Authentication using individual's inherent expression as secondary signature

A method and system are provided. The method includes training for one or more secondary signatures of a user. The method further includes identifying one or more inherent expressions of the user as the one or more secondary signatures. The method also includes authenticating the user using a primary signature and at least one of the one or more secondary signatures. The one or more inherent expressions are unintended expressions performed by the user in relation to the user providing the primary signature.

BACKGROUND

Technical Field

The present invention relates generally to authentication and, in particular, to authentication using an individual's inherent expression as a secondary signature.

Description of the Related Art

Security mechanisms such as passwords or pins are a necessary part of everyone's life, whether they are an automated teller machine (ATM) card pin or a password for logging onto a social networking service. Managing passwords becomes a headache for many people. Numerous online accounts, different password policies (such as expiration time period, password length, password format) multiply this inconvenience, making users desire a simpler solution. On the other hand, the availability of powerful and yet simple-to-use hacker tools, widespread viruses and Trojans, global access for hackers, and the severe consequences of being hacked (such as identify theft) argue for stronger and more complicated passwords. Thus, a simpler to use security mechanism that still provides strong security is needed.

SUMMARY

According to an aspect of the present principles, a method is provided. The method includes training for one or more secondary signatures of a user. The method further includes identifying one or more inherent expressions of the user as the one or more secondary signatures. The method also includes authenticating the user using a primary signature and at least one of the one or more secondary signatures. The one or more inherent expressions are unintended expressions performed by the user in relation to the user providing the primary signature.

According to another aspect of the present principles, a system is provided. The system includes a secondary signature trainer for training for one or more secondary signatures of a user. The system further includes an inherent expression as a secondary signature evaluator for identifying one or more inherent expressions of the user as the one or more secondary signatures. The system also includes a user authentication device for authenticating the user using a primary signature and at least one of the one or more secondary signatures. The one or more inherent expressions are unintended expressions performed by the user in relation to the user providing the primary signature.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

The present principles are directed to authentication using an individual's inherent expression as a secondary signature. Such inherent expression can include, for example, gestures, other body movements, speech, noise, shutter, lisp and other inherent characteristics specific to the individual such as blood pressure, heart rate, and/or brain wave. Advantageously, the secondary signature provides increased security to bolster the use of a primary signature. As used herein, the term “primary signature” refers to the first and primary input a user provides when being authenticated. Examples of primary signatures include, but are not limited to, entry of a password by typing or voice, or other input form, entry of a specific gesture, retina scan, or other biometric entry.

Thus, the present principles can apply to multi-factor authentication access, where more than one authentication factor is used to identify an individual. We note that such multi-factor authentication access typically involves multiple authentication factors from different categories.

Moreover, it is to be appreciated that system200described below with respect toFIG. 2is a system for implementing respective embodiments of the present principles. Part or all of processing system100may be implemented in one or more of the elements of system200.

Further, it is to be appreciated that processing system100may perform at least part of the method described herein including, for example, at least part of method300ofFIG. 3and/or at least part of method400ofFIG. 4. Similarly, part or all of system200may be used to perform at least part of method300ofFIG. 3and/or at least part of method400ofFIG. 4.

FIG. 2shows an exemplary system200for authenticating a user using the user's inherent expression as a secondary signature, in accordance with an embodiment of the present principles.

The system200includes a secondary signature capture device210, an inherent expression as a secondary signature evaluator220, a memory device230, a user authentication device240, a secondary signature training manager250, and an authentication action device260.

The secondary signature capture device210captures one or more secondary signatures from the user. The secondary signature capture device210can include one or more of a microphone, a brain wave monitor, a heart rate monitor, a blood pressure monitor, a visual monitoring device, and so forth. In an embodiment where the secondary signature capture device210includes the visual monitoring device, the visual monitoring device monitors the actions (e.g., gestures and/or movements) of a user. In such an embodiment, the visual monitoring device includes an image capture device such as a video camcorder, a gesture/movement recognition device, and so forth. However, any of the other aforementioned devices can replace and/or supplement the visual monitoring device included in the secondary signature capture device210.

The inherent expression as a secondary signature evaluator220evaluates inherent expressions of the user (that are expressed while the user is providing the primary signature) for suitability as secondary signatures. The evaluation is based on certain criterion/criteria including, but not limited to, similarity, probability of occurrence, and so forth.

