Abstract:
The invention provides a method and apparatus for authenticating a user in a touchscreen environment. A first tier may be defined having at least one object, and a destination tier may be defined having at least one bin. An authentication-key may be registered, the authentication-key comprising a length defining a number of nodes and a correct sequence of nodes, each node specifying a movement of one object from the first tier to one bin of the destination tier. A user sequence of at least one touchscreen gestures is received, each gesture specifying that one object from the first tier should be moved to one bin of the destination tier. Access is permitted if the at least one touchscreen gestures corresponds to the length, the correct sequence, and the movement of the authentication-key.

Description:
CLAIM OF PRIORITY 
       [0001]    This application claims priority under 35 U.S.C. §119(a) from Indian Patent Application Serial No. 2806/DEL/2012 filed in the Indian Patent Office on Sep. 10, 2012, the entire disclosure of which is incorporated by reference herein. This application also claims priority under 35 U.S.C. §119(a) to Korean Patent Application Serial No. 10-2013-0093017 filed in the Korean Intellectual Property Office on Aug. 6, 2013, the entire disclosure of which is hereby incorporated by reference. 
       BACKGROUND 
       [0002]    1. Field of the Invention 
         [0003]    The present disclosure relates to a touchscreen-enabled apparatus and a touchscreen-enabled gesture-based authentication method for improving the security of access-restricted computing devices. 
         [0004]    2. Description of the Related Art 
         [0005]    The portable nature of mobile computing devices, such as smartphones, tablet PCs and touch-enabled laptops, has necessitated the development of authentication mechanisms that prevent access to confidential information by denying unauthorized access. As a result, most mobile devices today include some form of authentication mechanism. While traditional systems were configured to utilize keypad input, the inclusion of touchscreen interfaces allows the authentication mechanisms to use touch, gesture and pattern-based input schemes to authenticate users and prevent unauthorized access to the device. More specifically, in a gesture-based authentication system, users may create a pre-defined “unlock” pattern that must be traced on the device screen, sometimes in relation to displayed visual elements. If the user-traced pattern matches with a pre-registered pattern, then the system may allow the user to access the device. 
         [0006]    In another gesture-based authentication mechanism, a user is required to select an object displayed on the touchscreen only once. Thus, the user is restricted to repeatedly selecting the object in successive iterations. Authentication mechanisms such as these are deficient because the number of possible wrong combinations or challenge objects displayed on screen is not of sufficient complexity as to ensure the failure of unauthorized attempts to access the device. As a result, the security level achieved by such gesture or pattern-based authentication mechanisms is low as compared to conventional mechanisms that utilize alpha-numeric authentication (i.e.; passwords or key codes). 
         [0007]    Increasing the complexity of gesture and pattern-based is further compounded by logistical difficulties introduced by the standard size of many mobile devices, such as smartphones. For example, in order to increase the challenge presented by a typical “unlock” pattern, the screen size of the device may have to be increased. This essentially limits the usefulness of this strategy for small screen devices. Moreover, the patterns employed by such strategies are usually simple enough so that a potential unauthorized user who has observed the pattern will be able to gain unauthorized access to the mobile device. Similarly, in the object-based authentication mechanism, if the unauthorized user knows the number of objects to be selected in a pre-pattern, then the total number of trials and challenges presented to the unauthorized user is decreased, increasing the probability that the unauthorized user will gain access to the mobile device. 
       SUMMARY 
       [0008]    In one aspect of the present disclosure, a method apparatus for authenticating a user in a touchscreen environment is provided. A first tier may be defined having at least one object, and a destination tier may be defined having at least one bin. An authentication-key may be registered, the authentication-key comprising a length defining a number of nodes and a correct sequence of nodes, each node specifying a movement of one object from the first tier to one bin of the destination tier. A user sequence of at least one touchscreen gestures is received, each gesture specifying that one object from the first tier should be moved to one bin of the destination tier. Access is permitted if the at least one touchscreen gestures corresponds to the length, the correct sequence, and the specified movement of the authentication-key. 
         [0009]    In another aspect of the present disclosure, a touchscreen apparatus for authenticating a user is provided. The apparatus utilizes a computer process for executing program instructions, a touchscreen display for receiving touch-based user inputs, and computer readable medium carrying program instructions. The program instructions are executable to define a first tier having at least one object, and a destination tier having at least one bin. An authentication-key is registered, the authentication-key comprising a length defining a number of nodes and a correct sequence of nodes, each node specifying a movement of one object from the first tier to one bin of the destination tier. A user sequence is received of at least one touchscreen gestures, each gesture specifying that one object from the first tier should be moved to one bin of the destination tier. Access is allowed if the at least one touchscreen gestures corresponds to the length, the correct sequence, and the specified movement of the authentication-key. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0010]      FIG. 1  is a block diagram illustrating a configuration of a mobile device touchscreen device with a number of modules, according to an embodiment of the present invention; 
           [0011]      FIG. 2  is a flowchart illustrating a method for authenticating a user of the touchscreen device utilizing an authentication-key and multiple tiers, according to an embodiment of the present invention; 
           [0012]      FIG. 3  is a block diagram illustrating an authentication-key utilizing two tiers, in accordance with an embodiment of the present invention; 
           [0013]      FIG. 4  is a block diagram illustrating an authentication-key utilizing one intermediate tier with channels, in accordance with an embodiment of the present invention; 
           [0014]      FIG. 5  is a block diagram illustrating an authentication-key utilizing two intermediate tiers with channels, in accordance with an embodiment of the present invention; 
           [0015]      FIG. 6  is a block diagram illustrating an authentication-key utilizing randomly-ordered objects of both the source tier and the destination tier in accordance with an embodiment of the present invention; and 
           [0016]      FIG. 7  a block diagram illustrating a computing environment implementing an embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0017]    The embodiments herein and the various features and advantageous details thereof are explained more fully with reference to the non-limiting embodiments that are illustrated in the accompanying drawings and detailed in the following description. Descriptions of well-known components and processing techniques are omitted so as to not unnecessarily obscure the embodiments herein. The examples used herein are intended merely to facilitate an understanding of ways in which the embodiments herein can be practiced and to further enable those of skill in the art to practice the embodiments herein. Accordingly, the examples should not be construed as limiting the scope of the embodiments herein. 
         [0018]    The embodiments herein achieve a method and apparatus for gesture-based authentication using objects from multiple classes arranged in multiple tiers. The method enables a touchscreen device to display multiple objects. A user may select, drag, and drop the objects from a source tier objects to destination tier objects through one or more intermediate tier objects. The gesture-based authentication-key (also interchangeably referred to as a “password”) is defined based on the number of objects selected, the sequence in which the objects are selected, and the pathways in which the objects are dragged and dropped through and to intermediary and destination tier objects. The method may allow selection of objects independently of previous iterations, thereby facilitating a very high rejection rate for unauthorized users attempting to gain access to the device. The method described herein exponentially increases the security level with a small increase in the number of objects necessary for implementation of any particular tier. 
