USER AUTHENTICATION FOR DEVICES WITH TOUCH SENSITIVE ELEMENTS, SUCH AS TOUCH SENSITIVE DISPLAY SCREENS

• US 20100225443A1
• Filed: 01/05/2010
• Published: 09/09/2010
• Est. Priority Date: 01/05/2009
• Status: Active Grant

• Current Assignee: Polytechnic Institute Of New York University (New York University)
• Original Assignee: Polytechnic Institute Of New York University (New York University)
• Inventors: MEMON, Nasir, Topkara, Umut, Bayram, Sevinc, Dirik, Ahmet Emir
• Granted Patent: US 8,941,466 B2
• Time in Patent Office: Days
• US Class Current: 340/5.830
• CPC Class Codes: G05B 2219/36168 Touchscreen
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 3/04883 for inputting data by handwriting, e.g. gesture or text
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

For user authentication, finger touch information from a user is accepted via a touch sensitive element, the finger touch information including at least a time series of finger touch samples that define a trace of the user'"'"'s signature, and each of the finger touch samples including centroid coordinates and non-centroid information, the non-centroid information including at least one of (A) a shape of the finger touch sample, (B) a size of the finger touch sample, (C) an orientation of the finger touch sample, and (D) characteristics of a multi-touch finger touch sample. A similarity of such finger touch samples with previously entered and stored finger touch samples is determined and compared with a threshold for purposes of user authentication.

Claims

1. A computer-implemented method for authenticating a user, the method comprising:

a) accepting, by a computer, finger touch information via a touch sensitive element, the finger touch information including at least a time series of finger touch samples that define a trace of a signature, wherein each of the finger touch samples includes centroid coordinates and non-centroid information, the non-centroid information including at least one of (A) a shape of the finger touch sample, (B) a size of the finger touch sample, (C) an orientation of the finger touch sample, and (D) characteristics of a multi-touch finger touch sample;

b) determining, by the computer system, a similarity between the accepted finger touch information and stored finger touch information previously provided; and

c) authenticating, by the computer system, the user using at least the determined similarity.

2. The computer-implemented method of claim 1, wherein the stored finger touch information previously provided by the user is provided during a registration phase, the registration phase includingprompting, by the computer system, the user to enter their signature a plurality of times via the touch sensitive element using one or more of their fingers;

2) accepting, by the computer system, the user'"'"'s signature the plurality of times requested as finger touch information from the user via the touch sensitive surface,

3) determining, by the computer system, a standard deviation of the plurality of the user'"'"'s signatures accepted; and

4) storing, by the computer system, the accepted finger touch information and the determined standard deviation of the plurality of the user'"'"'s signatures accepted.

3. The computer-implemented method of claim 2, wherein the act of authenticating the user based on the determined similarity of the accepted finger touch information of the user provided and stored finger touch information previously provided by the user during the registration phase includes:

1) determining whether the similarity is above a pass-fail threshold;

2) if similarity is above the pass-fail threshold, authenticating the user; and

3) if the similarly is not above the pass-fail threshold, not authenticating the user.

4. The computer-implemented method of claim 3, further comprising adjusting the pass-fail threshold as a function of at least one of (A) the plurality of the user'"'"'s signatures entered during the registration phase, (B) a location of the computer system, (C) a security level set on the computer system, and (D) biometric information of the user captured by the computer system.

5. The computer-implemented method of claim 1, wherein the act of determining a similarity uses dynamic time warping to measure the similarity.

6. The computer-implemented method of claim 1, wherein the computer system displays the finger touch information input by the user.

7. The computer-implemented method of claim 1, wherein the computer system does not display the finger touch information input by the user.

8. The computer-implemented method of claim 1, wherein the computer system displays a fake signature which does not match the finger touch information input by the user.

9. The computer implemented method of claim 1 wherein the non-centroid information includes characteristics of multi-touch finger touch sample.

10. Apparatus for authenticating a user, the apparatus comprising:

a) at least one processor;

b) a touch sensitive element for receiving finger touch information; and

c) at least one storage device storing program instructions which, when executed by the at least one processor, perform a method including

1) accepting, by a computer, finger touch information via the touch sensitive element, the finger touch information including at least a time series of finger touch samples that define a trace of a signature, wherein each of the finger touch samples includes centroid coordinates and non-centroid information, the non-centroid information including at least one of (A) a shape of the finger touch sample, (B) a size of the finger touch sample, (C) an orientation of the finger touch sample, and (D) characteristics of a multi-touch finger touch sample,

2) determining, by the computer system, a similarity between the accepted finger touch information and stored finger touch information previously provided, and

3) authenticating, by the computer system, the user using at least the determined similarity.

11. The apparatus of claim 10, wherein the stored finger touch information previously provided by the user is provided during a registration phase, the registration phase includingrequesting that the user enter their signature a plurality of times via the a touch sensitive surface using their finger;

2) accepting the user'"'"'s signature the plurality of times requested as finger touch information from the user via the touch sensitive surface, the finger touch information including at least a time series of finger touch coordinates that define a trace of the user'"'"'s signature, wherein each of the finger touch coordinates identifies an area and shape of the touch sensitive surface contacted by the user'"'"'s finger based on the physical characteristic of the user'"'"'s finger and the orientation of the user'"'"'s finger;

3) determining a standard deviation of the plurality of the user'"'"'s signatures accepted; and

4) storing the accepted finger touch information and determined standard deviation of the plurality of the user'"'"'s signatures accepted.