The memory device230stores a primary signature that is used to authenticate the user. The memory device230also stores the one or more secondary signatures of the user that are used for authentication of the user, based on a result of the evaluation (performed by the inherent expression as a secondary signature evaluator220).

The user authentication device240authenticates the user using the primary signature and at least one of the one or more secondary signatures.

The secondary signature training manager250manages the training of secondary signatures. The training manager can include determining when to invoke training. In an embodiment, the training manager250can invoke training based on the occurrence of certain conditions. In an embodiment, the one or more given conditions can include, but are not limited to, the elapsing of a predetermined amount of time, the occurrence of a predetermined number of authentications using at least one of the one or more secondary signatures, and so forth. In an embodiment, the given condition can be any session where the user is providing the primary signature so as to provide a continuous learning environment that accommodates, for example, habitual or environmental changes. These and other conditions are readily determined by one of ordinary skill in the art given the teachings of the present principles provided herein, while maintaining the spirit of the present principles.

Moreover, in an embodiment, the training manager250can perform gesture modeling of any inherent expressions performed by the user. One or more models may be used for a given inherent expression. Each model can represent a slight variation in a given inherent expression.

The authentication action device260performs a physical action using a machine or device, or causes the machine or device to perform the physical action, responsive to authentication of the user. The physical action by a machine or device can include, but is not limited to, unlocking a lock on a door or a physical device, automatically opening a non-manually operated door, providing access to a facility or item, and so forth. These and other actions are readily determined by one of ordinary skill in the art, given the teachings of the present principles provided herein.

In the embodiment ofFIG. 2, the visual monitoring device210, the inherent expression as a secondary signature evaluator220, the memory device230, and the second signature training manager250are part of a secondary signature trainer299. However, it is to be noted that the visual monitoring device210can also serve to identify a primary signature. However, in other embodiments, separate devices can be used to detect the primary signature and secondary signatures.

Of course, the system200may also include other elements (not shown), as readily contemplated by one of skill in the art, as well as omit certain elements. Moreover, other arrangements of the elements of system200can be used. For example, while one or more elements of system200are shown as separate devices, in other embodiments, two or more of the elements can be combined into an integrated element. We note that in the embodiment shown inFIG. 2, the elements thereof are interconnected by a bus201. However, in other embodiments, other types of connections can also be used. Moreover, in an embodiment, at least one of the elements of system200is processor-based. These and other variations of the elements of system200are readily contemplated by one of ordinary skill in the art given the teachings of the present principles provided herein, while maintaining the spirit of the present principles. As an example, the input devices could involve the touch screen on a smart phone and the blood pressure sensor provided on a wristwatch.

FIG. 3shows an exemplary method300for training for one or more secondary signatures, in accordance with an embodiment of the present principles.

At step310, monitor a user while the user is providing a primary signature one or more (preferably multiple) times to detect one or more inherent expressions of the user. The one or more inherent expressions are unintended expressions performed by the user. The unintended expressions can include gestures, movements, sounds, heart rate value, blood pressure value and/or brain wave activities of the user. The preceding unintended expressions are merely illustrative and, thus, other unintended expressions can also be used while maintaining the spirit of the present principles.

At step320, perform an evaluation to evaluate the one or more inherent expressions of the user for certain criteria. The criteria can include, but is not limited to, one or more of the following: similarity; probability of reoccurrence; and so forth.

At step330, store the one or more inherent expressions of the user as one or more secondary signatures of the user based on a result of the evaluation.

FIG. 4shows an exemplary method400for authenticating a user, in accordance with an embodiment of the present principles. The method400uses the user's inherent expression as a secondary signature for authentication.

At step410, receive (i) a primary signature from the user and (ii) data to be used in identifying one or more secondary signatures. Such data can include, but is not limited to, one or more gestures (e.g., movements or static positions) performed by the user, sounds produced by the user, a heart rate of the user, a blood pressure of the user, a brain wave of the user, and any other inherent expression made by the user in relation to the user providing the primary signature.

At step420, perform an authentication operation to authenticate the user using the primary signature.

At step430, determine whether or not the user has been authenticated using the primary signature. If so, then the method proceeds to step440. Otherwise, the method returns to step410.

At step440, perform an identification operation to identify one or more inherent expressions of the user as one or more secondary signatures, using the data received in step410. Such identification can be based on, for example, a comparison of the data to training data or sample data including expected inherent user expressions that can be used as secondary signatures.