         [0019]    The present invention may be applied to a plurality of systems or applications including, but not limited to, other small-screen devices, defense systems, Automated Teller Machines (ATM), door security systems, or any other system that may benefit from the strategy presented herein. Because the method and system is reliant on display of graphical objects, it may be advantageously implemented on touchscreen environments that benefit from elevated degrees of security. Mobile devices, being portable, easily accessible and sometimes shared, may benefit heavily from the method and system described herein. Furthermore, this method and system are advantageously useable by a wide breadth of users, including literate users, illiterate users, or users who would otherwise have difficulty recalling or remembering alphanumeric passwords. Therefore, even children and children&#39;s devices may benefit from the higher degree of security afforded by the graphical gesture-based authentication method and system described herein. The method and system may also be adjustable, facilitate alteration of the security level of the authentication mechanism according to the users requirements. The user may increase or decrease the security level based on alteration of the number of objects and/or the intermediate and destination tiers, thereby altering the complexity of the authentication-key. 
         [0020]    Throughout the description, the term “source tier” and “first tier” is used interchangeably. The term “destination tier” and “second tier” are used interchangeably. The term “gesture” and “pattern” are used interchangeably. The term “touchscreen device” and “touchscreen environment” are used interchangeably. 
         [0021]    Referring now to the drawings (i.e.;  FIGS. 1 through 7 ), where similar reference characters denote corresponding features consistently throughout the figures, these may be used to illustrate consistent features utilized across different embodiments of the present invention. 
         [0022]      FIG. 1  is a block diagram illustrating a configuration of a mobile device touchscreen device or touchscreen environment  100  with a number of modules  104 - 108 , according to an embodiment of the present invention. The touchscreen device  100  described herein may be configured to include a display module  102 , a touch interface module  104 , a storage module  106 , and a communication interface module  108 . The display module  102  of the touchscreen device  100  may be configured to display multiple objects across multiple classes and/or multiple tiers. This display module  102  preferably enables the user to select, drag, and drop the objects during the authentication process. The touch interface module  104  may be configured to extract gesture information based on user inputs to the touchscreen device  100 . The storage module  106  may be computer memory space used to store multiple objects and registered authentication-keys. The storage module  106  may be implemented as internal memory, such as Random Access Memory (RAM), Read Only Memory (ROM), or external memory. The communication interface module  108  may be configured to provide a mechanism for the touchscreen device  100  to communicate with other external devices. 
         [0023]    In one embodiment, the touchscreen device  100  described herein may implemented as a mobile phone, Personal Digital Assistant (PDA), personal computer, handheld device, portable electronic device, communicators, laptop, tablet PC, or any other device that utilizes a touchscreen input mechanism. 
         [0024]    The authentication method for securing the touchscreen device  100  may involve two phases. The first phase is an authorization or registration phase, in which the authentication-key for authenticating users is learned and stored by the touchscreen device  100 . In one embodiment, the authorization or registration phase may be defined as a process of configuring the touchscreen device  100  with a gesture or pattern of the user&#39;s choice, the gesture or pattern being defined by a number of relationships between objects manipulated by the user. The number of objects selected to create the gesture determines the authentication-key length, while the sequence and order of dragging objects from, to and through a number of intermediary and/or destination tier objects determines the components of the authentication-key. The aggregate authorized gesture forms the authentication-key. The second phase is the authentication or verification phase, where the user presents the authorized pattern to gain authorized access to the touchscreen device  100 . 
         [0025]      FIG. 2  is a flowchart illustrating one embodiment of the authentication or verification phase of the present invention, wherein a user of the touchscreen device  100  is authenticated utilizing an authentication-key and multiple destination tiers. At step  202 , the touchscreen device  100  displays multiple objects in multiple tiers, the multiple tiers having at least a first tier, one or more intermediary tiers, and a destination tier. At each tier, there are a number of “objects” or “elements” displayed. At step  204 , the user selects an object from the objects displayed in the first tier. At step  206 , the user drags the selected object from the first tier to the destination tier, passing the selected object through a single object or element at each intermediary tier. In one embodiment, the method allows the touchscreen device  100  to display the multiple predefined intermediate tiers during the authorization process. In one embodiment, the path taken by the dropped object can be displayed visually on the display module  102 , enabling the user to track the path the object has taken. The touchscreen device  100  preferably records the number of objects dragged and dropped from the first tier, the sequence of the dropped objects, and the path taken by the dragged and dropped object from the first tier, through the intermediary tiers, and down to the destination tiers. 
         [0026]    At step  208 , the touchscreen device  100  checks whether the number of objects dragged and dropped by the user matches the authentication-key length. If the number of objects does not match the authentication-key length, then the touchscreen device  100  continues to display the objects and tiers on the display module  102 , enabling the user to complete the authentication sequence. If the number of objects does match the authentication-key length, then at step  210 , the touchscreen device  200  may retrieve the sequence of dragged and dropped objects, and the path taken by each dragged and dropped object from the first tier, through intermediary tiers, down to the destination tiers, and compare the retrieved information to the stored authentication-key. 
         [0027]    At step  212 , if the stored authentication-key does not match the retrieved information, then access to the touchscreen device  100  is denied, and the steps  202 - 212  may be repeated. At step  214 , if the stored authentication-key does match the retrieved information, the user is allowed to access the touchscreen device  100   
         [0028]    It should be noted that various actions performed in the flowchart  200  may be performed in a different order than the order presented. Furthermore, in some embodiments, some actions listed in  FIG. 2  may be omitted entirely, while other actions not presented may be included. 
         [0029]      FIG. 3  is a block diagram illustrating an authentication-key utilizing two tiers, in accordance with an embodiment of the present invention. The two-tiers described herein may include a source tier  300  and a destination tier  302  respectively. In one embodiment, the source tier  300  may include elements, O 1 , O 2 , O 3  and O 4  (referred to herein as “objects”), while the destination tier  302  may include elements B 1 , B 2 , B 3  (referred to herein as “bins”). 
         [0030]    Generally then, the source set O may include multiple elements α (objects) and destination set B can include multiple elements β (bins), and as such, may be described as follows in equations 1 and 2: 
         [0000]        O=O   1   ,O   2   ,O   3   , . . . O   a   (1)
 
