Systems and methods for authenticating a user through an unobservable re-authentication system

• US 9,996,803 B2
• Filed: 09/03/2014
• Issued: 06/12/2018
• Est. Priority Date: 09/03/2013
• Status: Active Grant

• Current Assignee: Arizona Board of Regents (University of Arizona)
• Original Assignee: Arizona Board of Regents (University of Arizona)
• Inventors: Li, Lingjun, Zhao, Xinxin, Xue, Guoliang
• Primary Examiner(s): Chen, Alan S
• Application Number:
  US14/476,364
• Publication Number:
  US 20150066822A1
• Time in Patent Office: 1,378 Days
• Field of Search: None
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 3/0488 using a touch-screen or digitiser, e.g. input of commands through traced gestures
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer

Abstract

Systems and methods for authenticating a user through an unobservable re-authentication process are disclosed.

Claims

1. A method to authenticate a user of a device through an unobservable authentication process, the method comprising:

accessing first gesture data associated with an authorized owner;

implementing a training module to apply machine learning to the first gesture data, comprising

extracting features from the first gesture data, and

generating a plurality of classification modules from the first gesture data;

capturing second gesture data related to a user'"'"'s interaction with the device;

implementing a first instance of an authentication module to authenticate whether the second gesture data is associated with the authorized owner, comprising

extracting user features from the second gesture data,

forming a feature vector from the user features of the second gesture data,

selecting a classification module from the plurality of classification modules based upon the feature vector,

predicting whether the second gesture data is associated with the authorized owner by processing the feature vector with the classification module; and

continuously authenticating the user based on the user'"'"'s interaction with a content displayed by the device through the authentication module to determine if the user is the authorized owner,

wherein authenticating the user is automatic and does not require specific prompts to the user.

2. The method of claim 1, further comprising:

accessing a plurality of other people'"'"'s gesture feature data to the device for comparison with the gesture data features,

wherein the second gesture data is associated with finger sliding gestures, and,

wherein the classification module is associated with a unique gesture type.

3. The method of claim 2, wherein the classification module further comprises a file containing parameters for a classification algorithm.

4. The method of claim 2, wherein the classification module is generated by the training module, the training module is further deployed on a computer.

5. The method of claim 1, wherein the second gesture data comprises at least one of:

directional swiping motions, or

tapping motions.

6. The method of claim 1, further comprising:

implementing a second instance of the authentication module to authenticate whether third gesture data is associated with the authorized owner, comprising

extracting additional user features from the third gesture data,

forming an additional feature vector from the additional user features of the third gesture data,

selecting another classification module from the plurality of classification modules based upon the additional feature vector, and

predicting whether the third gesture data is associated with the authorized owner by processing the additional feature vector with the another classification module.

7. The method of claim 1, further comprising:

generating metrics values associated with the second gesture data for comparison with the first gesture data using a plurality of metrics, comprising;

identifying coordinates of a plurality of points associated with a sliding finger gesture across the device as defined by the second gesture data, the plurality of points including a starting point; and

generating a first metric value of the metrics values for the sliding finger gesture using a moving distance metric defined by a summation of distances between every two continuous points of the plurality of points.

8. The method of claim 7, wherein the generating of the metrics values associated with the second gesture data for comparison with the first gesture data further comprises:

generating a second metric value of the metrics values for the sliding finger gesture using an average moving direction metric defined by an average value of all of the plurality of points'"'"' moving directions except for a last point of the plurality of points,

wherein the feature vector comprises an average of the metric values associated with the second gesture data.

9. A method to authenticate an authorized owner of a smartphone, the method comprising;

collecting authorized owner data associated with an authorized owner of a smartphone;

capturing user data associated with a user'"'"'s interaction with the smartphone;

determining whether the user data is associated with the authorized owner,

comprising

extracting features from the user data,

forming a feature vector from the features of the user data,

selecting a classification module based upon the feature vector,

predicting whether the user data is associated with the authorized owner by processing the feature vector with the classification module;

continuously capturing additional user data related to the user'"'"'s interaction with the smartphone; and

wherein authenticating the user is automatic and does not require specific prompts for user interaction with the smartphone.

10. The method of claim 9, wherein the authorized owner data is collected from a training module or from the authorized owner'"'"'s interaction with the smartphone, the training module further comprising:

obtaining a plurality of classification modules, wherein the classification modules represent a specific gesture feature data;

downloading the feature data of other people to be used as a comparison tool;

uploading the authorized owner'"'"'s gesture feature data to a server; and

downloading the gesture feature data from the server to a computer device.

11. The method of claim 9, wherein the user data comprises at least one of a hand, finger, facial, or speech action.