At step450, determine whether any secondary signatures have been identified. If so, then the method proceeds to step460. Otherwise, the method proceeds to step480.

At step460, perform an authentication operation to authenticate the user using the primary signature and one or more of the secondary signatures (identified at step440).

At step470, determine whether or not the user has been authenticated using the primary signature and one or more of the secondary signatures. If so, then the method proceeds to step480. Otherwise, the method returns to step410.

At step480, perform a physical action by a machine or device in response to authentication of the user. The physical action by a machine or device can include, but is not limited to, unlocking a lock on a door or a physical device, automatically opening a non-manually operated door, providing access to a facility or item, and so forth. These and other actions are readily determined by one of ordinary skill in the art, given the teachings of the present principles provided herein.

It is to be appreciated that one or more steps of method400can involve training on-the-fly in order to update and/or replace any of the one or more secondary signatures. The training can be performed during the next time(s) when the user provides the primary signature in an authentication operation (e.g., step450). Such next time(s) can involve simply training without actual authentication or can be performing during subsequent authentication sessions to provide seamless further training for a user's secondary signature(s). These and other variations of the present principles are readily determined by one of ordinary skill in the art given the teachings of the present principles provided herein, while maintaining the spirit of the present principles.

Very often, authentication can have multiple levels. Let us consider a user unlocking an Android® phone through the 9-Dots Pattern authentication mechanism. First, the order of transversal through a subset of the 9-Dot is the primary password (or signature). Second, behavioral biometrics such as the speed of drawing when connecting two dots are used to enhance the primary password. This type of behavioral biometric is captured based on the physical interaction (touching) between a user and an input device, and is focused on capturing data related to intentional actions.

The present principles introduce another level of authentication using the person's inherent and unintended gestures. These gestures are not directly related to the physical, intentional interaction between the user and the input device. Yet, these unintended actions occur coincidentally with the intended physical actions involved with providing the primary signature (i.e., the finger swiping action). For example, a user uses his right hand index finger to swipe a pattern for the 9-Dots Pattern on the Android® phone, and this user has a habit of curling the pinky (little finger) while he connects the last two dots. As long as the curling of the pinky during the last two dots is a repeating habit, it can be used as part of a secondary signature to strengthen security around the primary signature. On the other hand, curling the pinky would not be used as a signature if the user was using the middle finger, or using any finger on the left hand to perform the swipe. Without the secondary signature for authentication (i.e., a less secure situation), it's up to the application to decide if access should be granted, whether a warning email should be send to the user, and so forth. Some of these inherent unintentional gestures or movements will occur across entry of many primary signatures. On the other hand, as the primary signature changes, the secondary signature (the inherent unintended gesture) may also change.

The present principles can be implemented using various gesture modeling and detection technology available today as the enabling technology. As these technologies become more mature, more precise and detailed gesture tracking and modeling will be available and the present principles will be enhanced at the same time.

A person's inherent gesture suggested by the present principles could be either pre-trained or trained-as-you-go. The training includes gesture modeling, where the movement of your fingers could be recognized and kept in a data structure. As the same password is input over and over again, multiple data structures representing the multiple occurrences are available. The content of data structure across these multiple occurrences is analyzed for similarity, and probability of reoccurrence. The specific action that has a high probability of reoccurrence becomes a candidate for the secondary signature.

The train-as-you-go process happens continuously (through continuous learning) to accommodate habitual or environmental changes. For example, 3 habitual gestures were initially identified as secondary signatures. Then the user hurt his pinky, which can no longer curl. While the pinky is healing, the other 2 gestures could be used as a secondary signature(s) while new habitual gestures could be detected (new habitual gestures might be available because of the changes to the pinky). The continuous learning could also be used in conjunction with other secondary signature such as the behavioral biometrics described earlier. In addition, the multiple secondary signatures can complement each other when a particular secondary signature does not reliably occur along with the primary signature the majority of the time. For example, gesture1happens 70% of time, gesture2happens 80% of time, gesture3happens 60% of time, and gesture4happens 70% of time. It is possible to determine based on historical occurrences that 2 out of the 4 gestures will happen together 99% of time. And, these 4 gestures would create a group of very strong and reliable secondary signatures. The preceding and other implementations involving multiple secondary signatures are readily contemplated by one of ordinary skill in the art given the teachings of the present principles provided herein, while maintaining the spirit of the present principles.

