User authentication for devices with touch sensitive elements, such as touch sensitive display screens

• US 8,941,466 B2
• Filed: 01/05/2010
• Issued: 01/27/2015
• Est. Priority Date: 01/05/2009
• Status: Active Grant

• Current Assignee: Polytechnic Institute Of New York University (New York University)
• Original Assignee: Polytechnic Institute Of New York University (New York University)
• Inventors: Bayram, Sevinc, Dirik, Ahmet Emir, Memon, Nasir, Topkara, Umut
• Primary Examiner(s): Mehmood, Jennifer
• Assistant Examiner(s): POINT, RUFUS C
• Application Number:
  US12/652,654
• Publication Number:
  US 20100225443A1
• Time in Patent Office: 1,848 Days
• Field of Search: 340/5.51, 340/5.52, 340/5.82, 341/71, 341/41, 713/186, 713/182
• US Class Current: 340/5.82
• CPC Class Codes: G05B 2219/36168 Touchscreen
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 3/04883 for inputting data by handwriting, e.g. gesture or text
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

For user authentication, finger touch information from a user is accepted via a touch sensitive element, the finger touch information including at least a time series of finger touch samples that define a trace of the user'"'"'s signature, and each of the finger touch samples including centroid coordinates and non-centroid information, the non-centroid information including at least one of (A) a shape of the finger touch sample, (B) a size of the finger touch sample, (C) an orientation of the finger touch sample, and (D) characteristics of a multi-touch finger touch sample. A similarity of such finger touch samples with previously entered and stored finger touch samples is determined and compared with a threshold for purposes of user authentication.

Claims

1. A computer-implemented method for authenticating a user, the method comprising:

a) receiving, by a computer system, finger touch information via a touch sensitive element, the finger touch information including at least a time series of finger touch samples that define a trace of a signature, at least a portion of which includes a continuous touch gesture during which at least one fingertip is always in contact with the touch sensitive element;

b) determining, by the computer system, a similarity between the time series of finger touch samples of the received finger touch information and stored finger touch information including a time series of finger touch samples previously provided by the user; and

c) authenticating, by the computer system, the user using at least the determined similarity by

1) receiving the stored finger touch information previously provided by the user,

2) determining a location of the computer system,

3) receiving a pass-fail threshold,

4) adjusting the pass-fail threshold as a function of the determined location of the computer system,

5) determining whether the similarity is above the adjusted pass-fail threshold; and

6) responsive to a determination that the similarity is above the adjusted pass-fail threshold, authenticating the user, and otherwise, responsive to a determination that the similarly is not above the adjusted pass-fail threshold, not authenticating the user.

2. The computer-implemented method of claim 1, wherein the stored finger touch information previously provided by the user is provided during a registration phase, the registration phase includingprompting, by the computer system, the user to enter their signature a plurality of times via the touch sensitive element using one or more of their fingers;

2) receiving, by the computer system, the user'"'"'s signature the plurality of times requested as finger touch information from the user via the touch sensitive surface,

3) determining, by the computer system, a standard deviation of the plurality of the user'"'"'s signatures received; and

4) storing, by the computer system, the received finger touch information and the determined standard deviation of the plurality of the user'"'"'s signatures received.

3. The computer-implemented method of claim 1, wherein the act of determining a similarity uses dynamic time warping to measure the similarity.

4. The computer-implemented method of claim 1, wherein the computer system displays the finger touch information input by the user.

5. The computer-implemented method of claim 1, wherein the computer system does not display the finger touch information input by the user.

6. The computer-implemented method of claim 1, wherein when the user enters an authenticated signature, the computer system displays a fake signature which does not match the finger touch information input by the user.

7. The computer implemented method of claim 1 wherein each of the finger touch samples includes centroid coordinates and non-centroid information of a single finger, the non-centroid information including at least one of (A) a shape of the single finger of the finger touch sample, (B) a size of the single finger of the finger touch sample, and (C) an orientation of the single finger of the finger touch sample, and

wherein the non-centroid information includes characteristics of multi-touch finger touch sample.

10. The computer-implemented method of claim 1, further comprising adjusting the pass-fail threshold as a function of the plurality of the user'"'"'s signatures entered during the registration phase.