         [0000]        B=B   1   ,B   2   ,B   3   , . . . B   β   (2)
 
         [0031]    In one embodiment, authorization of the touchscreen device  100  requires the user to drag and drop an object from the source set O into the bin of the destination set B. For example, the user may drag and drop an object O 1  from the source set O into the bin B 1  The user can repeat the process for different and/or subsequent objects. For each iteration, the selection of an object from the source set O, and the deposition of an object into a bin from the destination set B may be specific to the corresponding selection, and therefore independent from the previous iterations. Thus, the method enables the user to select the objects and deposit them in bins repeatedly. The sequence of selecting objects from the source set O (“i”) and depositing them into particular bins of the destination set B (“j”) may correspond to the authentication-key. Furthermore, the number of objects dropped from the source set O into the bins of the destination set B may provide the authentication key length (“L”). The objects of the source set O can be dropped into bins of destination set B based on the equation given below: 
         [0000]        O   1             B   1 )           K   1,1   1   (3)
 
         [0000]        O   2             B   3 )           K   2,3   2   (4)
 
         [0000]        O   4             B   3 )           K   4,3   3   (5)
 
         [0000]                  (6)
 
         [0000]        O   2             B   1 )           K   2,1   L   (7)
 
         [0032]    The symbol “→” represents the dropping of elements from the source set O to the destination set B. In one example, the q th  iteration of dropping the source set element O i  into the destination element B j  may be represented as K i,j   q . The sequential order K 1,1   1 , K 3,3   2 , K 4,3   3 , . . . , K 2,3   L  may define the authentication-key, where “L” is authentication-key length. 
         [0033]      FIG. 3  explains the process of authentication using two tiers of the objects. In one embodiment, the source tier  300  may include four elements O 1 , O 2 , O 3 , and O 4  (objects), and the destination tier  302  may include three elements B 1 , B 2 , and B 3  (bins). The correct number and sequence/order of objects dropped into the respective bins may constitute the authorized authentication-key. The sequence order as shown in  FIG. 3  for authentication key length where “L”=7 is given in equations below 
         [0000]        O   1             B   1 )           K   1,1   1   (8)
 
