03-29 | Charles Schwab & Co., Inc. | System and method for authenticating users using weak authentication techniques, with differences for different features |
US9430627B2 (en) * | 2014-03-05 | 2016-08-30 | Werner Blessing | Method and system for enforced biometric authentication |
EP3120493B1 (en) * | 2014-03-16 | 2018-11-07 | Haventec PTY LTD | Persistent authentication system incorporating one time pass codes |
CA2945158A1 (en) * | 2014-04-08 | 2015-10-15 | Capital One Financial Corporation | Systems and methods for transacting at an atm using a mobile device |
US9444825B2 (en) * | 2014-08-11 | 2016-09-13 | Empire Technology Development Llc | Continuous user authentication |
US10762186B1 (en) | 2014-08-24 | 2020-09-01 | AI Incorporated | Method for robotic devices to authenticate users |
US10185815B1 (en) * | 2014-08-24 | 2019-01-22 | AI Incorporated | Method for robotic devices to authenticate users |
US10915618B2 (en) * | 2014-08-28 | 2021-02-09 | Facetec, Inc. | Method to add remotely collected biometric images / templates to a database record of personal information |
US11256792B2 (en) | 2014-08-28 | 2022-02-22 | Facetec, Inc. | Method and apparatus for creation and use of digital identification |
US9754093B2 (en) * | 2014-08-28 | 2017-09-05 | Ncr Corporation | Methods and a system for automated authentication confidence |
US10277588B2 (en) * | 2014-11-03 | 2019-04-30 | Facebook, Inc. | Systems and methods for authenticating a user based on self-portrait media content |
JP6572537B2 (en) * | 2014-12-15 | 2019-09-11 | 富士通コネクテッドテクノロジーズ株式会社 | Authentication apparatus, method, and program |
KR20160084663A (en) * | 2015-01-06 | 2016-07-14 | 삼성전자주식회사 | Device and method for transmitting message |
US11122034B2 (en) * | 2015-02-24 | 2021-09-14 | Nelson A. Cicchitto | Method and apparatus for an identity assurance score with ties to an ID-less and password-less authentication system |
US9882914B1 (en) * | 2015-02-25 | 2018-01-30 | Workday, Inc. | Security group authentication |
US20160269418A1 (en) * | 2015-03-11 | 2016-09-15 | Nagula Tharma Sangary | Method, system, and apparatus for managing and storing data based on information sensitivity |
US9961076B2 (en) * | 2015-05-11 | 2018-05-01 | Genesys Telecommunications Laboratoreis, Inc. | System and method for identity authentication |
US11038896B2 (en) * | 2015-06-02 | 2021-06-15 | Dipankar Dasgupta | Adaptive multi-factor authentication system with multi-user permission strategy to access sensitive information |
US11503035B2 (en) * | 2017-04-10 | 2022-11-15 | The University Of Memphis Research Foundation | Multi-user permission strategy to access sensitive information |
CN106295270B (en) * | 2015-06-25 | 2019-03-29 | 联想(北京)有限公司 | A kind of user identification method and electronic equipment |
CN106445101A (en) | 2015-08-07 | 2017-02-22 | 飞比特公司 | Method and system for identifying user |
CA3176773A1 (en) | 2015-08-11 | 2017-02-11 | J.J. Mackay Canada Limited | Single space parking meter retrofit |
WO2017040867A1 (en) * | 2015-09-01 | 2017-03-09 | Quantum Interface, Llc. | Apparatuses, systems and methods for constructing unique identifiers |
US10135801B2 (en) * | 2015-09-09 | 2018-11-20 | Oath Inc. | On-line account recovery |
RU2622626C2 (en) * | 2015-09-30 | 2017-06-16 | Акционерное общество "Лаборатория Касперского" | System and method for detecting phishing scripts |
US10331873B1 (en) * | 2015-10-09 | 2019-06-25 | United Services Automobile Association (“USAA”) | Graphical event-based password system |
US20170149828A1 (en) * | 2015-11-24 | 2017-05-25 | International Business Machines Corporation | Trust level modifier |
US10162982B2 (en) * | 2015-12-10 | 2018-12-25 | Sap Se | End user control of personal data in the cloud |
US9392460B1 (en) * | 2016-01-02 | 2016-07-12 | International Business Machines Corporation | Continuous user authentication tool for mobile device communications |