11. The computer-implemented method of claim 1, further comprising adjusting the pass-fail threshold as a function of biometric information of the user captured by the computer system.

12. The computer-implemented method of claim 1, further comprising adjusting the pass-fail threshold as a function of a security level set on the computer system.

13. The computer-implemented method of claim 7, wherein the non-centroid information further includes biometric information of the user captured by the computer system.

14. The computer-implemented method of claim 13, wherein the biometric information of the user captured by the computer system includes at least one of (A) voice recognition information, (B) fingerprint recognition information, and (C) iris recognition information.

15. The computer-implemented method of claim 13, wherein the biometric information of the user captured by the computer system includes at least one of (A) finger pressure information, (B) skin impedance information and (C) finger skin EEG signal information.

16. The computer-implemented method of claim 1, wherein the pass-fail threshold is adjusted to be less stringent when the location of the computer system is within a specified region.

17. The computer-implemented method of claim 1, wherein the pass-fail threshold is adjusted to be less stringent when the location of the computer system is on an approved communication network.

18. The computer-implemented method of claim 1, wherein the stored finger touch information previously provided by the user is provided during a registration phase, the registration phase includingprompting, by the computer system, the user to enter their signature a plurality of times via the touch sensitive element using one or more of their fingers;

2) receiving, by the computer system, the user'"'"'s signature as finger touch information from the user via the touch sensitive surface,

3) determining, by the computer system, that a strength of the signature is below a threshold, and

4) responsive to the determination that the strength of the signature is below a threshold, providing, by the computer system, a message to the user that the signature is too weak.

19. The computer-implemented method of claim 1, wherein the stored finger touch information previously provided by the user is provided during a registration phase, the registration phase includingprompting, by the computer system, the user to enter their signature a plurality of times via the touch sensitive element using one or more of their fingers;

2) receiving, by the computer system, a plurality of the user'"'"'s signature as finger touch information from the user via the touch sensitive surface,

3) determining, by the computer system, that a similarity of the plurality of signatures is below a threshold, and

4) responsive to the determination that the similarity of plurality of signatures is below a threshold, providing, by the computer system, a message to the user that the signatures are too dissimilar.

20. The computer-implemented method of claim 3, wherein the act using dynamic time warping to measure the similarity includesreceiving a plurality of signatures,setting a dynamic time warping threshold by

A) for each of the received plurality of signatures, computing its average similarity to other of the received plurality of signatures,

B) identifying the least similar signature as the one of the plurality of signatures with a lowest computed average similarity, and

C) setting the dynamic time warping threshold based on the identified least similar signature.

8. Apparatus for authenticating a user, the apparatus comprising:

a) at least one processor;

b) a touch sensitive element for receiving finger touch information; and

c) at least one storage device storing program instructions which, when executed by the at least one processor, perform a method including

1) receiving finger touch information via the touch sensitive element , the finger touch information including at least a time series of finger touch samples that define a trace of a signature, at least a portion of which includes a continuous touch gesture during which at least one fingertip is always in contact with the touch sensitive element,

2) determining a similarity between the time series of finger touch samples of the received finger touch information and stored finger touch information including a time series of finger touch samples previously provided by the user, and

3) authenticating, by the computer system, the user using at least the determined similarity by

A) receiving the stored finger touch information previously provided by the user,

B) determining a location of the apparatus,

C) receiving a pass-fail threshold,

D) adjusting the pass-fail threshold as a function of the determined location of the apparatus,

E) determining whether the similarity is above the adjusted pass-fail threshold; and

F) responsive to a determination that the similarity is above the adjusted pass-fail threshold, authenticating the user, and otherwise, responsive to a determination that the similarly is not above the adjusted pass-fail threshold, not authenticating the user.

9. The apparatus of claim 8, wherein the stored finger touch information previously provided by the user is provided during a registration phase, the registration phase including:

1) requesting that the user enter their signature a plurality of times via the a touch sensitive surface using their finger;

2) receiving the user'"'"'s signature the plurality of times requested as finger touch information from the user via the touch sensitive surface;

3) determining a standard deviation of the plurality of the user'"'"'s signatures received; and

4) storing the received finger touch information and determined standard deviation of the plurality of the user'"'"'s signatures received.