System, device, and method of recovery and resetting of user authentication factor

• US 10,586,036 B2
• Filed: 12/11/2018
• Issued: 03/10/2020
• Est. Priority Date: 11/29/2010
• Status: Active Grant

• Current Assignee: Biocatch Ltd.
• Original Assignee: Biocatch Ltd.
• Inventors: Turgeman, Avi
• Primary Examiner(s): Rahim, Monjur
• Application Number:
  US16/215,654
• Publication Number:
  US 20190121956A1
• Time in Patent Office: 455 Days
• Field of Search: 726 6
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication

Abstract

Devices, systems, and methods of password recovery and password reset, as well as resetting or recovering other types of user-authentication factor. A system monitors and tracks user-interactions that are performed by a user of an electronic device or a computerized service. The system defines a user-specific task or challenge, in which the user is requested to enter a phrase or perform a task. A user-specific feature is extracted from the manner in which the user performs the task. Subsequently, that user-specific feature is utilized instead of a security question, in order to verify the identity of the user and to allow the user to perform password reset or to perform a reset of another user-authentication factor; by presenting to the user the same task or a similar task, and monitoring the manner in which the user performs the fresh task.

Claims

1. A method comprising:

(AA) monitoring mouse interactions of a particular user, that utilizes an electronic device having a mouse to access a computerized service;

(BB) analyzing said mouse interactions, and identifying a particular mouse-movement that said particular user performed multiple times in a repeated user-specific manner;

subsequently,

(CC) in response to an indication that a current user is required to perform a reset or a recovery of a user-authentication factor of said computerized service;

(a) constructing a series of multiple mouse-movements, which comprises said particular mouse-movement identified in step (BB) and also comprises other mouse-movements that are non-unique to said particular user; and

presenting to the current user a fresh task that requires the current user to perform said series of multiple mouse-movements;

(b) monitoring a fresh manner in which the current user performs mouse-movements while he performs said fresh task;

(c) determining whether or not a fresh series of mouse-movements as monitored in step (b), includes a performance of said particular mouse-movement which exhibits said repeated user-specific manner that was identified in step (BB) during repeated previous performance of said particular mouse-movement by said particular user;

(d) if the determining of step (c) is positive, then determining that the current user is the particular user that is authorized to reset or recover said user-authentication factor of said computerized service.

2. The method of claim 1, wherein step (c) comprises:

determining whether there is a match between (I) a fresh user-specific characteristic, that is extracted from a fresh manner in which the current user performs mouse-movements to complete said series, and (II) a previously-extracted user-specific characteristic that was previously extracted from prior mouse interactions of the particular user when he repeatedly performed said particular mouse-movement in steps (AA) and (BB).

3. The method of claim 1, wherein the method comprises:

(I) detecting that said particular user, moves an on-screen pointer from on-screen location B to on-screen location C in a unique user-specific manner that is consistently repeated by said particular user across multiple interactions;

(II) constructing a task that requires the current user to move the on-screen pointer, via the mouse, from on-screen location A to on-screen location B, and then from on-screen location B to on-screen location C, and then from on-screen location C to on-screen location D;

(III) checking whether the current user has moved the on-screen pointer from on-screen location B to on-screen location C in accordance with the unique user-specific manner that was consistently repeated by said particular user;

(IV) if the checking result of step (III) is positive, then;

determining that the current user is said particular user, and authorizing the current user to perform recovery or reset of the user-authentication factor.

4. The method of claim 1, wherein said particular mouse-movement identified in step (BB) corresponds to a particular mouse-movement that said particular user had repeatedly performed, across multiple different usage sessions, in the same behavioral manner that is autonomously identified by analysis of mouse interactions of said particular user across said multiple different usage sessions.

5. The method of claim 1, wherein said particular mouse-movement identified in step (BB) is not a random or pseudo-random mouse-movement generated by a computing device, and is not a mouse-movement selected from a pool of pre-defined mouse-movements;

but rather, is extracted from analysis of mouse interactions of said particular user across multiple different usage sessions; and

is a mouse-movement that even said particular user is not aware that he repeatedly performs in said particular unique manner.

6. The method of claim 1, wherein step (a) comprises:

constructing said series of multiple mouse-movements, which comprises said particular mouse-movement identified in step (BB) and also comprises said other mouse-movements that are non-unique to said particular user, by randomly selecting said other mouse-movements from a pool of pre-defined mouse-movements.

7. The method of claim 1,

wherein said user authentication factor is utilized as a condition for granting access to a physical location.

8. The method of claim 1,

wherein said user authentication factor is utilized as a condition for granting access to a vehicle.

9. The method of claim 1,

wherein said user authentication factor is utilized for user authentication as part of a multi-factor authentication process.

