Method and system for providing authentication through aggregate analysis of behavioral and time patterns

• US 9,400,879 B2
• Filed: 11/05/2008
• Issued: 07/26/2016
• Est. Priority Date: 11/05/2008
• Status: Active Grant

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Inventors: Tredoux, Gavan Leonard, Harrington, Steven J.
• Primary Examiner(s): HOFFMAN, BRANDON S
• Application Number:
  US12/265,432
• Publication Number:
  US 20100115610A1
• Time in Patent Office: 2,820 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A method and a system for evaluating identification of a user based on behavioral patterns and time patterns, including an analysis component for analyzing data; an authentication component for authenticating the analyzed data; and a behavioral biometric device for collecting behavioral biometric data related to the user, the authentication component and the analysis component operably connected at least with the behavioral biometric device; wherein the behavioral biometric data is matched against previously obtained or expected behavioral biometric data stored in a first database component of the analysis component in order to progressively, continuously, and incrementally evaluate the identification of the user to determine a confidence factor.

Claims

1. A system for evaluating identification of a user based on behavioral patterns and time patterns, the system comprising:

an analysis component for analyzing;

an authentication component for authenticating the analyzed data; and

a behavioral biometric device for collecting behavioral biometric data comprising textual style characteristics of raw streams of text generated by the user, the behavioral biometric data related to the user, wherein an identification of the user is not known, the authentication component and the analysis component operably connected at least with the behavioral biometric device;

wherein the behavioral biometric data is matched against previously obtained or expected behavioral biometric data stored in a first database component of the analysis component in order to determine an identification of the user, and to progressively, continuously, and incrementally evaluate the trustworthiness of the user to determine a confidence factor, the trustworthiness corresponding to confidence in the identification of the user,

wherein one or more application features or resources has different security classification levels, each security classification level associated with a level of access to the one or more application features or application resources,

wherein the level of access to one or more application features or application resources for the user is matched to the determined confidence factor,

wherein the confidence factor is progressively, continuously, and incrementally increased or decreased based on a timing pattern received from the behavioral biometric device corresponding to a habitual activity of the user; and

wherein the level of access to the one or more application features or application resources for the user is dynamically increased or decreased responsive to the determined confidence factor.

2. The system according to claim 1, wherein the analysis component and the authentication component are connected to a server and the behavioral biometric device is in operable communication with one or more computing devices in a network configuration.

3. The system according to claim 1, wherein the analysis component includes a parameter monitoring component, a parameter comparing component, a user profile component, and the first database component.

4. The system according to claim 1, wherein the authentication component includes a software security component, an access component, and a second database component.

5. The system according to claim 1, wherein a user profile is created based upon the behavioral biometric data that is matched against the previously obtained or expected behavioral biometric data.

6. The system according to claim 1, uncharacteristic deviations detected from the previously obtained or expected behavioral biometric data stored in the first database component of the analysis component trigger a decrease in the level of access to one or more application features or application resources for the user.

7. The system according to claim 1, wherein the different security classification levels are based on the confidence factor associated with each of the one or more application features or application resources.

8. The system according to claim 7, wherein the confidence factor associated with each of the one or more application features or application resources is established to a degree of probability by the analysis component.

9. The system according to claim 7, wherein the habitual activity corresponds to at least one of a time of day accessing an application or a website, an amount of time accessing an application or a website, or a characteristic order of accessing an application or a website, and wherein the level of access to the one or more application features or application resources for the user correspondingly increases or decreases responsive to the confidence factor.

10. The system according to claim 1, wherein the confidence factor is determined by monitoring (i) a specific class of behaviors and (ii) one or more redundant operations in order to create a user profile.

11. The system according to claim 1, wherein uncharacteristic deviations detected from the previously obtained or expected behavioral biometric data stored in the first database component of the analysis component trigger either (i) an automatic revocation of authentication, (ii) set off an alarm, or (iii) initiate further investigation via a plurality of alternative methods.