         [0000]        O   2             B   3 )           K   2,3   3   (9)
 
         [0000]        O   4             B   3 )           K   4,3   3   (10)
 
         [0000]        O   3             B   2 )           K   3,2   4   (11)
 
         [0000]        O   1             B   2 )           K   1,2   3   (12)
 
         [0000]        O   2             B   1 )           K   2,1   6   (13)
 
         [0000]        O   4             B   3 )           K   4,3   7   (14)
 
         [0034]    The equations 8-14 show actions that must be performed by the user during the authorization process, each equation corresponding to an iteration. During the first iteration (or equation 8), the object O 1  of the source tier  300  was dropped into the bin B 1  of the destination tier  302 . During the second iteration, the object O 2  of the source tier  300  was dropped into the bin B 3  of the destination tier  302 . During the third iteration, the object O 4  of the source tier  300  was dropped into the bin B 3  of the destination tier  302 . During the fourth iteration, the object O 3  of the source tier  300  was dropped into the bin B 2  of the destination tier  302 . During the fifth iteration, the object O 1  of the source tier  300  was dropped into the bin B 2  of the destination tier  302 . During the sixth iteration, the object O 2  of the source tier  300  was dropped into the bin B 1  of the destination tier  302 . During the seventh iteration, the object O 4  of the source tier  300  was dropped into the bin B 3  of the destination tier  302 . In this example, therefore, the authentication-key length “L” is equal to seven, and the authentication-key may be defined as the sequence consisting of K 1,1   1 , K 2,3   2 , K 4,3   3 , K 3,2   4 , K 1,2   5 , K 2,1   6  K 4,3   7 . 
         [0035]    In the present example, during the authentication process, the user drops the objects O 1 , O 2 , O 3 , and O 4  of the source tier  300  into the bins B 1 , B 2 , and B 3  of the destination tier  302  in the same sequence as K 1,1   1 , K 2,3   2 , K 4,3   3 , K 3,2   4 , K 1,2   5 , K 2,1   6  K 4,3   7 , according to the authorized authentication-key. If the user fails to follow the authentication-key sequence order, then the user is preferably denied access to the touchscreen device  100 . If the user successfully enters the correct authentication-key, both in terms of length, sequence, and path, then the user is preferably granted access to the touchscreen device  100 . 
         [0036]    In one embodiment, the objects or elements in the source set  300  and destination set  302  may be represented with fanciful or representative visual elements on the display module  102 . For example, if the device is being used by children, elements in the source tier  300  may be displayed as different fruits, and the elements in the destination tier  302  may be baskets or boxes. In another example, the elements in the source tier  300  may include video clips (or a live video) of various sporting events, and the elements in the destination tier  302  may display the names of these sporting events. The user may then drop the selected video clip to the correct corresponding sporting event. In essence, the elements in the source tier  300  and the destination tier  302  may be any visual element desired, such as, but not limited toys, pets, cages, persons, characters, colors, symbols, etc., a combination thereof, or any other desired element. These elements may be stored in storage module  106  and available for display and selection in, for example, a selectable display gallery on the touchscreen device  100 . 
         [0037]      FIG. 4  illustrates another embodiment of the present invention in which the authentication-key utilizes one intermediate tier  400  with “channels” C 1  and C 2 . The inclusion of an intermediate tier  400  provides enhanced security to the touchscreen device  200  by requiring the usage of one or more intermediate tiers (such as channels C 1 , C 2 , . . . , C ζ ) between the source tier  300  and the destination tier  302 , increasing the complexity of the authentication-key. As described above in the equations 1 and 2, the source set O and the destination set B may include multiple elements. Similarly, each intermediate tier may also include multiple channels. The inclusion of one or more intermediate tiers C 1 , C 2 , . . . , C ζ  may utilize an indefinite number of channels, referred to as γ, δ, . . . , η channels respectively, where τ≧0 and γ, δ, . . . , η&gt;1. 
         [0038]    The generic form of all the elements in all the tiers used by the method described herein during the authentication mechanism is as follows: 
         [0000]    
       
         
           
             
               
                 
                   
                     
                       O 
                       = 
                       
                         O 
                         1 
                       
                     
                     , 
                     
                       O 
                       2 
                     
                     , 
                     
                       
                         O 
                         3 
                       
                        
                       
                           
                       
                        
                       … 
                        
                       
                           
                       
                        
                       
                         O 
                         α 
                       
                     
                   
                    
                   
                     
 
                   
                    
                   
                     α 
                     &gt; 
                     0 
                   
                 
               
               
                 
                   ( 
                   15 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       
                         C 
                         1 
                       
