Authentication of a user device comprising spatial trigger challenges

Authentication of a user device, and/or associated user, to a system is a key component of many systems whereby access is restricted to only authorized personnel. Spatial challenges require a user, as determined by at least a sensor of a user device, to perform a particular spatial action. A sensor in the user device provides output signals and, if the output signals are associated with compliance with the spatial challenge, authorization to access a secured asset may then be granted.

CROSS-CITATION TO RELATED APPLICATIONS

The present application incorporates by reference U.S. application Ser. No. 16/392,336 filed Apr. 23, 2019 entitled “AUTHENTICATION OF A USER DEVICE COMPRISING SPATIAL TRIGGER CHALLENGES”, the entire disclosure of which is hereby incorporated by reference.

FIELD OF THE DISCLOSURE

The present disclosure is generally directed toward authentication of a user to a system and more specifically, authentication of a user device associated with a user to a system.

BACKGROUND

Providing data, such as passwords and personal identification numbers (PINs) or a biometric identifier (e.g., voice, facial, fingerprint, retinal, etc.) are well understood means of authenticating a user to a device, such as a computer, security panel, etc. As computing devices, such as laptop computers, tablets, and cellular telephones, have both gained portability and computing power, often a user is authenticated to the device, such as a by providing a passcode, password, or body component for biometric recognition. Once the user-to-user device authentication is performed, the user device may then be authenticated to other components, such as to enable access to secured information (e.g., medical records, business documents, etc.), perform a transaction (e.g., banking, e-commerce, etc.), or launch an application (e.g., email, financial application, etc.).

SUMMARY

It is with respect to the above issues and other problems that the embodiments presented herein were contemplated.

User authentication is a key component in many systems. In addition to the methods, and enabling hardware, of the prior art systems, spatial triggers are provided by the embodiments disclosed herein. A user is first authenticated to a user device. The user device comprises portable computing device, such as a cellular telephone, tablet, laptop, electronic goggles or glasses, or other computing device which may further comprise wireless connectivity hardware and instructions (e.g., WiFi, Bluetooth, Near Field Communications, cellular, etc.). The user device may be embodied as one device (e.g., cellular telephone, laptop, tablet, etc.) or a plurality of devices (e.g., wearable and paired cellular telephone). For example, a user may wear a “smart watch,” which provides a portion of the functionality of the user device and is in communication with a cellular telephone carried by the same user, which provides another portion of the functionality of the user device. The user device may comprise one or more sensing components (e.g., accelerometer, altimeter, orientation, compass, microphone, camera, vision, location (GPS coordinates), etc.).

In one embodiment, a user having a user device may be asked to perform one or more tasks as a component of an authentication challenge. While the authentication challenge may incorporate known non-spatial challenges (e.g., enter a user name and password), as described herein, the authentication challenge comprises at least one spatial challenge. A spatial challenge may be a task or action, such as capturing an image at a particular location, capturing a sound at a particular location, placing their user device in a particular physical location or orientation, setting a location using device GPS tracking, and/or transition their user device through a particular physical location or orientation. It should be appreciated that a human user may receive, such as via their user device, the instruction to perform the action and may be required to perform an action, however, compliance or lack of compliance is determined with respect to the user device, such as one or more sensor outputs indicating the user device has performed the action and then, upon determining the output signals from the one or more sensors indicates compliance with the instruction. Once the user device successfully indicates compliance with the spatial challenge, indicating the user performed the action, the user and/or the user device may be granted access to a secured asset such as private information, enabled to perform a secured transaction, or granted access to a secured location. In another embodiment, the access to the secured asset and/or enabling the secure transaction may be transitory and/or geospatially limited.

In one embodiment, a user device is disclosed, comprising: a data storage; and a processor that: selects, from the data storage, an authentication challenge comprising a first spatial challenge; causes the first spatial challenge to be presented by the user device; receives a first sensor output indicating a first spatial action of the user device; determines whether the authentication challenge is successful, further comprising determining the first sensor output indicates compliance with the first spatial challenge; and upon the determination that the authentication challenge is successful, grants the user device access to a secured asset.

In another embodiment, a server is disclosed comprising: a data storage; a network interface to a network; and a processor that: establishes a communication with a first user device, utilizing the network interface, wherein the communication comprises a request for authentication; accesses, from the data storage, an authentication challenge comprising a first spatial challenge; sends the first spatial challenge to the first user device for presentation by the first user device; receives a first sensor output indicating a first spatial action of the first user device; determines whether the authentication challenge is successful, further comprising determining the first sensor output indicates compliance with the first spatial challenge; and upon the determination that the authentication challenge is successful, grants the first user device access to a secured asset.