US10438209B2 (en) | 2016-02-10 | 2019-10-08 | Bank Of America Corporation | System for secure routing of data to various networks from a process data network |
US10178105B2 (en) * | 2016-02-22 | 2019-01-08 | Bank Of America Corporation | System for providing levels of security access to a process data network |
US10299018B1 (en) | 2016-02-29 | 2019-05-21 | Ips Group Inc. | Pole-mounted vehicle sensor |
US20170272428A1 (en) * | 2016-03-16 | 2017-09-21 | Thien Pham | Method for validating the identity of a user by using geo-location and biometric signature stored in device memory and on a remote server |
US9707911B1 (en) * | 2016-03-21 | 2017-07-18 | Ford Global Technologies, Llc | Identifying a driver of a vehicle |
TWI590100B (en) * | 2016-03-25 | 2017-07-01 | 速博思股份有限公司 | Operating method for handheld device |
KR101777389B1 (en) * | 2016-04-05 | 2017-09-26 | 한국전자통신연구원 | Apparatus and method for authentication based cognitive information |
TWI647584B (en) * | 2016-04-12 | 2019-01-11 | 速博思股份有限公司 | Method of enabling/disabling operating-authority of handheld device |
US10230723B2 (en) * | 2016-04-29 | 2019-03-12 | Motorola Solutions, Inc. | Method and system for authenticating a session on a communication device |
WO2018013117A1 (en) * | 2016-07-14 | 2018-01-18 | Hewlett-Packard Development Company, L.P. | Contextual device unlocking |
AU2017300273B2 (en) * | 2016-07-20 | 2019-08-01 | Dexcom, Inc. | System and method for wireless communication of glucose data |
US10924479B2 (en) * | 2016-07-20 | 2021-02-16 | Aetna Inc. | System and methods to establish user profile using multiple channels |
US10423768B2 (en) * | 2016-07-27 | 2019-09-24 | Google Llc | Real-time user authentication using integrated biometric sensor |
US10637853B2 (en) | 2016-08-05 | 2020-04-28 | Nok Nok Labs, Inc. | Authentication techniques including speech and/or lip movement analysis |
US10769635B2 (en) * | 2016-08-05 | 2020-09-08 | Nok Nok Labs, Inc. | Authentication techniques including speech and/or lip movement analysis |
US10402796B2 (en) | 2016-08-29 | 2019-09-03 | Bank Of America Corporation | Application life-cycle transition record recreation system |
US11184766B1 (en) * | 2016-09-07 | 2021-11-23 | Locurity Inc. | Systems and methods for continuous authentication, identity assurance and access control |
US9980135B2 (en) | 2016-09-12 | 2018-05-22 | Qualcomm Incorporated | Managing security for a mobile communication device |
US10580282B2 (en) * | 2016-09-12 | 2020-03-03 | Bragi GmbH | Ear based contextual environment and biometric pattern recognition system and method |
US20180083939A1 (en) | 2016-09-19 | 2018-03-22 | International Business Machines Corporation | Geolocation dependent variable authentication |
US20180089519A1 (en) * | 2016-09-26 | 2018-03-29 | Michael Raziel | Multi-modal user authentication |
WO2018059962A1 (en) * | 2016-09-28 | 2018-04-05 | Sony Corporation | A device, computer program and method |
US11030618B1 (en) | 2016-09-30 | 2021-06-08 | Winkk, Inc. | Authentication and personal data sharing for partner services using out-of-band optical mark recognition |
US9769166B1 (en) * | 2016-10-19 | 2017-09-19 | International Business Machines Corporation | Wearable sensor based system for person identification |
US10372893B2 (en) * | 2016-11-01 | 2019-08-06 | International Business Machines Corporation | Sensor-based authentication |
US20180132107A1 (en) * | 2016-11-07 | 2018-05-10 | Mediatek Inc. | Method and associated processor for improving user verification |
KR20180055661A (en) * | 2016-11-16 | 2018-05-25 | 삼성전자주식회사 | Electronic apparatus and control method thereof |
US10027662B1 (en) * | 2016-12-06 | 2018-07-17 | Amazon Technologies, Inc. | Dynamic user authentication |
US10505924B1 (en) | 2016-12-09 | 2019-12-10 | Wells Fargo Bank, N.A. | Defined zone of authentication |
US10140440B1 (en) * | 2016-12-13 | 2018-11-27 | Symantec Corporation | Systems and methods for securing computing devices that are not in users' physical possessions |
