Challenge generation for verifying users of computing devices

• US 10,082,954 B2
• Filed: 09/04/2015
• Issued: 09/25/2018
• Est. Priority Date: 09/04/2015
• Status: Active Grant

• Current Assignee: Arkose Labs Holdings Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Jarrous, Ayman, Shulman-Peleg, Alexandra, Menahem, Eitan
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): MURPHY, JOSEPH B
• Application Number:
  US14/845,285
• Publication Number:
  US 20170068446A1
• Time in Patent Office: 1,117 Days
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 3/04883 for inputting data by handwriting, e.g. gesture or text
• CPC Class Codes: G06F 3/04886 by partitioning the display area of the touch-screen or the surface of the digitising tablet into independently controllable areas, e.g. virtual keyboards or menus
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Challenging a current user of a computing device by measuring characteristics of user actions sensed by a computing device, determining that the measurements meet a uniqueness condition with respect to corresponding measurements in a comparison set of actions, recording the user actions and their measurements in a set of challenge actions associated with an authorized user, and responsive to a challenge requirement to determine whether a current user of the computing device is the authorized user, selecting challenge actions associated with an authorized user, prompting the current user to perform the selected challenge actions that are then sensed by the computing device, measuring characteristics of the prompted actions, and determining that the measurements of the characteristics of the prompted actions meet a similarity condition with respect to measurements of corresponding characteristics of the selected challenge actions.

Claims

1. A system for challenging a user of a computing device, the system comprising:

a characteristics measurement module configured to measure one or more characteristics of a user action sensed by a computing device and performed by an authorized user of the computing device subsequent to the authorized user of the computing device having been identified as the authorized user of the computing device;

a uniqueness assessor configured to

determine that the measurements of the characteristics of the user action performed by the authorized user of the computing device subsequent to the authorized user of the computing device having been identified as the authorized user of the computing device meet a uniqueness condition with respect to measurements of corresponding characteristics of a corresponding action in a comparison set of actions, and

cause the user action and the measurements of the characteristics to be recorded in a set of challenge actions associated with the authorized user responsive to determining that the measurements of the characteristics meet the uniqueness condition; and

a challenge manager configured to determine, responsive to a challenge requirement, whether a current user of the computing device is the authorized user, by

selecting one or more of the challenge actions associated with the authorized user,

prompting the current user of the computing device to perform the selected challenge actions, wherein the selected challenge actions performed by the current user are sensed by the computing device, and

determining that the measurements of the characteristics of the selected challenge actions performed by the current user meet a similarity condition with respect to measurements of corresponding characteristics of the selected challenge actions,

wherein the characteristics measurement module, the uniqueness assessor, and the challenge manager are implemented in any of

a) computer hardware, and

b) computer software embodied in a non-transitory, computer-readable medium.

2. The system according to claim 1 wherein the challenge manager is configured to determine whether the current user of the computing device is the authorized user responsive to a failed attempt to determine whether the current user is the authorized user.

3. The system according to claim 1 wherein any of the user actions are in the form of two-dimensional geometric patterns that are input via a touch screen of the computing device when using an on-screen keyboard of the computing device.

4. The system according to claim 1 wherein any of the user actions are in the form of two-dimensional geometric patterns that are input via a touch screen of the computing device when tracing a pattern among graphic elements of a displayed set of graphic elements.

5. The system according to claim 1 wherein any of the user actions are in the form of three-dimensional input patterns that combine two-dimensional geometric input patterns with a spatial orientation of the computing device at input time of the two-dimensional geometric input patterns.

6. The system according to claim 1 wherein the comparison set of actions includes actions and characteristic measurements associated with a reference set of users of other computing devices.

7. The system according to claim 1 wherein the challenge manager is configured to determine whether the current user of the computing device is the authorized user when an attempt is made by the current user of the computing device to access any of a) a software application hosted by the computing device and b) an operating system function of the computing device that are configured to trigger the challenge requirement responsive to the attempt.

8. The system according to claim 1 wherein the challenge manager is configured to determine whether the current user of the computing device is the authorized user when the measurements of the characteristics of one of the user actions that are detected at different times differ by more than a predefined acceptable variance.

9. A computer program product for challenging a user of a computing device, the computer program product comprising:

a non-transitory, computer-readable storage medium; and

computer-readable program code embodied in the storage medium, wherein the computer-readable program code is configured to

measure one or more characteristics of a user action sensed by a computing device and performed by an authorized user of the computing device subsequent to the authorized user of the computing device having been identified as the authorized user of the computing device,

determine that the measurements of the characteristics of the user action performed by the authorized user of the computing device subsequent to the authorized user of the computing device having been identified as the authorized user of the computing device meet a uniqueness condition with respect to measurements of corresponding characteristics of a corresponding action in a comparison set of actions,

record the user action and the measurements of the characteristics in a set of challenge actions associated with the authorized user responsive to determining that the measurements of the characteristics meet the uniqueness condition,

perform the measuring, determining, and recording for a plurality of different user actions associated with the authorized user, and

determine, responsive to a challenge requirement, whether a current user of the computing device is the authorized user, by

selecting one or more of the challenge actions associated with the authorized user,

prompting the current user of the computing device to perform the selected challenge actions, wherein the selected challenge actions performed by the current user are sensed by the computing device,

measuring one or more characteristics of the selected challenge actions performed by the current user, and

determining that the measurements of the characteristics of the selected challenge actions performed by the current user meet a similarity condition with respect to measurements of corresponding characteristics of the selected challenge actions.

10. The computer program product according to claim 9 wherein the computer-readable program code is configured to determine whether the current user of the computing device is the authorized user when the measurements of the characteristics of one of the user actions that are detected at different times differ by more than a predefined acceptable variance.