Conditional behavioral biometrics

• US 10,719,765 B2
• Filed: 06/24/2016
• Issued: 07/21/2020
• Est. Priority Date: 06/25/2015
• Status: Active Grant

• Current Assignee: Biocatch Ltd.
• Original Assignee: Biocatch Ltd.
• Inventors: Novik, Alesis, Sutas, Andrius
• Primary Examiner(s): Pwu, Jeffrey C
• Assistant Examiner(s): Truong, Thong P
• Application Number:
  US15/192,845
• Publication Number:
  US 20170177999A1
• Time in Patent Office: 1,488 Days
• CPC Class Codes: G06F 18/23 Clustering techniques
• CPC Class Codes: G06F 18/24323 Tree-organised classifiers
• CPC Class Codes: G06F 18/256 of results relating to different input data, e.g. multimodal recognition
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06N 3/126 Evolutionary algorithms, e.g. genetic algorithms or genetic programming
• CPC Class Codes: G06V 40/70 Multimodal biometrics, e.g. combining information from different biometric modalities

Abstract

The present invention relates to an improved method of providing identification of a user or authentication of a user'"'"'s identity. More particularly, the present invention relates to an improved method of providing identification of a user or authentication of a user'"'"'s identity using conditional behavioural biometrics.

The present invention seeks to provide an enhanced method of authenticating and/or identifying a user identity using conditional behavioural biometrics.

According to a first aspect of the present invention, there is provided a method of generating a user profile for use in identifying and/or authenticating a user on a device, the device equipped with one or more sensors, the method comprising: generating a set of data points from sensory data collected by the one or more sensors; clustering the set of data points to produce a set of data clusters; developing a first classifier for the data clusters, the first classifier being operable to assign a further data point derived from a further user interaction with the computing device to one of the data clusters; and developing one or more further classifiers for at least one of the data clusters, the further classifier operable to identify and/or authenticate a user identity based on the further data point.

Claims

1. A method comprising:

(a) monitoring touch-screen gestures of a user, that interacts with an online service via a touch-screen of a computing device, across multiple usage sessions;

(b) monitoring acceleration and tilt of said computing device, during said touch-screen gestures;

(c) extracting data-points from the monitoring performed in step (a) and from the monitoring performed in step (b);

(d) performing classification of said data-points, and generating a user-specific profile that indicates a characterizing acceleration and a characterizing tilt of the computing device during said touch-screen gestures;

(e) subsequently, monitoring touch-screen gestures that are performed via the touch-screen of the computing device during access to said online service; and

monitoring accompanying acceleration and tilt of said computing device;

(f) extracting data-points from information monitored in step (e);

(g) analyzing the data-points extracted in step (f), and checking whether said data-points match said user-specific profile generated in step (d);

(h) if the checking of step (g) has a negative result, then;

generating a notification that a user that interacted in step (e) with the computing device to access said online service, is different from the user that interacted in step (a) with the computing device to access said online service;

wherein the generating of step (h) is further based on;

determining that a first characteristic of landscape/portrait device orientation during touch-screen gestures monitored on the computing device in step (a), is different from a second characteristic of landscape/portrait device orientation during touch-screen gestures monitored on the computing device in step (e).

2. The method of claim 1,

wherein the computing device is a device selected from the group consisting of:

a laptop computer, a personal computer, a desktop computer, a mobile computing device, a mobile telephone, a tablet.

3. The method of claim 1, comprising:

utilizing user interactions with the computing device to authenticate the user identity without requiring the user to input any security data, by collecting and monitoring sensory data in the background on the computing device.

4. The method of claim 1, comprising:

utilizing user interactions with the computing device to authenticate the user identity without requiring the user to input any security data, by collecting and monitoring sensory data in the background on the computing device;

wherein, if behavioral biometrics continue to classify the user as an authorized user, then the method does not require the user to provide any password or PIN or fingerprint and the method comprises performing user authentication in the background;

wherein, if said behavioral biometrics fail to continue to classify the user as the authorized user, then the method comprises asking the user to enter further security information.