10. A process comprising:

(I) detecting that a particular user moves an on-screen pointer, from on-screen location B to on-screen location C, in a unique user-specific manner that is consistently repeated by said particular user across multiple interactions with a computerized service via an input-unit;

(II) constructing a task that requires a current user to move the on-screen pointer, via said input unit, from on-screen location A to on-screen location B, and then from on-screen location B to on-screen location C, and then from on-screen location C to on-screen location D;

(III) checking whether the current user has moved the on-screen pointer from on-screen location B to on-screen location C in accordance with the unique user-specific manner that was consistently repeated by said particular user;

(IV) if the checking result of step (III) is positive, then;

determining that the current user is said particular user, and authorizing the current user to perform recovery or reset of the user-authentication factor.

11. The process of claim 10,

wherein constructing said task comprises hiding a user-specific requirement to move the on-screen pointer from on-screen location B to on-screen location C, among other, non-user-specific, requirements to move the on-screen pointer among other on-screen locations.

12. The process of claim 10,

wherein said input-unit is a mouse, and wherein step (I) comprises detecting that a unique user-specific manner in which said particular user repeatedly and uniquely operates the mouse in order to move the on-screen pointer from on-screen location B to on-screen location C.

13. The process of claim 10,

wherein said input-unit is a touch-pad, and wherein step (I) comprises detecting that a unique user-specific manner in which said particular user repeatedly and uniquely operates the touch-pad in order to move the on-screen pointer from on-screen location B to on-screen location C.

14. The process of claim 10, comprising:

detecting that said particular user, moves the on-screen pointer from on-screen location B to on-screen location C, repeatedly, in a unique and repeated non-linear route;

constructing a unique task that includes, among multiple requirements, a particular requirement to move the on-screen pointer from on-screen location B to on-screen location C; and

monitoring the manner in which a current user performs said particular requirement to determine whether the current user is said particular user.

15. The process of claim 10, wherein step (II) of constructing said task comprises:

randomly selecting from a pre-defined pool of mouse gestures, a first requirement to move the on-screen pointer from on-screen location A to on-screen location B;

deterministically and non-randomly selecting a second requirement, to move the on-screen pointer from on-screen location B to on-screen location C, based on the detecting in step (I) that said particular user moves from on-screen location B to on-screen location C in a particular unique manner that is repeated by said particular user across multiple usage sessions;

randomly selecting from said pre-defined pool of mouse gestures, a third requirement to move the on-screen pointer from on-screen location C to on-screen location D.

16. A method comprising:

(AA) monitoring touch-pad interactions of a particular user, that utilizes an electronic device having a touch-pad to access a computerized service;

(BB) analyzing said touch-pad interactions, and identifying a particular touch-pad-gesture that said particular user performed multiple times in a repeated user-specific manner;

subsequently,

(CC) in response to an indication that a current user is required to perform a reset or a recovery of a user-authentication factor of said computerized service;

(a) constructing a series of multiple movements, which comprises said particular touch-pad gesture identified in step (BB) and also comprises other touch-pad gestures that are non-unique to said particular user; and

presenting to the current user a fresh task that requires the current user to perform said series of multiple touch-pad gestures;

(b) monitoring a fresh manner in which the current user performs touch-pad gestures while he performs said fresh task;

(c) determining whether or not a fresh series of touch-pad gestured monitored in step (b), includes a performance of said particular touch-pad gesture which exhibits said repeated user-specific manner that was identified in step (BB) during repeated previous performance of said particular touch-pad gesture by said particular user;

(d) if the determining of step (c) is positive, then determining that the current user is the particular user that is authorized to reset or recover said user-authentication factor of said computerized service.

17. The method of claim 16,

wherein the method comprises differentiating between users based on monitoring whether or not the current user performs, within a series of gestures required from him, a particular gesture in a same manner that had been performed previously multiple times in a unique am repeated user-specific manner by said particular user.

18. A method comprising:

(AA) monitoring touch-screen interactions of a particular user, that utilizes an electronic device having a touch-screen to access a computerized service;

(BB) analyzing said touch-screen interactions, and identifying a particular touch-screen gesture that said particular user performed multiple times in a repeated user-specific manner;

subsequently,

(CC) in response to an indication that a current user is required to perform a reset or a recovery of a user-authentication factor of said computerized service;

(a) constructing a series of multiple gestures, which comprises said particular touch-screen gesture identified in step (BB) and also comprises other touch-screen gestures that are non-unique to said particular user; and

presenting to the current user a fresh task that requires the current user to perform said series of multiple gestures;

(b) monitoring a fresh manner in which the current user performs touch-screen gestures while he performs said fresh task;

(c) determining whether or not a fresh series of touch-screen gestures monitored in step (b), includes a performance of said particular touch-screen gesture which exhibits said repeated user-specific manner that was identified in step (BB) during repeated previous performance of said particular touch-screen gesture by said particular user;

(d) if the determining of step (c) is positive, then determining that the current user is the particular user that is authorized to reset or recover said user-authentication factor of said computerized service.

19. The method of claim 18,

wherein the method comprises differentiating between users based on monitoring whether or not the current user performs, within a series of gestures required from him, a particular gesture in a same manner that had been performed previously multiple times in a unique am repeated user-specific manner by said particular user.