Let us take the same example mentioned herein, where a user uses his right hand index finger to swipe a pattern for the 9-Dots Pattern on the Android® phone with a curling pinky. This can be implemented using technology from Leap Motion®, where gestures can be detected. The Leap Motion® technology can be implemented as a sensor on the Android phone. Through modeling of the gesture as described, a repeating inherent gesture can be detected and used as a secondary signature. Of course, the present principles are not limited to use of technology from Leap Motion® and, thus, other gesture recognition devices, systems, and approaches can also be used in accordance with the teachings of the present principles, while maintaining the spirit of the present principles.

Another example relates to the use of the present principles with any other authentication method that involves some sort of intentional user movement. Thus, for example, while the user is performing such intentional movement which, in an embodiment, can serve as a primary signature, one or more inherent expressions of the user can be detected as used as one or more secondary signatures. In this way, overall authentication security is enhanced.

Yet another example is related to a regular password input. One possible habit when inputting the password is that the user may sub-vocalize which causes lip movements, a lisp or stutter, or they may habitually make other facial expressions. The lip movement, stutter and facial expression could be used as three separate secondary passwords. This could be accomplished using a camera as the sensor, together with lip recognition, noise recognition, facial expression recognition and modeling technique (for example, the Open Source Computer Vision (OpenCV) computer vision library from Intel® provide such capability). Through modeling of the lip, noise and facial expression as described, the three repeating inherent expressions can be employed as a “failover” of each other and used in a continuous learning embodiment.

Still another example is related to a 10 character password input for an online game account. One possible characteristic when inputting the password is that the user's blood pressure gradually increases and peaks at the 5thcharacter input. The entire blood pressure movement can be modeled as a function of time, and mapped to the time-sequence of each character being inputted. Alternatively, the peak blood pressure can be mapped to the 5thinput character.

A further example is related to a user being asked to speak their password. The user utters the phrase “tea cup”. When the user utters the phrase, due to the structure of the user's teeth, a whistling sound is emitted concurrently with the “c” in “cup”. Hence, in this example, the primary signature is the utterance “tea cup”, and the secondary inherent expression is the whistling sound that the user emits when uttering the phrase “tea cup”, that is while the user is providing the primary signature.

Yet a further example relates to the user being asked to speak their password. The user utters the phrase “tea cup”. When the user utters the phrase, the user also moves his right thumb. Hence, in this example, the primary signature is the utterance “tea cup”, and the secondary inherent expression is the movement of the user's right thumb.

To elaborate, let us consider the case where the primary Signature involves multiple steps and/or parts (for example, but not limited to, multiple keyboard inputs, multiple clicks of a mouse, or based on time), each of these steps could be mapped to steps and/or parts in the secondary signature. Thus, with respect to the above example, if the blood pressure peaked at the 8th character (where the peak is expected at the 5thcharacter), the authentication will fail.

Accordingly, upon authenticating the individual, the individual can be allowed certain permissions, such an entering a secured facility, using a secured device, accessing a bank account over the Internet, and so forth. Moreover, the authentication can be linked to further actions such as unlocking an entry point into the secured facility or secured device and so forth. These and various other applications to which the present principles can be applied are readily determined by one of ordinary skill in the art, while maintaining the spirit of the present principles.

We now describe various differences between the present principles and various prior arts.

The authentication approach proposed in accordance with the present principles is different than a simple extension from gesture based computer interaction into a security method. For gesture-based computer interaction, the algorithms do their best to ignore unrelated details of a gesture. In contrast, the present principles involve the opposite. That is, the present principles deliberately intend to capture what other security methods ignore, by utilizing the latest technologies to capture the subtlest of details surrounding entry of a primary signature for use as a secondary signature.

The authentication approach proposed in accordance with the present principles is different than a simple extension of behavioral biometric, for example, using typing style (e.g., rhythm, speed of typing or swiping) for authentication. These behavioral biometric algorithms use a specific human body part (e.g. the finger, the eye ball, and so forth) that interacted with the input device to determine the repeatable behavior. For example, if the right hand index finger and the right hand thumb are used for a touch screen “zoom” function, then the behavior of the index finger and thumb are studied and used for authentication. The other fingers or the other hand are not used to provide input to the input device, and therefore, they are not used for authentication purpose. The present principles propose to use the other fingers, the other hand or other body parts that are not used to provide input to the input device, for authentication purposes.