CN110192193A (en) * | 2017-01-19 | 2019-08-30 | 惠普发展公司有限责任合伙企业 | Secret protection equipment |
DE102017101959A1 (en) * | 2017-02-01 | 2018-08-02 | Endress+Hauser Conducta Gmbh+Co. Kg | Method for measuring, calibrating and documenting a sensor by means of a computer |
US20180232508A1 (en) * | 2017-02-10 | 2018-08-16 | The Trustees Of Columbia University In The City Of New York | Learning engines for authentication and autonomous applications |
US20180241743A1 (en) * | 2017-02-21 | 2018-08-23 | Google Inc. | Integrated Second Factor Authentication |
US11397598B2 (en) | 2017-02-23 | 2022-07-26 | Samsung Electronics Co., Ltd. | Electronic device for performing authentication by using multiple biometric sensors and operation method thereof |
KR102314241B1 (en) * | 2017-03-28 | 2021-10-20 | 삼성전자주식회사 | Method for adaptive authentication and electronic device supporting the same |
US10581842B2 (en) | 2017-03-30 | 2020-03-03 | At&T Intellectual Property I, L.P. | Seamless authentication device |
US10624561B2 (en) | 2017-04-12 | 2020-04-21 | Fitbit, Inc. | User identification by biometric monitoring device |
US10917423B2 (en) | 2017-05-15 | 2021-02-09 | Forcepoint, LLC | Intelligently differentiating between different types of states and attributes when using an adaptive trust profile |
US10999297B2 (en) | 2017-05-15 | 2021-05-04 | Forcepoint, LLC | Using expected behavior of an entity when prepopulating an adaptive trust profile |
US10862927B2 (en) | 2017-05-15 | 2020-12-08 | Forcepoint, LLC | Dividing events into sessions during adaptive trust profile operations |
US10447718B2 (en) | 2017-05-15 | 2019-10-15 | Forcepoint Llc | User profile definition and management |
US9882918B1 (en) | 2017-05-15 | 2018-01-30 | Forcepoint, LLC | User behavior profile in a blockchain |
US10129269B1 (en) | 2017-05-15 | 2018-11-13 | Forcepoint, LLC | Managing blockchain access to user profile information |
US10915643B2 (en) | 2017-05-15 | 2021-02-09 | Forcepoint, LLC | Adaptive trust profile endpoint architecture |
US10999296B2 (en) | 2017-05-15 | 2021-05-04 | Forcepoint, LLC | Generating adaptive trust profiles using information derived from similarly situated organizations |
US20180336326A1 (en) * | 2017-05-17 | 2018-11-22 | Bank Of America Corporation | System for electronic authentication with bot detection and denial |
US10579322B1 (en) | 2017-05-22 | 2020-03-03 | Parallels International Gmbh | Connecting to remote access session based on proximity of mobile device |
CN108959865B (en) * | 2017-05-25 | 2022-12-16 | 创新先进技术有限公司 | Verification method and device |
SE1750720A1 (en) * | 2017-06-07 | 2018-12-08 | Fingerprint Cards Ab | Fingerprint authentication method and system for rejecting spoof attempts |
JP2019008702A (en) * | 2017-06-28 | 2019-01-17 | トヨタ自動車株式会社 | Authentication apparatus |
US20190044942A1 (en) * | 2017-08-01 | 2019-02-07 | Twosense, Inc. | Deep Learning for Behavior-Based, Invisible Multi-Factor Authentication |
DK3665860T3 (en) | 2017-08-11 | 2021-08-09 | Kobil Gmbh | Multifactor authentication |
US10404675B2 (en) * | 2017-08-16 | 2019-09-03 | Bank Of America Corporation | Elastic authentication system |
US10637662B2 (en) * | 2017-08-28 | 2020-04-28 | International Business Machines Corporation | Identity verification using biometric data and non-invertible functions via a blockchain |
KR102382470B1 (en) * | 2017-08-29 | 2022-04-04 | 홈 컨트롤 싱가포르 피티이. 엘티디. | Sophisticated User Recognition |
US11079812B1 (en) * | 2017-09-12 | 2021-08-03 | Apple Inc. | Modular button assembly for an electronic device |
EP3471447A1 (en) * | 2017-10-13 | 2019-04-17 | Gemalto M2M GmbH | Method for securing a direct communication connection |
US10225737B1 (en) * | 2017-10-31 | 2019-03-05 | Konica Minolta Laboratory U.S.A., Inc. | Method and system for authenticating a user using a mobile device having plural sensors |