In another embodiment, a method for authentication is disclosed, comprising: selecting an authentication challenge comprising a first spatial challenge; causes the first spatial challenge to be presented by a user device; receiving a first sensor output indicating a first spatial action of the user device; determining whether the authentication challenge is successful, further comprising determining the first sensor output indicates compliance with the first spatial challenge; and upon the determination that the authentication challenge is successful, granting the user device access to a secured asset.

The term “computer-readable medium,” as used herein, refers to any tangible storage that participates in providing instructions to a processor for execution. Such a medium may take many forms, including, but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, NVRAM, or magnetic or optical disks. Volatile media includes dynamic memory, such as main memory. Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, magneto-optical medium, a CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, a RAM, a PROM, an EPROM, a FLASH-EPROM, a solid-state medium like a memory card, any other memory chip or cartridge, or any other medium from which a computer can read. When the computer-readable media is configured as a database, it is to be understood that the database may be any type of database, such as relational, hierarchical, object-oriented, and/or the like. Accordingly, the disclosure is considered to include a tangible storage medium and prior art-recognized equivalents and successor media, in which the software implementations of the present disclosure are stored.

While machine-executable instructions may be stored and executed locally to a particular machine (e.g., personal computer, mobile computing device, laptop, etc.), it should be appreciated that the storage of data and/or instructions and/or the execution of at least a portion of the instructions may be provided via connectivity to a remote data storage and/or processing device or collection of devices, commonly known to as “the cloud,” but may include a public, private, dedicated, shared and/or other service bureau, computing service, and/or “server farm.”

The term “module,” as used herein, refers to any known or later-developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and software that is capable of performing the functionality associated with that element. Also, while the disclosure is described in terms of exemplary embodiments, it should be appreciated that other aspects of the disclosure can be separately claimed.

DETAILED DESCRIPTION

Any reference in the description comprising an element number, without a subelement identifier when a subelement identifier exists in the figures, when used in the plural, is intended to reference any two or more elements with a like element number. When such a reference is made in the singular form, it is intended to reference one of the elements with the like element number without limitation to a specific one of the elements. Any explicit usage herein to the contrary or providing further qualification or identification shall take precedence.

The exemplary systems and methods of this disclosure will also be described in relation to analysis software, modules, and associated analysis hardware. However, to avoid unnecessarily obscuring the present disclosure, the following description omits well-known structures, components, and devices that may be shown in block diagram form and are well known or are otherwise summarized.

For purposes of explanation, numerous details are set forth in order to provide a thorough understanding of the present disclosure. It should be appreciated, however, that the present disclosure may be practiced in a variety of ways beyond the specific details set forth herein.

FIG. 1depicts environment100in accordance with embodiments of the present disclosure. In one embodiment, environment100comprises artifacts110, such as wall112with portrait110A and landscape110B, and clock110C. Artifacts110may comprise a visual artifact, such that user104may capture an image with a camera of user device102. In another embodiment, artifact110may comprise an acoustic source, such as chimes or ticking of clock110C, which may then be captured by a microphone of user device102. User104may wish to utilize user device102to access a secured asset. Upon being authenticated, user device102and/or user104is authorized to access the secured asset. As a component of an authorization challenge, user device104is presented with a spatial challenge that confirms user device102is at location108, which may further require the user to be at location108at a particular time or within a window of time.

User104may be provided with an authentication challenge, such as by receiving a message on user device102or by other means. The authentication challenge, if successfully completed, will grant user104and/or user device102access to a secured asset. In one example, the authentication challenge requires user104to stand in location108and capture an image of artifact110A. The presence of user104within location108may be determined by a relative angle in which the camera of user device102captures the image of artifact110A was captured or other known geo-location means (e.g., radio triangulation, GPS coordinates, etc.) available to device102and/or a system in communication with device102(e.g., WiFi network, cellular network, etc.). In another embodiment, the presence of user108may be determined, with at least an acceptable degree of certainty, by making the spatial challenge known to user104minimally in advance of a deadline to complete the spatial challenge. For example, location108may be a relatively small area within a much larger area, such as a few square feet in an office building or a particular room in a gallery. If user104is correctly located in area108and receives a portion of spatial challenge, such as by receiving and observing a message on user device102, user104may be able to comply with the instruction to capture an image, such as of artifact110B, within a few seconds. Accordingly, if user104completes the spatial challenge within, for example, fifteen seconds, then user104may be determined to be within location108. Artifacts may be static (e.g., artifact110A,110B) or dynamic, such as the positions of a hand of a clock (e.g., artifact110C), image of trees as they change over seasons, tides, traffic, etc.