                       = 
                       
                         c 
                         1 
                         1 
                       
                     
                     , 
                     
                       c 
                       1 
                       2 
                     
                     , 
                     … 
                      
                     
                         
                     
                     , 
                     
                       c 
                       1 
                       γ 
                     
                   
                    
                   
                     
 
                   
                    
                   
                     γ 
                     &gt; 
                     1 
                   
                 
               
               
                 
                   ( 
                   16 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       
                         C 
                         2 
                       
                       = 
                       
                         c 
                         2 
                         1 
                       
                     
                     , 
                     
                       c 
                       2 
                       2 
                     
                     , 
                     … 
                      
                     
                         
                     
                     , 
                     
                       c 
                       2 
                       δ 
                     
                   
                    
                   
                     
 
                   
                    
                   
                     δ 
                     &gt; 
                     1 
                   
                 
               
               
                 
                   ( 
                   17 
                   ) 
                 
               
             
             
               
                 
                   ⋮ 
                    
                   
                       
                   
                   = 
                   
                       
                   
                    
                   ⋮ 
                 
               
               
                 
                   ( 
                   18 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       
                         C 
                         τ 
                       
                       = 
                       
                         c 
                         τ 
                         1 
                       
                     
                     , 
                     
                       c 
                       τ 
                       2 
                     
                     , 
                     … 
                      
                     
                         
                     
                     , 
                     
                       c 
                       τ 
                       η 
                     
                   
                    
                   
                     
 
                   
                    
                   
                     
                       η 
                       &gt; 
                       1 
                     
                     , 
                     
                       τ 
                       ≥ 
                       0 
                     
                   
                 
               
               
                 
                   ( 
                   19 
                   ) 
                 
               
             
             
               
                 
                   
                     B 
                     = 
                     
                       B 
                       1 
                     
                   
                   , 
                   
                     B 
                     2 
                   
                   , 
                   
                     B 
                     3 
                   
                   , 
                   
                     
                       … 
                        
                       
                           
                       
                        
                       
                         B 
                         β 
                       
                        
                       β 
                     
                     &gt; 
                     0 
                   
                 
               
               
                 
                   ( 
                   20 
                   ) 
                 
               
             
           
         
       
     
         [0039]    In one example, “L” represents the number of objects dropped from the source tier  300  to the bins in the destination tier  302  via one channel, and the sequence/order of dragging objects from the source tier, through channels of intermediary tiers  400 , and dropping them into the bins of the destination tier  302  forms the authentication key. For example, the q th  iteration of dropping the object O i  from the source tier  300  into the bin B j  of the destination tier  302  via channels c 1   x , c 2   y , . . . , c τ   z  of the intermediate tiers  400 , such as 1, 2, . . . , τ can be represented as K l,1   q,x,y, . . . ,z , where 0&lt;i≦u, 0&lt;j≦β, 0&lt;x≦γ, 0&lt;y≦δ and 0&lt;z≦η. 
         [0040]    In the present example, each of the selected objects O i  of the source tier  300  may pass through one channel at each intermediate tier  400  before being dropped into one of the selected bins B j  of the destination tier  302 . The sequence/order of dropping the objects from the source set O to the destination set B may be represented as follows: 
         [0000]        O   1             c   1   x     1               c   2   y     1    . . .            c   τ   z     1               B   1 )           K   1,1   1,x     1     ,y     1     , . . . ,z     1     (22)
 
         [0000]        O   2             c   1   x2             c   2   y2  . . .            c   τ   z     2               B   3 )           K   1,1   1,x     2     ,y     2     , . . . ,z     2     (23)
 
         [0000]                  (24)
 
         [0000]        O   2             c   1   x     3               c   1   y     3    . . .            c   τ   z     3               B   1 )           K   2,1   L,x     3     ,y     3     , . . . ,z     3     (25)
 
         [0041]    The symbol “→” represents the dropping of elements from one set to other. 
         [0042]    In the generalized form, c i   k  may be used to represent channel k at the intermediate tier i. The q th  iteration of dropping a source set object O i  into a destination bin B j , through the channels c 1   x , c 2   y , . . . , c τ   z  at the intermediate tiers 1, 2, . . . τ, may be represented as K i,j   q,x,y, . . . ,z . Therefore, the generalized sequence order representing an authentication key of length “L” may be given as: 
         [0000]        K   1,1   1,x     1     ,y     1     , . . . ,z     1     ,K   2,3   2,x     2     ,y     2     , . . . ,z     2     , . . . ,K   2,1   L,x     3     ,y     3     , . . . ,z     3     (26)
 