US10885168B2 (en) * | 2017-11-24 | 2021-01-05 | Mastercard International Incorporated | User authentication via fingerprint and heartbeat |
US11868995B2 (en) | 2017-11-27 | 2024-01-09 | Nok Nok Labs, Inc. | Extending a secure key storage for transaction confirmation and cryptocurrency |
JP6669714B2 (en) | 2017-11-28 | 2020-03-18 | ファナック株式会社 | Teaching operation panel and robot control system |
US10868812B2 (en) * | 2017-12-29 | 2020-12-15 | ANI Technologies Private Limited | Method and system for device authentication |
US10937470B2 (en) * | 2018-01-10 | 2021-03-02 | Fmr Llc | Systems and methods for dynamic data masking |
US11831409B2 (en) | 2018-01-12 | 2023-11-28 | Nok Nok Labs, Inc. | System and method for binding verifiable claims |
US11036841B1 (en) | 2018-02-26 | 2021-06-15 | NortonLifeLock Inc. | Systems and methods for detecting unauthorized use of an application |
KR102535720B1 (en) | 2018-02-28 | 2023-05-22 | 엘지전자 주식회사 | Electronic device |
KR102517610B1 (en) * | 2018-02-28 | 2023-04-03 | 엘지전자 주식회사 | Electronic device |
WO2019196792A1 (en) * | 2018-04-12 | 2019-10-17 | Oppo广东移动通信有限公司 | Security control method and apparatus for application program, and mobile terminal and computer-readable storage medium |
US11171937B2 (en) | 2018-05-25 | 2021-11-09 | Target Brands, Inc. | Continuous guest re-authentication system |
US10791461B1 (en) * | 2018-06-25 | 2020-09-29 | Sprint Communications Company L.P. | Mobile communication device user authenticator |
US11527107B1 (en) * | 2018-06-29 | 2022-12-13 | Apple Inc. | On the fly enrollment for facial recognition |
ES2912165T3 (en) * | 2018-07-06 | 2022-05-24 | Veridas Digital Authentication Solutions S L | Authentication of a user |
US11637694B2 (en) | 2018-07-16 | 2023-04-25 | Winkk, Inc. | Secret material exchange and authentication cryptography operations |
US11100204B2 (en) * | 2018-07-19 | 2021-08-24 | Motorola Mobility Llc | Methods and devices for granting increasing operational access with increasing authentication factors |
US11134084B1 (en) * | 2018-08-22 | 2021-09-28 | Hid Global Corporation | Diversified authentication and access control |
KR102120674B1 (en) * | 2018-09-19 | 2020-06-10 | 엘지전자 주식회사 | Mobile terminal |
US20200117780A1 (en) * | 2018-10-15 | 2020-04-16 | Ca, Inc. | Multi-factor biometric authentication |
US10878071B2 (en) | 2018-10-23 | 2020-12-29 | International Business Machines Corooration | Biometric authentication anomaly detection |
EP3644137A1 (en) * | 2018-10-26 | 2020-04-29 | Tissot S.A. | Method of securing access to the use of functions of a watch |
US11159520B1 (en) * | 2018-12-20 | 2021-10-26 | Wells Fargo Bank, N.A. | Systems and methods for passive continuous session authentication |
US11095641B1 (en) | 2018-12-20 | 2021-08-17 | Wells Fargo Bank, N.A. | Systems and methods for passive continuous session authentication |
US11411958B2 (en) | 2019-01-18 | 2022-08-09 | Cisco Technology, Inc. | Machine learning-based application posture for zero trust networking |
US11546328B2 (en) | 2019-01-24 | 2023-01-03 | Hewlett Packard Enterprise Development Lp | Continuous multifactor device authentication |
US11922756B2 (en) | 2019-01-30 | 2024-03-05 | J.J. Mackay Canada Limited | Parking meter having touchscreen display |
CA3031936A1 (en) | 2019-01-30 | 2020-07-30 | J.J. Mackay Canada Limited | Spi keyboard module for a parking meter and a parking meter having an spi keyboard module |
US11080379B2 (en) | 2019-02-13 | 2021-08-03 | International Business Machines Corporation | User authentication |
US12041039B2 (en) | 2019-02-28 | 2024-07-16 | Nok Nok Labs, Inc. | System and method for endorsing a new authenticator |
US11863552B1 (en) * | 2019-03-06 | 2024-01-02 | Wells Fargo Bank, N.A. | Systems and methods for continuous session authentication utilizing previously extracted and derived data |
US11310228B1 (en) | 2019-03-06 | 2022-04-19 | Wells Fargo Bank, N.A. | Systems and methods for continuous authentication and monitoring |