5. A method comprising:

(a) monitoring touch-screen gestures of a user, that interacts with an online service via a touch-screen of a computing device, across multiple usage sessions;

(b) monitoring acceleration and tilt of said computing device, during said touch-screen gestures;

(c) extracting data-points from the monitoring performed in step (a) and from the monitoring performed in step (b);

(d) performing classification of said data-points, and generating a user-specific profile that indicates a characterizing acceleration and a characterizing tilt of the computing device during said touch-screen gestures;

(e) subsequently, monitoring touch-screen gestures that are performed via the touch-screen of the computing device during access to said online service; and

monitoring accompanying acceleration and tilt of said computing device;

(f) extracting data-points from information monitored in step (e);

(g) analyzing the data-points extracted in step (f), and checking whether said data-points match said user-specific profile generated in step (d);

(h) if the checking of step (g) has a negative result, then;

generating a notification that a user that interacted in step (e) with the computing device to access said online service, is different from the user that interacted in step (a) with the computing device to access said online service;

wherein generating said user-specific profile comprises;

generating a user-specific profile that is based on at least;

(i) a characteristic of background tremor of the computing device during monitored touch-screen gestures, and

(ii) a characteristic of curvature of monitored touch-screen gestures, and

(iii) a characteristic of landscape/portrait device orientation during monitored touch-screen gestures.

6. The method of claim 5,

wherein the computing device is a device selected from the group consisting of:

a laptop computer, a personal computer, a desktop computer, a mobile computing device, a mobile telephone, a tablet.

7. The method of claim 5, comprising:

utilizing user interactions with the computing device to authenticate the user identity without requiring the user to input any security data, by collecting and monitoring sensory data in the background on the computing device.

8. The method of claim 5, comprising:

utilizing user interactions with the computing device to authenticate the user identity without requiring the user to input any security data, by collecting and monitoring sensory data in the background on the computing device;

wherein, if behavioral biometrics continue to classify the user as an authorized user, then the method does not require the user to provide any password or PIN or fingerprint and the method comprises performing user authentication in the background;

wherein, if said behavioral biometrics fail to continue to classify the user as the authorized user, then the method comprises asking the user to enter further security information.

9. A method comprising:

(a) monitoring touch-screen gestures of a user, that interacts with an online service via a touch-screen of a computing device, across multiple usage sessions;

(b) monitoring acceleration and tilt of said computing device, during said touch-screen gestures;

(c) extracting data-points from the monitoring performed in step (a) and from the monitoring performed in step (b);

(d) performing classification of said data-points, and generating a user-specific profile that indicates a characterizing acceleration and a characterizing tilt of the computing device during said touch-screen gestures;

(e) subsequently, monitoring touch-screen gestures that are performed via the touch-screen of the computing device during access to said online service; and

monitoring accompanying acceleration and tilt of said computing device;

(f) extracting data-points from information monitored in step (e);

(g) analyzing the data-points extracted in step (f), and checking whether said data-points match said user-specific profile generated in step (d);

(h) if the checking of step (g) has a negative result, then;

generating a notification that a user that interacted in step (e) with the computing device to access said online service, is different from the user that interacted in step (a) with the computing device to access said online service;

wherein generating said user-specific profile comprises;

generating a user-specific profile that is based on at least;

(i) a characteristic of background tremor of the computing device during monitored touch-screen gestures, and

(ii) a characteristic of curvature of monitored touch-screen gestures, and

(iii) a characteristic of landscape/portrait device orientation during monitored touch-screen gestures, and

(iv) a characteristic of touch-location coordinates of monitored touch-screen gestures, and

(v) a characteristic of touch-pressure of monitored touch-screen gestures.

10. The method of claim 9,

wherein the computing device is a device selected from the group consisting of:

a laptop computer, a personal computer, a desktop computer, a mobile computing device, a mobile telephone, a tablet.

11. The method of claim 9, comprising:

utilizing user interactions with the computing device to authenticate the user identity without requiring the user to input any security data, by collecting and monitoring sensory data in the background on the computing device.

12. The method of claim 9, comprising:

utilizing user interactions with the computing device to authenticate the user identity without requiring the user to input any security data, by collecting and monitoring sensory data in the background on the computing device;

wherein, if behavioral biometrics continue to classify the user as an authorized user, then the method does not require the user to provide any password or PIN or fingerprint and the method comprises performing user authentication in the background;

wherein, if said behavioral biometrics fail to continue to classify the user as the authorized user, then the method comprises asking the user to enter further security information.