         [0043]      FIG. 4  shows the source tier  300 , the destination tier  302 , and a single intermediate tier  400 . The intermediate tier  400  described herein may include two such channels c 1   1  and c 1   2 . The user may attempt to access the touchscreen device  100  by dragging the objects from the source tier  300 , through either channel of the intermediate tier  400  and dropping them into the bins of the destination tier  302 . As described above, the user preferably manipulates the objects in a specific user-selected pattern, the number, sequence and pathway of such constituting the authentication-key. Therefore, in the present example, during the first iteration the user can drop the O 1  to B 1  through the ell, during the second iteration the user can drop the O 2  to B 3  through the c 1   2 , during the third iteration the user can drop the O 4  to B 3  through the c 1   2 , during the fourth iteration the user can drop the O 3  to B 2  through the c 1   1 , during the fifth iteration the user can drop the O 1  to B 2  through the c 1   2 , during the sixth iteration the can drop the O 2  to 131 through the c 1   1 , and during the seventh iteration the user can drop the O 4  to B 3  through the c 1   2 . In an example, the desired authentication-key could therefore have a length “L” equal to seven, and the authentication-key can be represented as K 1,1   1,1 , K 2,3   2,2 , K 4,3   3,2 , K 3,2   4,1 , K 1,2   5,1 , K 2,1   6,1 , K 4,3   7,2 . As before, the sequence/order of dropping the objects should be same as the authentication-key. If the user fails to follow the defined sequence, then the user is denied access the touchscreen device  100 . 
         [0044]      FIG. 5  is a block diagram illustrating an authentication-key utilizing two intermediate tiers  500  and  502  with channels, in accordance with an embodiment of the present invention. In this embodiment, and authentication-key requires use of a source tier  300 , destination tier  302 , and two intermediate tiers  500  and  502 . The intermediate tiers are provided between the source tier  300  and the destination tier  302 . In this example, the intermediate tier  500  may include two channels c 1   1  and c 1   2 , and the intermediate tier  502  may include three channels c 2   1 , c 2   2 , and c 2   3 . The user of the touchscreen device  100  is required to drag the objects from the source tier  300  through the channels of the intermediate tiers  500  and  502  and drop them into the bins of the destination tier  302 , in a user-specific sequence. Therefore, the sequence shown in  FIG. 5  gives the authentication-key of a length of seven, and can be represented by K 1,1   1,1,2 , K 2,3   2,2,3 , K 4,3   3,2,3 , K 3,2   4,1,2 , K 1,2   5,1,2 , K 2,1   6,1,1 , K 4,3   7,2,2 . 
         [0045]      FIG. 6  is a block diagram illustrating an authentication-key utilizing randomly-ordered objects of both the source tier and the destination tier in accordance with an embodiment of the present invention. In this example, the objects O 2 , O 1 , O 3 , and O 4  of the source tier  300  and the bins B 2 , B 1 , and B 3  of the destination tier  302  are randomly arranged. Therefore, the order of objects of the source tier  300  is changed to O 2 , O 1 , O 3 , and O 4  and the order of bins of the destination tier  302  is changed to B 2 , B 1 , and B 3 . This random or shuffled arrangement of the objects and the bins can be done for every instance of the authentication, which should impede the efforts of an unauthorized user to access the touchscreen device  100  by (for example) observing and memorizing the pattern drawn on the touchscreen device  100  by an authorized user. Thus, even though the sequence/order of dropping the objects into the bins remains unchanged, the actual pattern required to unlock the touchscreen device  100  changes with every iteration, and will be known only to an authorized user. 
         [0046]    In the present example, the authentication key created during the authorization process may include dropping the object O 1  of the source tier  300  into the bin B 1  of the destination tier  302  during the first iteration, dropping the object O 2  of the source tier  300  into the bin B 3  of the destination tier  302  during the second iteration, dropping the object O 3  of the source tier  300  into the bin B 3  of the destination tier  302  during the third iteration, dropping the object O 4  of the source tier  300  into the bin B 2  of the destination tier  302  during the fourth iteration, dropping the object O 1  of the source tier  300  into the bin B 2  of the destination tier  302  during the fifth iteration, dropping the object O 2  of the source tier  300  into the bin B 1  of the destination tier  302  during the sixth iteration, and dropping the object O 3  of the source tier  300  into the bin B 3  of the destination tier  302  during the seventh iteration. In an example, this seven iteration process defines an authentication-key length (“L”) equal to seven, with the authentication-key represented as K 1,1   1 , K 2,3   2 , K 4,3   3 , K 3,2   4 , K 1,2   5 , K 2,1   6 , K 4,3   7 . 
         [0047]    In an example, the authentication key defined herein is same as defined in the  FIG. 3 , but the actual pattern traced by the user when dragging objects from source tier  300  into the bins of the destination tier  302  will differ considerably because of the randomization of the arrangement of objects in each tier. Therefore, an authorized user who mimics the observed pattern perfectly will be denied access to the touchscreen device  100 . Thus, the method provides enhanced security to the touchscreen device  100  by randomly ordering the displayed objects, rather than having fixed or static display pattern for the objects in each respective tier. 
         [0048]    In one embodiment, the user location may be known from applications such as a Global Positioning System (GPS), system time application, and a calendar/date application installed on the touchscreen device  100 . Additionally, user profiles, social media, a map application, or other information sources may be used to determine the user&#39;s physical location. This information may be leveraged advantageously for use with the present invention. For example, the touchscreen device  100  may change the display or gallery set of objects for each tier based on the current location. Additionally, the user may authorize the use of different gallery sets depending on the time, date or physical location, adding more levels of security to the present invention. 
         [0049]    In one embodiment, the touchscreen device  100  may add “empty” or “dummy” bins to the presented set of bins of the destination tier  302 . Any objects from the source tier  300  dropped into the dummy bins may be either ignored or considered, based on the authorized user preferences. If a user notices that a potential unauthorized user is observing the user&#39;s attempt to access the touchscreen device  100 , then the user may drop the objects into the dummy bin, which are preferably not considered, based on the authorized user preferences. The unauthorized user may later attempt to imitate the user&#39;s gesture, but their attempts at access may be confounded because the inclusion of the dummy bin complicates observation and recognition of the correct number, sequences and paths to recreate the authorization-key. In yet another embodiment, dummy objects may also be placed among the objects of the source tier  300 . The dummy objects dragged and dropped from the source tier  300  into the true bins or dummy bins may also be ignored or considered, depending on the user&#39;s preferences. These dummy objects of the source tier  300  or the dummy bins of the destination tier  302  may thereby increase the security level by complicating observation of the correct authentication-key relative to static pattern-based authentication. 
         [0050]    In another embodiment, the touchscreen device  100  may be configured to perform multiple authentication checks having different levels of security depending on the sensitivity of the requested function. For example, the user may have a low security level authentication check for unlocking the smart phone, but may include a high security level authentication check for access or manipulation of an important file or folder. The security level may be adjusted by increasing or decreasing the number of intermediate tiers, thereby allowing the user to allow any other person to access some functions of a (for example) smart phone without worrying about sensitive confidential information being disclosed. 
         [0051]    Comparative analysis shows that the present invention is better secured relative to existing gesture-based authentication methods. The following evaluation metrics present mathematical analysis of the method as compared against the existing methods. The source tier  300  may be represented by the source set O, and the destination tier  302  may be represented by the destination set B, as in the equations 1 and 2. Source tier  300  and destination tier  302  have α and β objects respectively, wherein the intermediate tiers 1, 2, . . . τ can include γ, δ, . . . η channels respectively. The existing method includes only one set of objects, such as an alphabet set, so as to achieve a fair comparison. The summation of the number of elements from all the tiers may therefore include the source tier, the destination tier, and all the intermediate tiers, and analogized to an alphabet set having size x where: 
         [0000]        x =(α+β+γ+, . . . ,+η)  (27)
 