US11531736B1 (en) | 2019-03-18 | 2022-12-20 | Amazon Technologies, Inc. | User authentication as a service |
JP7207047B2 (en) * | 2019-03-18 | 2023-01-18 | 富士フイルムビジネスイノベーション株式会社 | Data collection systems, devices and programs |
US11792024B2 (en) | 2019-03-29 | 2023-10-17 | Nok Nok Labs, Inc. | System and method for efficient challenge-response authentication |
US11860985B2 (en) * | 2019-04-08 | 2024-01-02 | BehavioSec Inc | Adjusting biometric detection thresholds based on recorded behavior |
US10853496B2 (en) | 2019-04-26 | 2020-12-01 | Forcepoint, LLC | Adaptive trust profile behavioral fingerprint |
US11321436B2 (en) | 2019-05-01 | 2022-05-03 | Samsung Electronics Co., Ltd. | Human ID for mobile authentication |
US11457019B2 (en) * | 2019-05-08 | 2022-09-27 | International Business Machines Corporation | Access control authentication scheme based on continuous authentication |
EP4010825A4 (en) * | 2019-08-09 | 2023-08-23 | Mastercard Technologies Canada ULC | Utilizing behavioral features to authenticate a user entering login credentials |
US11509642B2 (en) * | 2019-08-21 | 2022-11-22 | Truist Bank | Location-based mobile device authentication |
US11550938B2 (en) * | 2019-09-03 | 2023-01-10 | Science Applications International Corporation | Automatic device zeroization |
US11658959B2 (en) * | 2019-10-07 | 2023-05-23 | Apple Inc. | User authentication framework |
CN111027037A (en) * | 2019-11-11 | 2020-04-17 | 华为技术有限公司 | Method for verifying user identity and electronic equipment |
EP3832404A1 (en) * | 2019-12-06 | 2021-06-09 | Tissot S.A. | Method for managing use of the functions of a watch |
EP3832402A1 (en) * | 2019-12-06 | 2021-06-09 | Tissot S.A. | Method for secure connection of a watch to a remote server |
EP3832405A1 (en) * | 2019-12-06 | 2021-06-09 | Tissot S.A. | Watch comprising a system for controlling biometric access to confidential data |
EP3832407B1 (en) * | 2019-12-06 | 2024-03-27 | Tissot S.A. | Method for secure connection of a watch to a remote server |
US11652815B2 (en) | 2019-12-10 | 2023-05-16 | Winkk, Inc. | Security platform architecture |
US11657140B2 (en) * | 2019-12-10 | 2023-05-23 | Winkk, Inc. | Device handoff identification proofing using behavioral analytics |
US11563582B2 (en) | 2019-12-10 | 2023-01-24 | Winkk, Inc. | Method and apparatus for optical encryption communication using a multitude of hardware configurations |
US11936787B2 (en) | 2019-12-10 | 2024-03-19 | Winkk, Inc. | User identification proofing using a combination of user responses to system turing tests using biometric methods |
US11574045B2 (en) | 2019-12-10 | 2023-02-07 | Winkk, Inc. | Automated ID proofing using a random multitude of real-time behavioral biometric samplings |
US11328042B2 (en) | 2019-12-10 | 2022-05-10 | Winkk, Inc. | Automated transparent login without saved credentials or passwords |
US20210173949A1 (en) * | 2019-12-10 | 2021-06-10 | Winkk, Inc | Method and apparatus using personal computing device as a secure identification |
US11588794B2 (en) | 2019-12-10 | 2023-02-21 | Winkk, Inc. | Method and apparatus for secure application framework and platform |
US11928193B2 (en) * | 2019-12-10 | 2024-03-12 | Winkk, Inc. | Multi-factor authentication using behavior and machine learning |
US11553337B2 (en) | 2019-12-10 | 2023-01-10 | Winkk, Inc. | Method and apparatus for encryption key exchange with enhanced security through opti-encryption channel |
US11618413B2 (en) * | 2020-01-03 | 2023-04-04 | Blackberry Limited | Methods and systems for driver identification |
US11483312B2 (en) * | 2020-03-31 | 2022-10-25 | LendingClub Bank, National Association | Conditionally-deferred authentication steps for tiered authentication |
US11522867B2 (en) | 2020-03-31 | 2022-12-06 | LendingClub Bank, National Association | Secure content management through authentication |
