RECOGNITION-BASED AUTHENTICATION, SYSTEMS AND METHODS

• US 20150302571A1
• Filed: 12/11/2014
• Published: 10/22/2015
• Est. Priority Date: 12/11/2013
• Status: Abandoned Application

• Current Assignee: NantMobile, LLC (NantWorks, LLC)
• Original Assignee: NantMobile, LLC (NantWorks, LLC)
• Inventors: Lambert, James
• Application Number:
  US14/568,015
• Publication Number:
  US 20150302571A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/5854 using shape and object relationship
• CPC Class Codes: G06T 7/337 involving reference images or patches
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

An authentication engine authenticates a user to access a service via a computing device by executing an object recognition algorithm on an image received from a different computing device. Specifically, the authentication engine presents an image token on a first computing device after receiving a request. The authentication engine then instructs the user to use a second computing device to capture a digital photo of the image token. Upon receiving the photo from the second device, the authentication engine executes an object recognition algorithm on the photo to derive a set of image descriptors. The authentication engine then generates an image difference by comparing the set of descriptors of the photo against the set of descriptors of the image token. Based on the image difference, the authentication engine authenticates the user to use a service via the first computing device.

Claims

1. A method of initiating a handshake between a first device and a second device, comprising:

instructing, by an authentication engine, the first device to present an image token to the second device, wherein the image token is associated with a first set of image descriptors previously derived from the image token;

receiving, at the authentication engine, image data from the second device, the image data being representative of a photo of the image token presented on the first device;

deriving, by the authentication engine, a second set of image descriptors from the image data;

generating, by the authentication engine, an image difference between the image token and the image data by comparing the first set of image descriptors and the second set of image descriptors; and

initiating, by the authentication engine, a handshake session between the first and second devices as a function of the generated difference.

2. The method of claim 1, wherein the handshake session allows a user to use a service via the first device.

3. The method of claim 1, wherein initiating the handshake session comprises establishing a communication channel between the first and second devices.

4. The method of claim 1, wherein the handshake session has a duration attribute.

5. The method of claim 1, wherein the handshake session has an access level attribute.

6. The method of claim 1, wherein initiating the handshake session comprises initiating the handshake session between the first and second devices when the generated image difference indicates that the first set of image descriptors and the second set of image descriptors are not identical.

7. The method of claim 6, wherein initiating the handshake session further comprises initiating the handshake session between the first and second devices only when the generated image difference is below a predetermined threshold.

8. The method of claim 1, wherein the first and second devices are communicatively coupled to the authentication engine, but are not communicatively coupled with each other.

9. The method of claim 1, further comprises aborting the handshake session when no image data is received from the second device within a predetermined duration of time.

10. The method of claim 1, further comprises aborting the handshake session between the first and second devices when the generated image difference exceeds a predetermined threshold.

11. The method of claim 1, wherein initiating the handshake session comprises providing a one-time session specific pass code to the second device.

12. The method of claim 1, further comprising providing an interface that enables a user to select an image as the image token for initiating the handshake session.

13. The method of claim 12, wherein the interface further enables the user to rotate the selected image and use the rotated image as the image token for initiating the handshake session.

14. A system for initiating a handshake between a first device and a second device, comprising:

an image database configured to store a plurality of image tokens and image descriptors associated with each of the plurality of image tokens; and

an authentication engine communicatively coupled to the image database and programmed to;

instruct the first device to present a first image token selected from the plurality of image tokens, wherein the first image token is associated with a first set of image descriptors,

receive image data from the second device, wherein the image data is representative of a photo of the image token presented on the first device,

derive a second set of image descriptors from the image data,

generate an image difference between the first image token and the image data by comparing the first set of image descriptors and the second set of image descriptors, and

initiate a handshake session between the first and second devices as a function of the generated difference.

15. The system of claim 14, wherein the authentication engine is further programmed to initiating the handshake session between the first and second devices when the generated image difference indicates that the image token and the image data is different.

16. The system of claim 15, wherein the authentication engine is further programmed initiate the handshake session further comprises initiating the handshake session between the first and second devices only when the generated image difference is below a predetermined threshold.

17. The system of claim 14, wherein the first and second devices are communicatively coupled to the authentication engine, but are not communicatively coupled with each other.

18. The system of claim 14, wherein the authentication engine is further programmed to abort the handshake session when no image data is received from the second device within a predetermined duration of time.

19. The system of claim 14, wherein the handshake session allows a user to use a service via the first device.

20. The system of claim 14, wherein the authentication engine is further programmed to initiate the handshake session by establishing a communication channel between the first and second devices.