System and method for eye tracking during authentication

• US 9,898,596 B2
• Filed: 03/18/2014
• Issued: 02/20/2018
• Est. Priority Date: 03/22/2013
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Lindemann, Rolf
• Primary Examiner(s): Scott, Randy
• Application Number:
  US14/218,551
• Publication Number:
  US 20140289834A1
• Time in Patent Office: 1,435 Days
• Field of Search: 726 5, 726 2, 726 7, 726 12, 713185, 713186, 713188
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/3274 using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 : using key encryption key
• CPC Class Codes: H04L 9/0841 : involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3297 : involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/065 : Continuous authentication

Abstract

A system, apparatus, method, and machine readable medium are described for performing eye tracking during authentication. For example, one embodiment of a method comprises: receiving a request to authenticate a user; presenting one or more screen layouts to the user; capturing a sequence of images which include the user'"'"'s eyes as the one or more screen layouts are displayed; and (a) performing eye movement detection across the sequence of images to identify a correlation between motion of the user'"'"'s eyes as the one or more screen layouts are presented and an expected motion of the user'"'"'s eyes as the one or more screen layouts are presented and/or (b) measuring the eye'"'"'s pupil size to identify a correlation between the effective light intensity of the screen and its effect on the user'"'"'s eye pupil size.

Claims

1. A method comprising:

receiving a request to authenticate a user;

presenting a plurality of screen layouts to the user;

capturing a sequence of images which include the user'"'"'s eyes as the plurality of screen layouts are displayed;

(a) performing eye movement detection across the sequence of images to identify a correlation between motion of the user'"'"'s eyes as the plurality of screen layouts are presented and an expected motion of the user'"'"'s eyes as the plurality of screen layouts are presented and/or (b) measuring the user'"'"'s eye pupil size across the sequence of images to identify a correlation between the effective light intensity of the plurality of screen layouts presented to the user and its effect on the user'"'"'s eye pupil size;

performing facial recognition to identify a correlation between one or more images of the user'"'"'s face and facial template data associated with the user; and

generating an assurance level based on the correlation between the images of the user'"'"'s face and facial template data associated with the user, and the correlation between the motion of the user'"'"'s eyes and an expected motion of the user'"'"'s eyes as the plurality of screen layouts are presented and/or the correlation between the effective light intensity of the plurality of screen layouts presented to the user and its effect on the user'"'"'s eye pupil size.

2. The method as in claim 1 wherein presenting the plurality of screen layouts comprises displaying one or more graphics images, photographs, or motion video images in designated regions of the display, wherein the expected motion characteristic of the user'"'"'s eyes depends on the contents, the size, the appearance, the context and the region where these elements are shown.

3. The method as in claim 2 wherein facial recognition is performed first, resulting in a first correlation and eye movement detection is performed only if the facial recognition results in a correlation above a specified threshold.

4. The method as in claim 2 wherein the designated regions of the display for displaying the graphics images, photographs, or motion video images are selected randomly.

5. The method as in claim 2 wherein presenting the plurality of screen layouts comprises displaying a plurality of graphics images, photographs, or motion video images in a specified sequence using a specified timing.

6. The method as in claim 1 further comprising:

determining whether the assurance level is sufficient to authenticate the user for a particular transaction; and

permitting the transaction if the assurance level is sufficient.

7. The method as in claim 6 wherein the transaction is an online transaction with a remote relying party.

8. The method as in claim 6 further comprising:

if the assurance level is not sufficient by itself to authenticate the user for a particular transaction, then combining the assurance level with authentication data generated using one or more additional authentication techniques to authenticate the user for the particular transaction.

9. The method as in claim 8 wherein one of the additional authentication techniques comprises performing an explicit authentication in which the end user is required to enter a password or PIN or to swipe a finger on a fingerprint authentication device.

10. The method as in claim 8 wherein one of the additional authentication techniques comprises one or more non-intrusive authentication techniques in which sensor data collected from one or more device sensors is used for authentication.

11. The method as in claim 10 wherein the sensor data comprises location data.

12. The method as in claim 10 wherein one of the non-intrusive techniques comprises determining elapsed time from the last explicit user authentication and responsively increasing the assurance level of explicit user authentication has occurred within a specified time period.

13. The method as in claim 1 wherein the expected motion of the user'"'"'s eyes is based on learned characteristics of eye-movement triggered by different types of images.

14. An apparatus comprising:

an authentication engine receiving a request to authenticate a user;

a camera capturing a sequence of images which include the user'"'"'s eyes as a plurality of screen layouts are displayed;

an eye tracking hardware module (a) performing eye movement detection across the sequence of images to identify a correlation between motion of the user'"'"'s eyes as the plurality of screen layouts are presented and an expected motion of the user'"'"'s eyes as the plurality of screen layouts are presented and/or (b) measuring the user'"'"'s eye pupil size across the sequence of images to identify a correlation between the effective light intensity of the plurality of screen layouts presented to the user and its effect on the user'"'"'s eye pupil size;

a facial recognition device to perform facial recognition to identify a correlation between one or more images of the user'"'"'s face and facial template data associated with the user; and

the authentication engine generating an assurance level based on the correlation between the images of the user'"'"'s face and facial template data associated with the user, and the correlation between the motion of the user'"'"'s eyes and an expected motion of the user'"'"'s eyes as the plurality of screen layouts are presented and/or the correlation between the effective light intensity of the plurality of screen layouts presented to the user and its effect on the user'"'"'s eye pupil size.

15. The apparatus as in claim 14 wherein presenting the plurality of screen layouts comprises displaying one or more graphics images, photographs, or motion video images in designated regions of the display, wherein the expected motion of the user'"'"'s eyes is in the direction of the graphics images, photographs, or motion video images to different degrees.

16. The apparatus as in claim 15 wherein facial recognition is performed first, resulting in a first correlation and eye movement detection is performed only if the facial recognition results in a correlation above a specified threshold.

17. The apparatus as in claim 15 wherein the designated regions of the display for displaying the graphics images, photographs, or motion video images are selected randomly.

18. The apparatus as in claim 15 wherein presenting the plurality of screen layouts comprises displaying a plurality of graphics images, photographs, or motion video images in a specified sequence using a specified timing.

19. The apparatus as in claim 14 further comprising:

the authentication engine determining whether the assurance level is sufficient to authenticate the user for a particular transaction; and

permitting the transaction if the assurance level is sufficient.

20. The apparatus as in claim 18 wherein the transaction is an online transaction with a remote relying party.

21. The apparatus as in claim 19 further comprising:

the authentication engine combining the assurance level with authentication data generated using one or more additional authentication techniques to authenticate the user for the particular transaction if the assurance level is not sufficient by itself to authenticate the user for a particular transaction.

22. The apparatus as in claim 19 wherein one of the additional authentication techniques comprises performing an explicit authentication in which the end user is required to enter a password or PIN or to swipe a finger on a fingerprint authentication device.

23. The apparatus as in claim 22 wherein one of the additional authentication techniques comprises one or more non-intrusive authentication techniques in which sensor data collected from one or more device sensors is used for authentication.

24. The apparatus as in claim 23 wherein the sensor data comprises location data.

25. The apparatus as in claim 23 wherein one of the non-intrusive techniques comprises determining elapsed time from the last explicit user authentication and responsively increasing the assurance level of explicit user authentication has occurred within a specified time period.

26. The apparatus as in claim 14 wherein the expected motion of the user'"'"'s eyes is based on learned characteristics of eye-movement triggered by different types of images.