US10791114B1 (en) | 2020-04-17 | 2020-09-29 | Capital One Services, Llc | Computing systems utilizing generated unique authorization identifiers for authorizing user operations and methods of use thereof |
US20220012314A1 (en) * | 2020-07-09 | 2022-01-13 | Veracity, Inc. | Group-Based Authentication Technique |
US11658964B2 (en) | 2020-08-26 | 2023-05-23 | Bank Of America Corporation | System and method for providing a continuous authentication on an open authentication system using user's behavior analysis |
CN111885597B (en) * | 2020-09-28 | 2021-01-01 | 上海兴容信息技术有限公司 | Method and system for security authentication |
GB2601165A (en) * | 2020-11-20 | 2022-05-25 | Wallife S R L | Transaction verification |
WO2022136930A1 (en) * | 2020-12-22 | 2022-06-30 | PathPartner Technology Private Limited | System and method for classification of objects in vehicle using feature vectors |
US20220207162A1 (en) * | 2020-12-29 | 2022-06-30 | Citrix Systems, Inc. | Systems and methods for securing user devices |
US11637826B2 (en) * | 2021-02-24 | 2023-04-25 | Capital One Services, Llc | Establishing authentication persistence |
WO2022217342A1 (en) * | 2021-04-14 | 2022-10-20 | Ecosystem Informatics Inc. | Monitoring an ambient air parameter using a trained model |
US11843943B2 (en) | 2021-06-04 | 2023-12-12 | Winkk, Inc. | Dynamic key exchange for moving target |
US20230008868A1 (en) * | 2021-07-08 | 2023-01-12 | Nippon Telegraph And Telephone Corporation | User authentication device, user authentication method, and user authentication computer program |
US11824999B2 (en) | 2021-08-13 | 2023-11-21 | Winkk, Inc. | Chosen-plaintext secure cryptosystem and authentication |
US20230214822A1 (en) * | 2022-01-05 | 2023-07-06 | Mastercard International Incorporated | Computer-implemented methods and systems for authentic user-merchant association and services |
US12045327B2 (en) * | 2022-02-16 | 2024-07-23 | IsltMe LLC | Methods and systems for facilitating authenticating of users |
US20240144238A1 (en) * | 2022-10-31 | 2024-05-02 | Capital One Services, Llc | System and method for facilitating service machine activation |
CN117407843B (en) * | 2023-10-13 | 2024-04-19 | 成都安美勤信息技术股份有限公司 | Privacy information access detection management method |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7725732B1 (en) * | 2003-12-16 | 2010-05-25 | Ballard Claudio R | Object authentication system |
EP2254093A1 (en) * | 2009-05-22 | 2010-11-24 | Daon Holdings Limited | Method and system for confirming the identity of a user background of the invention |
WO2012018326A1 (en) * | 2010-08-04 | 2012-02-09 | Research In Motion Limited | Method and apparatus for providing continuous authentication based on dynamic personal information |
US20120252411A1 (en) * | 2011-03-30 | 2012-10-04 | Qualcomm Incorporated | Continuous voice authentication for a mobile device |
US20130055348A1 (en) * | 2011-08-31 | 2013-02-28 | Microsoft Corporation | Progressive authentication |
Family Cites Families (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP4374904B2 (en) * | 2003-05-21 | 2009-12-02 | 株式会社日立製作所 | Identification system |
US20100146262A1 (en) * | 2008-12-04 | 2010-06-10 | Shenzhen Huawei Communication Technologies Co., Ltd. | Method, device and system for negotiating authentication mode |
US7690032B1 (en) * | 2009-05-22 | 2010-03-30 | Daon Holdings Limited | Method and system for confirming the identity of a user |
US20120323717A1 (en) * | 2011-06-16 | 2012-12-20 | OneID, Inc. | Method and system for determining authentication levels in transactions |
US20130054433A1 (en) * | 2011-08-25 | 2013-02-28 | T-Mobile Usa, Inc. | Multi-Factor Identity Fingerprinting with User Behavior |
US8590018B2 (en) * | 2011-09-08 | 2013-11-19 | International Business Machines Corporation | Transaction authentication management system with multiple authentication levels |
US9621404B2 (en) * | 2011-09-24 | 2017-04-11 | Elwha Llc | Behavioral fingerprinting with social networking |
