METHODS PROVIDING AUTHENTICATION DURING A SESSION USING IMAGE DATA AND RELATED DEVICES AND COMPUTER PROGRAM PRODUCTS

• US 20180124046A1
• Filed: 11/02/2016
• Published: 05/03/2018
• Est. Priority Date: 11/02/2016
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: VERMA, VINEET
• Granted Patent: US 10,630,679 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/5838 using colour
• CPC Class Codes: G06V 40/172 Classification, e.g. identification
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

A method providing use of an application may include providing a session for a user of the application, wherein the session is provided based on a credential for the user. While providing the session, image data for the session may be obtained, and responsive to the image data for the session, authentication may be performed based on a determination whether the image data for the session includes a facial image that matches the user credential. Responsive to success of the authentication based on the image data for the session, the session for the user of the application may continue to be provided. Related devices and computer program products are also discussed.

Claims

1. A method providing use of an application, the method comprising:

providing a session for a user of the application, wherein the session is provided based on a credential for the user;

while providing the session, obtaining image data for the session;

responsive to the image data for the session, performing authentication based on a determination whether the image data for the session includes a facial image that matches the user credential; and

responsive to success of the authentication based on the image data for the session, continuing to provide the session for the user of the application.

2. The method of claim 1, further comprising:

responsive to the image data for the session, logging the facial image of the user in an audit log for the user.

3. The method of claim 1, wherein performing authentication comprises,

responsive to uncertainty regarding the image data including the facial image that matches the user credential, transmitting a notification to a system administrator;

wherein continuing to provide the session comprises continuing to provide the session responsive to receiving a confirmation from the system administer that the image data includes the facial image that matches the user credential.

4. The method of claim 3, wherein performing authentication comprises,

generating a facial recognition score based on a comparison of the image data for the session and a data set including facial image data of a plurality of users of the network application including the user,

wherein transmitting the notification to the system administrator comprises transmitting the notification responsive to the facial recognition score indicating uncertainty.

5. The method of claim 1, wherein performing authentication comprises,

responsive to uncertainty regarding the image data including the facial image that matches the user credential, obtaining additional image data;

wherein continuing to provide the session comprises continuing to provide the session responsive to obtaining the additional image data including the facial image that matches the user credential.

6. The method of claim 5, wherein obtaining the additional image data comprises,

providing an instruction for the user to look in a designated direction, and

obtaining the additional image data after providing the instruction.

7. The method of claim 5, wherein obtaining the additional image data comprises,

providing an instruction for the user to hold a photo-identification next to the user'"'"'s head, and obtaining the additional image data after providing the instruction.

8. The method of claim 5, wherein performing authentication comprises,

generating a facial recognition score based on a comparison of the image data for the session and a data set including facial image data of a plurality of users of the network application including the user,

wherein obtaining the additional image data comprises obtaining the additional image data responsive to the facial recognition score indicating uncertainty.

9. The method of claim 1, wherein the image data for the session is first image data for the session, the method further comprising:

after receiving the first image data for the session and after continuing to provide the session, receiving second image data for the session while providing the session, wherein the first image data for the session is different than the second image data for the session; and

responsive to a determination that multiple facial images are included in the second image data for the session, blocking access to at least a portion of the network application.

10. The method of claim 9, wherein blocking access comprises continuing to provide the session while blocking access to a high security zone of the network application.

11. The method of claim 1, wherein the image data for the session is first image data for the session, the method further comprising:

after receiving the first image data for the session and after continuing to provide the session, obtaining second image data for the session while providing the session, wherein the first image data for the session is different than the second image data for the session;

responsive to the second image data for the session, performing authentication based on a determination whether the second image data includes a facial image that matches the user credential; and

responsive to failure of the authentication based on the second image data for the session, blocking access to at least a portion of the application.

12. The method of claim 11, wherein blocking access comprises terminating the session for the user.

13. The method of claim 11, wherein blocking access comprises continuing to provide the session while selectively blocking access to a high security zone of the application.

14. The method of claim 11, further comprising:

responsive to the failure of the authentication, transmitting a notification of the failure to a system administrator and/or to the user associated with the credential.

15. The method of claim 1, wherein performing authentication based on the determination whether the image data includes a facial image that matches the user credential comprises initiating facial recognition to compare the image data for the session with a data set including facial image data of a plurality of users of the application including the user.

16. The method of claim 15, further comprising:

responsive to the image data for the session including a facial image that matches the user credential, updating the facial image data of the user in the data set using the image data for the session.

17. The method of claim 1, further comprising:

before providing the session, obtaining authentication information, wherein the authentication information includes the user credential and pre-session image data; and

performing authentication based on a determination whether the pre-session image data includes a facial image that matches the user credential;

wherein providing the session comprises providing the session responsive to authentication success based on the pre-session image data.

18. The method of claim 1, wherein the user credential comprise a username and/or user identification.

19. The method of claim 18, wherein the user credential further comprises a password.

20. The method of claim 1, wherein the application comprises a network application hosted on a network application server, wherein the user is a user of a network client device, wherein the session is provided for the user of the network client device over a network using the network application hosted by the network application server, and wherein obtaining the image data comprises obtaining the image data for the session from the network client device at the network application server.

21. A first network device comprising:

a network interface configured to communicate with a second network device through a network;

a processor coupled to the network interface; and

a memory coupled to the processor and storing computer readable program code that is executable by the processor to perform,

providing a session for a user of a second network device using the network application over a network using the network application, wherein the session is provided based on a credential for the user of the second network device,

receiving image data for the session from the second network device over the network while providing the session,

performing authentication responsive to the image data for the session based on a determination whether the image data for the session includes a facial image that matches the user credential, and

continuing to provide the session for the user of the second network device using the network application responsive to authentication success based on the image data for the session.

22. A computer program product comprising,

a non-transitory computer readable storage medium comprising computer readable program code embodied in the medium that when executed by a processor of a first network device causes the processor to perform operations comprising:

providing a session for a user of the application, wherein the session is provided based on a credential for the user;

while providing the session, obtaining image data for the session;

responsive to the image data for the session, performing authentication based on a determination whether the image data for the session includes a facial image that matches the user credential; and

responsive to success of the authentication based on the image data for the session, continuing to provide the session for the user of the application.