Targeted biometric challenges

• US 8,752,144 B1
• Filed: 12/14/2011
• Issued: 06/10/2014
• Est. Priority Date: 12/14/2011
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Kaufman, Alon, Villa, Yael, Dotan, Yedidya
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Ambaye, Samuel
• Application Number:
  US13/325,131
• Time in Patent Office: 909 Days
• Field of Search: 726/6, 713/186, 704/200
• US Class Current: 726/6
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

An improved technique tailors a biometric challenge activity to a particular user. The particular user submits electronic input from which an authentication system extracts information concerning traits of the particular user; such traits can include keystroke and swiping patterns, handheld device positions, and place of origin. An authentication server maps values of user attributes such as place of origin, age, and UI device to the extracted traits. The authentication server then selects biometric challenges for the particular user based on user attributes having values which deviate most from a mean value of that attribute taken across a population of users. That is, the authentication server bases biometric challenges on the most distinguishing traits of the particular user.

Claims

1. A method of tailoring a challenge activity to a particular user, the challenge activity being a part of an authentication procedure which is constructed and arranged to authenticate users based on multiple authentication factors, the method comprising:

identifying traits of the particular user from electronic input received from the particular user, the identified traits distinguishing the particular user among users of a user population;

selecting a set of user attributes from a pool of user attributes based on the identified traits of the particular user, each user attribute being an objectively measurable feature of a user of the user population; and

incorporating user attributes of the set of user attributes into the challenge activity;

wherein each identified trait of the particular user corresponds to a value of a user attribute of the pool of user attributes;

wherein identifying traits of the particular user includes;

performing a comparison operation on the value of the user attribute for the particular user to which that identified trait corresponds and a value of the user attribute for the user population, results of the comparison operation being used to identify distinguishing traits of the particular user;

wherein the value of the user attribute for the user population is equal to a mean value of the user attribute across the user population;

wherein performing the comparison operation includes;

generating a comparison value based on the value of the user attribute for the particular user and the mean value of the user attribute across the user population; and

assessing whether the comparison value satisfies a predetermined set of criteria;

wherein assessing whether the comparison value satisfies the predetermined set of criteria includes;

ranking, in descending order, the user attributes of the pool of user attributes according to the difference between the value of the user attribute and the mean value of the user attribute across the user population for each user attribute of the pool of user attributes to produce a ranked list of user attributes; and

wherein selecting the set of user attributes from the pool of user attributes based on the identified traits of the particular user includes;

picking the first N user attributes of the ranked list of user attributes as the set of user attributes, N being a number less than the number of user attributes in the pool of user attributes.

2. A method according to claim 1, wherein at least one user attribute of the pool of user attributes is a static attribute having a value that does not change with the electronic input from the particular user;

wherein ranking the user attributes of the pool of user attributes includes;

applying, based on the value of the static attribute, a set of policies to the user attributes of the pool of user attributes to produce a set of illegal attributes, each illegal attribute of the set of illegal attributes belonging to the pool of user attributes; and

removing the illegal attributes of the set of illegal attributes from the ranked list of attributes to form a ranked list of legal attributes; and

wherein N is a number less than the number of attributes in the ranked list of legal attributes.

3. A method according to claim 1, wherein ranking the user attributes of the pool of user attributes includes:

forming a fourfold table for each user attribute of the pool of user attributes, entries of the fourfold table representing probabilities of, respectively, (a) authentication given actual user, (b) authentication given fraudulent user, (c) no authentication given actual user, and (d) no authentication given fraudulent user;

wherein ranking the user attributes of the pool of user attributes further includes;

generating, for each user attribute of the pool of user attributes, an odds ratio equal to a ratio of the product of the probabilities (a) and (d) to the product of the probabilities (b) and (c); and

sorting the pool of user attributes by the odds value assigned to each user attribute of the pool of user attributes to form a sorted pool of user attributes.

4. A method according to claim 3, wherein picking the first N user attributes of the ranked list of user attributes as the set of user attributes includes:

generating a pooled odds ratio of the first k user attributes of the sorted pool of user attributes, k being a number that is between one and the number of user attributes in the pool of user attributes, the pooled odds ratio being a ratio of a sum of the product of the probabilities (a) and (d) for each of the first k user attributes to a sum of the product of the probabilities (b) and (c) for each of the first k user attributes; and

selecting, as the number N, the smallest value of k such that the pooled odds ratio is greater than a threshold pooled odds ratio.