US20130111586A1 (en) * | 2011-10-27 | 2013-05-02 | Warren Jackson | Computing security mechanism |
JP2013186851A (en) * | 2012-03-12 | 2013-09-19 | Panasonic Corp | Information processor for which input of information for cancelling security is required and log-in method |
US10270748B2 (en) * | 2013-03-22 | 2019-04-23 | Nok Nok Labs, Inc. | Advanced authentication techniques and applications |
JP6307593B2 (en) * | 2013-04-26 | 2018-04-04 | インターデイジタル パテント ホールディングス インコーポレイテッド | Multi-factor authentication to achieve the required level of certification assurance |
-
2014
- 2014-10-24 US US14/523,689 patent/US20150242605A1/en not_active Abandoned
-
2015
- 2015-02-20 EP EP15712447.0A patent/EP3108636A1/en not_active Withdrawn
- 2015-02-20 WO PCT/US2015/016887 patent/WO2015127256A1/en active Application Filing
- 2015-02-20 CN CN201580008776.0A patent/CN106030599A/en active Pending
- 2015-02-20 KR KR1020167025678A patent/KR20160124834A/en unknown
- 2015-02-20 JP JP2016552902A patent/JP2017515178A/en active Pending
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7725732B1 (en) * | 2003-12-16 | 2010-05-25 | Ballard Claudio R | Object authentication system |
EP2254093A1 (en) * | 2009-05-22 | 2010-11-24 | Daon Holdings Limited | Method and system for confirming the identity of a user background of the invention |
WO2012018326A1 (en) * | 2010-08-04 | 2012-02-09 | Research In Motion Limited | Method and apparatus for providing continuous authentication based on dynamic personal information |
US20120252411A1 (en) * | 2011-03-30 | 2012-10-04 | Qualcomm Incorporated | Continuous voice authentication for a mobile device |
US20130055348A1 (en) * | 2011-08-31 | 2013-02-28 | Microsoft Corporation | Progressive authentication |
Non-Patent Citations (1)
Title |
---|
See also references of EP3108636A1 |
Cited By (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2017144768A1 (en) * | 2016-02-26 | 2017-08-31 | Nokia Technologies Oy | Behavioural biometric authentication |
US10715521B2 (en) | 2016-05-12 | 2020-07-14 | Credext Technologies Pvt. Ltd. | Biometric face recognition based continuous authentication and authorization system |
WO2017195218A1 (en) * | 2016-05-12 | 2017-11-16 | Credext Technologies Pvt. Ltd. | Biometric face recognition based continuous authentication and authorization system |
WO2018172016A1 (en) * | 2017-03-20 | 2018-09-27 | Bundesdruckerei Gmbh | Method and system for the behaviour-based authentication of a user |
US11632368B2 (en) | 2017-03-20 | 2023-04-18 | Bundesdruckerei Gmbh | Method and system for the behaviour-based authentication of a user |
WO2018198110A1 (en) | 2017-04-25 | 2018-11-01 | Ix-Den Ltd. | System and method for iot device authentication and secure transaction authorization |
EP3616359A4 (en) * | 2017-04-25 | 2021-03-17 | IX-Den Ltd. | System and method for iot device authentication and secure transaction authorization |
EP3471002A1 (en) * | 2017-10-16 | 2019-04-17 | Bundesdruckerei GmbH | Behaviour-based authentication taking into account environmental parameters |
EP3477981A1 (en) * | 2017-10-26 | 2019-05-01 | Bundesdruckerei GmbH | Behaviour-based authentication taking into account environmental parameters |
US11514142B2 (en) | 2018-04-26 | 2022-11-29 | ID R&D, Inc. | System and method for multi-modal continuous biometric authentication for messengers and virtual assistants |
EP3743836A4 (en) * | 2018-05-02 | 2021-03-03 | Samsung Electronics Co., Ltd. | System and method for resource access authentication |
WO2019212263A1 (en) | 2018-05-02 | 2019-11-07 | Samsung Electronics Co., Ltd. | System and method for resource access authentication |
US11985132B2 (en) | 2018-05-02 | 2024-05-14 | Samsung Electronics Co., Ltd. | System and method for resource access authentication |
WO2019243474A1 (en) * | 2018-06-21 | 2019-12-26 | Bundesdruckerei Gmbh | Automatic adaptive calibration of authentication requirements |