         [0052]    The metrics used for the comparison can be for example, Elimination Combinations (EC), Visual Eliminations (VE), and Effective Eliminations (EE). 
         [0053]    The EC described herein may be defined as the number of wrong combinations or challenges or rejections that the system poses for the unauthorized user. A higher number of potential eliminations represents a greater degree of scrutiny. In the disclosed invention, for each iteration, the selection of the elements from the source, destination or intermediate tiers is independent of the corresponding selection from the previous iterations. The EC for authentication key of length L is therefore as given below: 
         [0000]      EC=(α×β×γ×δ, . . . η) L   (28)
 
         [0054]    In the existing gesture-based authentication method, there exists a constraint that the selected object from the alphabet set x could not be repeated. The existing system elimination combinations (PEC), for an authentication-key of length L is therefore: 
         [0000]    
       
         
           
             
               
                 
                   
                     P 
                      
                     
                         
                     
                      
                     E 
                      
                     
                         
                     
                      
                     C 
                   
                   = 
                   
                     
                       χ 
                       ! 
                     
                     
                       
                         ( 
                         
                           χ 
                           - 
                           L 
                         
                         ) 
                       
                       ! 
                     
                   
                 
               
               
                 
                   ( 
                   29 
                   ) 
                 
               
             
           
         
       
     
         [0055]    The VE described herein can be considered provided the unauthorized user has a chance to visually observe the authentication-key when the authorized user is authenticating the graphically secured touchscreen device  100 . The unauthorized user may gain access to the touchscreen device  100  by providing the observed authentication pattern or gesture. The VE gives the total number of background variations to enter the authenticating pattern. The VE of the present invention is given below: 
         [0000]      VE=α!×β!×γ!×δ!, . . . η!  (30)
 
         [0056]    Thus, the number of visual eliminations is constant, and is given by: 
         [0000]      PVE=CONSTANT  (31)
 
         [0057]    The EE described herein gives the total number of rejections or the difficulties that the system poses for the unauthorized user due to elimination combinations and visual elimination. Since the elimination chances and visual eliminations are mutually dependent, the effective elimination of the unauthorized user for the proposed system (EE) is: 
         [0000]      EE=EC×VE  (32)
 
         [0058]    In contrast, the effective eliminations of the unauthorized user under the existing method (PEE) is given by: 
         [0000]      PEE=PEC×PVE  (33)
 