5. A system constructed and arranged to tailor a challenge activity to a particular user, the challenge activity being a part of an authentication procedure which is constructed and arranged to authenticate users based on multiple authentication factors, the system comprising:

a network interface;

a memory; and

a controller which includes controlling circuitry coupled to the memory, the controlling circuitry being constructed and arranged to;

identify traits of the particular user from electronic input received from the particular user, the identified traits distinguishing the particular user among users of a user population;

select a set of user attributes from a pool of user attributes based on the identified traits of the particular user, each user attribute being an objectively measurable feature of a user of the user population; and

incorporate the set of user attributes into the challenge activity;

wherein each identified trait of the particular user is a value of a user attribute of the pool of user attributes for the particular user, the user attribute corresponding to the identified trait;

wherein identifying traits of the particular user includes;

performing a comparison operation on the value of the user attribute for the particular user to which that identified trait corresponds and a value of the user attribute for the user population, results of the comparison operation being used to identify distinguishing traits of the particular user;

wherein the value of the user attribute for the user population is equal to a mean value of the user attribute across the user population;

wherein performing the comparison operation includes;

generating a comparison value based on the value of the user attribute for the particular user and the mean value of the user attribute across the user population; and

assessing whether the comparison value satisfies a predetermined set of criteria;

wherein assessing whether the difference satisfies a predetermined set of criteria;

ranking, in descending order, the user attributes of the pool of user attributes according to the difference between the value of the user attribute and the mean value of the user attribute across the user population for each user attribute of the pool of user attributes to produce a ranked list of user attributes; and

wherein selecting the set of user attributes from the pool of user attributes based on the identified traits of the particular user includes;

picking the first N user attributes of the ranked list of user attributes as the set of user attributes, N being a number less than the number of user attributes in the pool of user attributes.

6. A system according to claim 5, wherein at least one user attribute of the pool of user attributes is a static attribute having a value that does not change with the electronic input from the particular user;

wherein ranking the user attributes of the pool of user attributes includes;

applying, based on the value of the static attribute, a set of policies to the user attributes of the pool of user attributes to produce a set of illegal attributes, each illegal attribute of the set of illegal attributes belonging to the pool of user attributes; and

removing the illegal attributes of the set of illegal attributes from the ranked list of attributes to form a ranked list of legal attributes; and

wherein N is a number less than the number of attributes in the ranked list of legal attributes.

7. A system according to claim 5, wherein ranking the user attributes of the pool of user attributes includes:

forming a fourfold table for each user attribute of the pool of user attributes, entries of the fourfold table representing probabilities of, respectively, (a) authentication given actual user, (b) authentication given fraudulent user, (c) no authentication given actual user, and (d) no authentication given fraudulent user;

wherein ranking the user attributes of the pool of user attributes further includes;

generating, for each user attribute of the pool of user attributes, an odds ratio equal to a ratio of the product of the probabilities (a) and (d) to the product of the probabilities (b) and (c); and

sorting the pool of user attributes by the odds value assigned to each user attribute of the pool of user attributes to form a sorted pool of user attributes.

8. A system according to claim 7, wherein picking the first N user attributes of the ranked list of user attributes as the set of user attributes includes:

generating a pooled odds ratio of the first k user attributes of the sorted pool of user attributes, k being a number that is between one and the number of user attributes in the pool of user attributes, the pooled odds ratio being a ratio of a sum of the product of the probabilities (a) and (d) for each of the first k user attributes to a sum of the product of the probabilities (b) and (c) for each of the first k user attributes; and

selecting, as the number N, the smallest value of k such that the pooled odds ratio is greater than a threshold pooled odds ratio.

9. A computer program product having a non-transitory, computer-readable storage medium which stores code to tailor a challenge activity to a particular user, the code including instructions to:

identify traits of the particular user from electronic input received from the particular user, the identified traits distinguishing the particular user among users of a user population;

select a set of user attributes from a pool of user attributes based on the identified traits of the particular user, each user attribute being an objectively measurable feature of a user of the user population; and

incorporate the set of user attributes into the challenge activity;

wherein each identified trait of the particular user corresponds to a value of a user attribute of the pool of user attributes;

wherein identifying traits of the particular user includes;

performing a comparison operation on the value of the user attribute for the particular user to which that identified trait corresponds and a value of the user attribute for the user population, results of the comparison operation being used to identify distinguishing traits of the particular user;

wherein the value of the user attribute for the user population is equal to a mean value of the user attribute across the user population;

wherein performing the comparison operation includes;

generating a comparison value based on the value of the user attribute for the particular user and the mean value of the user attribute across the user population; and

assessing whether the comparison value satisfies a predetermined set of criteria;

wherein assessing whether the comparison value satisfies the predetermined set of criteria;

ranking, in descending order, the user attributes of the pool of user attributes according to the difference between the value of the user attribute and the mean value of the user attribute across the user population for each user attribute of the pool of user attributes to produce a ranked list of user attributes; and

wherein selecting the set of user attributes from the pool of user attributes based on the identified traits of the particular user includes;

picking the first N user attributes of the ranked list of user attributes as the set of user attributes, N being a number less than the number of user attributes in the pool of user attributes.