EP3842967A1 (en) * | 2019-12-26 | 2021-06-30 | Koa Health B.V. | Method, system and computer programs for validating a user |
WO2021130272A1 (en) * | 2019-12-26 | 2021-07-01 | Koa Health B.V. | Method, system and computer programs for validating a user |
EP3926498A1 (en) * | 2020-06-17 | 2021-12-22 | Irdeto Canada Corporation | System and method for continuous user authentication |
US11637835B2 (en) | 2020-06-17 | 2023-04-25 | Irdeto B.V. | System and method for context-sensitive access control |
IT202100019634A1 (en) * | 2021-07-23 | 2023-01-23 | Cleafy Spa | Method for confirming the identity of a user in a browsing session of an online service |
EP4123483A1 (en) * | 2021-07-23 | 2023-01-25 | Cleafy Società per Azioni | Method for confirming the identity of a user in a browsing session of an online service |
Also Published As
Publication number | Publication date |
---|---|
CN106030599A (en) | 2016-10-12 |
KR20160124834A (en) | 2016-10-28 |
JP2017515178A (en) | 2017-06-08 |
EP3108636A1 (en) | 2016-12-28 |
US20150242605A1 (en) | 2015-08-27 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20150242605A1 (en) | Continuous authentication with a mobile device | |
EP3108397B1 (en) | Trust broker authentication method for mobile devices | |
US10440019B2 (en) | Method, computer program, and system for identifying multiple users based on their behavior | |
EP3198911B1 (en) | Scalable authentication process selection based upon sensor inputs | |
US12032668B2 (en) | Identifying and authenticating users based on passive factors determined from sensor data | |
US10896248B2 (en) | Systems and methods for authenticating user identity based on user defined image data | |
US9531710B2 (en) | Behavioral authentication system using a biometric fingerprint sensor and user behavior for authentication | |
US10242362B2 (en) | Systems and methods for issuance of provisional financial accounts to mobile devices | |
US20160226865A1 (en) | Motion based authentication systems and methods | |
EP3304389B1 (en) | Authentication through multiple pathways based on device capabilities and user requests | |
US20160232516A1 (en) | Predictive authorization of mobile payments | |
US20190114060A1 (en) | User interface customization based on facial recognition | |
US11171951B2 (en) | Device interface output based on biometric input orientation and captured proximate data | |
US10958639B2 (en) | Preventing unauthorized access to secure information systems using multi-factor, hardware based and/or advanced biometric authentication | |
EP3651038A1 (en) | Brain activity-based authentication | |
KR102017632B1 (en) | User authentication system and method using a wearable terminal and a token issue terminal | |
CA2910929C (en) | Systems and methods for authenticating user identity based on user-defined image data | |
KR20210050651A (en) | Mobile device and method for authenricating a user by using an audio signal |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 15712447 Country of ref document: EP Kind code of ref document: A1 |
|
DPE1 | Request for preliminary examination filed after expiration of 19th month from priority date (pct application filed from 20040101) | ||
ENP | Entry into the national phase |
Ref document number: 2016552902 Country of ref document: JP Kind code of ref document: A |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
REG | Reference to national code |
Ref country code: BR Ref legal event code: B01A Ref document number: 112016019452 Country of ref document: BR |
|
REEP | Request for entry into the european phase |
Ref document number: 2015712447 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2015712447 Country of ref document: EP |
|
ENP | Entry into the national phase |
Ref document number: 20167025678 Country of ref document: KR Kind code of ref document: A |
|
ENP | Entry into the national phase |
Ref document number: 112016019452 Country of ref document: BR Kind code of ref document: A2 Effective date: 20160823 |