         [0059]    Mathematical analysis of the present invention (as derived from equations 28 and 29) shows that the elimination combination (EC) of the invention is exponential. In contrast, the existing system&#39;s elimination combinations (PEC) are factorial with respect the authentication-key of length L. If the unauthorized user is aware of the length L of the authentication-key, then from equation 28, the proposed system poses (α!×β!×γ!×δ!, . . . η!) L  elimination combinations. That is, the impostor being successful is 1: (α×β×γ×δ, . . . ,η) L , thereby allowing the user to repeatedly select an element in all the tiers. If the unauthorized user is not aware of the length L of the authentication key, then the proposed system poses: 
         [0000]      EC=(α×β×γ×δ, . . . η) ∞   (34)
 
         [0000]    number of elimination combinations. That is, the chances of the unauthorized user being successful are 1: ∞, which is very low. Equation 21 shows that the security of the proposed system is directly proportional to the number of elements in all the tiers such as the source tier a, the destination tier β, and the number of channels γ, δ, . . . η at the intermediate tiers 1, 2, . . . τ, respectively. Hence, altering these parameters will alter the security level exponentially. Thus, a small increase in these parameters may affect a high level of security, especially relative to the existing method. 
         [0060]    From equations 30 and 31, it is seen that the VE generated in the proposed system is the product of factorials of the number of elements in each tier, whereas in the existing system it is a constant. By increasing the number of elements in any of the multiple tiers by a small value, the VE generated increases significantly relative to the PVE generated by the existing system. Hence, it may be that the method addresses consistent visual attack by an unauthorized user far better than the existing system. The effective elimination is the product of the EC and VE. 
         [0061]      FIG. 7  is a block diagram illustrating a computing environment implementing an embodiment of the present invention. As depicted, the computing environment includes at least one processing unit  700  that is equipped with a control unit  710  and an Arithmetic Logic Unit (ALU)  705 , a memory unit  715 , a storage unit  730 , plurality of networking devices  720 , and a multiple input output (I/O) devices  725 . The processing unit  700  is responsible for processing the instructions of the algorithm. The processing unit  700  receives commands from the control unit  710  in order to perform its processing. Further, any logical and arithmetic operations involved in the execution of the instructions are computed with the help of the ALU  705 . 
         [0062]    The overall computing environment can be composed of multiple homogeneous and/or heterogeneous cores, multiple CPUs of different kinds, special media and other accelerators. The processing unit  700  is responsible for processing the instructions of the algorithm. The processing unit  700  receives commands from the control unit  710  in order to perform its processing. Further, any logical and arithmetic operations involved in the execution of the instructions are computed with the help of the ALU  705 . Furthermore, the plurality of process units may be located on a single chip or over multiple chips. 
         [0063]    The embodiments disclosed herein can be implemented through at least one software program running on at least one hardware device and performing network management functions to control the elements. The elements shown in  FIGS. 1 and 7  include blocks, which can be at least one of a hardware device, or a combination of hardware device and software module. 
         [0064]    The apparatuses and methods of the disclosure can be implemented in hardware, firmware or as software or computer code that can be stored in a recording medium such as a CD ROM, an RAM, a floppy disk, a hard disk, or a magneto-optical disk or computer code downloaded over a network originally stored on a remote recording medium or a non-transitory machine readable medium and to be stored on a local recording medium, so that the methods described herein can be rendered in such software that is stored on the recording medium using a general purpose computer, or a special processor or in programmable or dedicated hardware, such as an ASIC or FPGA. As would be understood in the art, the computer, the processor, microprocessor controller or the programmable hardware include memory components, e.g., RAM, ROM, Flash, etc. that may store or receive software or computer code that when accessed and executed by the computer, processor or hardware implement the processing methods described herein. In addition, it would be recognized that when a general purpose computer accesses code for implementing the processing shown herein, the execution of the code transforms the general purpose computer into a special purpose computer for executing the processing shown herein. In addition, an artisan understands and appreciates that a “processor” or “microprocessor” constitute hardware in the claimed disclosure. Under the broadest reasonable interpretation, the appended claims constitute statutory subject matter in compliance with 35 U.S.C. §101. 
         [0065]    The definition of the terms “unit” or “module” as referred to herein is to be understood as constituting hardware circuitry such as a processor or microprocessor configured for a certain desired functionality, or a communication module containing hardware such as transmitter, receiver or transceiver, or a non-transitory medium comprising machine executable code that is loaded into and executed by hardware for operation, in accordance with statutory subject matter under 35 U.S.C. §101 and do not constitute software per se. 
         [0066]    The foregoing description of the specific embodiments will so fully reveal the general nature of the embodiments herein that others can, by applying current knowledge, readily modify and/or adapt for various applications such specific embodiments without departing from the generic concept, and, therefore, such adaptations and modifications should and are intended to be comprehended within the meaning and range of equivalents of the disclosed embodiments. It is to be understood that the phraseology or terminology employed herein is for the purpose of description and not of limitation. Therefore, while the embodiments herein have been described in terms of preferred embodiments, those skilled in the art will recognize that the embodiments herein can be practiced with modification within the spirit and scope of the embodiments as described herein.