Device, system, and method of recovery and resetting of user authentication factor

• US 10,164,985 B2
• Filed: 06/15/2016
• Issued: 12/25/2018
• Est. Priority Date: 11/29/2010
• Status: Active Grant

• Current Assignee: Biocatch Ltd.
• Original Assignee: Biocatch Ltd.
• Inventors: Turgeman, Avi
• Primary Examiner(s): Rahim, Monjur
• Application Number:
  US15/182,624
• Publication Number:
  US 20160294837A1
• Time in Patent Office: 923 Days
• Field of Search: 726 26
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/0486 Drag-and-drop
• CPC Class Codes: G06F 3/04886 by partitioning the display area of the touch-screen or the surface of the digitising tablet into independently controllable areas, e.g. virtual keyboards or menus
• CPC Class Codes: G07C 9/33 by means of a password
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Devices, systems, and methods of password recovery and password reset, as well as resetting or recovering other types of user-authentication factor. A system monitors and tracks user-interactions that are performed by a user of an electronic device or a computerized service. The system defines a user-specific task or challenge, in which the user is requested to enter a phrase or perform a task. A user-specific feature is extracted from the manner in which the user performs the task. Subsequently, that user-specific feature is utilized instead of a security question, in order to verify the identity of the user and to allow the user to perform password reset or to perform a reset of another user-authentication factor; by presenting to the user the same task or a similar task, and monitoring the manner in which the user performs the fresh task.

Claims

1. A method comprising:

(AA) monitoring input-user interactions of a user, that utilizes an electronic device to access a computerized service;

(BB) analyzing said input-user interactions, and identifying a particular word that the user typed multiple times in a user-specific typing manner;

subsequently,

(CC) determining that a current user, that (i) fails to perform an authentication process for accessing said computerized service or (ii) requests to perform a reset process for a user-authentication factor of said computerized service, is a genuine user that is authorized to reset said user-authentication factor of said computerized service, by performing;

(a) constructing a unique multiple-word phrase, which comprises (i) said particular word that was identified in step (BB), and also (ii) one or more other words; and

presenting to the current user a fresh task that requires the current user to type said unique multiple-word phrase;

(b) monitoring a fresh manner in which the current user types said unique multiple-word phrase;

(c) determining whether or not fresh typing of said unique multiple-word phrase as monitored in step (b), exhibits during typing of said particular word the user-specific typing manner that was identified in step (BB) during repeated previous typing of said particular word;

(d) if the determining of step (c) is positive, then determining that the current user is the genuine user that is authorized to reset said user-authentication factor of said service.

2. The method of claim 1, wherein step (c) comprises:

determining whether there is a match between (I) a fresh user-specific characteristic, that is extracted from the fresh manner in which the current user performs typing of said unique multiple-word phrase in step (b), and (II) a previously-extracted user-specific characteristic that was previously extracted from prior user interactions of the genuine user when he typed said particular word multiple types in steps (AA) and (BB).

3. The method of claim 1, comprising:

injecting an input/output aberration to a behavior of an input unit that the current user utilizes;

tracking a reaction of the user to the input/output aberration;

extracting from said reaction a user-specific reaction characteristic; and

determining whether the current user is authorized to reset said user-authentication factor by taking into account both (i) the user-specific reaction characteristic, and (ii) a result of the determining of step (c).

4. The method of claim 1, comprising:

injecting an input/output aberration to a behavior of an input unit that the current user utilizes;

tracking a corrective gesture of the user to the input/output aberration;

extracting from said corrective gesture a user-specific corrective characteristic; and

determining whether the current user is authorized to reset said user-authentication factor by taking into account both (i) the user-specific corrective characteristic, and (ii) a result of the determining of step (c).

5. The method of claim 1, wherein said user authentication factor is utilized as a condition for granting access to the user to a physical location.

6. The method of claim 1, wherein said user authentication factor is utilized as a condition for granting access to the user to a vehicle.

7. The method of claim 1, wherein said user authentication factor is utilized for user authentication as part of a multi-factor authentication process.