12. The system according to claim 1, wherein the behavioral biometric data include one or more of the following:

user interface preferences when editing and navigating, file-name patterns, file system browsing habits, web URLs (Uniform Resource Locators) habitually visited, system or software application usage, and keystroke dynamics.

13. The system according to claim 1, wherein the analysis component selectively and empirically chooses desired or suitable behavioral biometric data to evaluate the trustworthiness of the user.

14. A method for evaluating identification of a user based on behavioral patterns and time patterns, the method comprising the steps of:

analyzing data;

authenticating the analyzed data; and

collecting behavioral biometric data comprising textual style characteristics of raw streams of text generated by the user, the behavioral biometric data related to the user, wherein an identification of the user is not known;

wherein the behavioral biometric data is matched against previously obtained or expected behavioral biometric data in order to determine an identification of the user and to progressively, continuously, and incrementally evaluate the trustworthiness of the user to determine a confidence factor, the trustworthiness corresponding to confidence in the identification of the user,

wherein one or more application features or application resources has different security classification levels, each security classification level associated with a level of access to the one or more application features or application resources,

wherein the level of access to one or more application features or application resources for the user is matched to the determined confidence factor,

wherein the confidence factor is progressively, continuously, and incrementally increased or decreased based on a timing pattern received from the behavioral biometric device corresponding to a habitual activity of the user, and

wherein the level of access to the one or more application features or application resources for the user is dynamically increased or decreased responsive to the determined confidence factor.

15. The method according to claim 14, wherein a user profile is created based upon the behavioral biometric data that is matched against the previously obtained or expected behavioral biometric data.

16. The method according to claim 14, wherein uncharacteristic deviations detected from the previously obtained or expected behavioral biometric data stored in the first database component of the analysis component trigger a decrease in the level of access to one or more application features or application resources for the user.

17. The method according to claim 14, wherein the different security classification levels are based on the confidence factor associated with each of the one or more application features or application resources.

18. The method according to claim 17, wherein the confidence factor associated with each of the one or more application features or application resources is established to a degree of probability.

19. The method according to claim 17, wherein the habitual activity corresponds to at least one of a time of day accessing an application or a website, an amount of time accessing an application or a website, or a characteristic order of accessing an application or a website, and wherein the level of access to the one or more application features or application resources for a user correspondingly increases or decreases responsive to the confidence factor.

20. The method according to claim 14, wherein the confidence factor is determined by monitoring (i) a specific class of behaviors and (ii) one or more redundant operations in order to create a user profile.

21. The method according to claim 14, wherein uncharacteristic deviations detected from the previously obtained or expected behavioral biometric data triggers either (i) an automatic revocation of authentication, (ii) set off an alarm, or (iii) initiate further investigation via a plurality of alternative methods.

22. The method according to claim 14, wherein the behavioral biometric data include one or more of the following:

user interface preferences when editing and navigating, file-name patterns, file system browsing habits, web URLs (Uniform Resource Locators) habitually visited, system or software application usage, and keystroke dynamics.

23. A computer program product comprising a non-transitory recording medium storing a set of programmable instructions configured for execution by at least one processor for evaluating identification of a user based on behavioral patterns and time patterns, which when executed by the at least one processor, causes the processor to perform the steps of:

analyzing data;

authenticating the analyzed data; and

collecting behavioral biometric data comprising textual style characteristics of raw streams of text generated by the user, the behavioral biometric data related to the user, wherein an identification of the user is not known;

wherein the behavioral biometric data is matched against previously obtained or expected behavioral biometric data in order to determine an identification of the user and to progressively, continuously, and incrementally evaluate the trustworthiness of the user to determine a confidence factor, the trustworthiness corresponding to confidence in the identification of the user,

wherein one or more application features has different security classification levels, each security classification level associated with a level of access to the one or more application features,

wherein the level of access to one or more application features for the user is matched to the determined confidence factor, and

wherein the level of access to the one or more application features for the user is dynamically increased or decreased responsive to the determined confidence factor.