Artifacts110may comprise acoustic artifacts, which may be static over an interval of time (e.g., ticking of a clock) or may be dynamic or at least unique over another period of time, such as capturing the sound of the clock striking twelve, or the announcements at a train station comprising the arrival or departure of a particular train, etc. In certain embodiments, successfully completing a single spatial challenge may be sufficient to authorize user104and/or user device102to access the secured asset. An acoustic artifact may operate independently of user104and/or user device102or be triggered by user104and/or user device102. In another embodiment, two or more spatial challenges may be arranged in a series to provide additional assurances that user104is known, known to be at a particular location, authorized, etc. A subsequent spatial challenge may be provided to user104after determining, with an acceptable threshold of confidence, that a particular user is user104. A spatial challenge may require user104to be at a particular location, such as location108or another area reachable by user104, within a particular time window. In another embodiment, artifact110may be radio frequency (e.g., within range of a particular WiFi transmitter, Near Field Communication (NFC) transmitter, being determined to be at a location having a particular GPS coordinate, etc.).

The secured asset, to which user104and/or user device102may be granted access upon completion of an authentication challenge, is variously embodied. In one embodiment, the secured asset is an electronic record (e.g., document, image, media file, encryption/decryption key, data record, transaction, etc.) previously installed in the memory of user device102, such as an encrypted file. Upon successfully completing the authentication challenge, the secured asset is decrypted or decryption enabled, such that user104and/or user device102may access the secured asset in an unencrypted form. In another embodiment, the secured asset may be an electronic record that resides on another device in communication, or enabled to communicate, with user device102. Upon successfully completing the authentication challenge, the secured asset is provided (e.g., made accessible, authorized, downloaded, streamed, etc.) to user device102. In another embodiment, the secured asset may be a particular location. Upon successfully completing the authentication challenge, user104is allowed to access the particular location. In a further embodiment, the particular location may be time specific or time limited. Additionally or alternatively, when the secured asset is a particular location, access may be further limited to a particular number of users104, even if such users104had successfully completed the authentication challenge.

User device102may be variously embodied. User device102comprises at least one sensor (e.g., visual, audio, haptic, compass, orientation, altitude, acceleration, radio frequency, etc.) and a processor (i.e., an electronic microprocessor comprising input, output, and processing circuitry and further comprising, or having access to, memory providing retrievable storage of data and/or instructions to be executed by the processor). User device102may further comprise human input/output components (e.g., display screen, speaker, microphone, touch screen, buttons, switches, haptic input/output, etc.) and/or communications components (e.g., WiFi, Bluetooth, NFC, cellular, infrared, etc.) to enable device102to communicate with other networks and devices. User device102may be embodied as a single device (e.g., a smart phone) or a plurality of devices. such as a first user device portion (e.g., a smart watch, smart glasses, virtual reality headset, or other portable/wearable device) in communication with a second user device portion (e.g., smart phone, tablet computer, laptop computer, etc.), which may further comprise restricting certain communications to be exclusively between the first user device and the second user device portion (i.e., paired).

FIG. 2depicts environment200in accordance with embodiments of the present disclosure. User device102may receive and/or transmit radio frequency signals to other components such as satellite204, such as to receive GPS signals, satellite based communications, etc.; network communication interface206, such as WiFi, WiMax, Bluetooth, NFC, etc.; cellular tower208, such as to communicate via a cellular voice and/or data network; other user device210associated with another user212; and/or other components.

In one embodiment, user104via user device102successfully completed a first spatial challenge, such as a sensor (e.g., camera) capturing an image of artifact110A, which has been verified to comply with the first spatial challenge. Compliance with the first spatial challenge may be determined by an absolute compliance or compliance within a particular category of deviations and/or an acceptable amount of deviation. For example, capturing an image may not produce an exact replica of an ideal captured image due to differences in camera equipment, compression loss, lighting, position variations from within location108, etc.

Differences may be permitted, and compliance still found, when the difference is one of a permitted category type, such as brightness or contrast of a captured image, additional sounds captured with an acoustic artifact, etc. and/or the difference is one of permitted degree (e.g., the brightness of a captured image is 4% lighter compared to an ideal image, the captured image is rotated seven degrees, etc.). The difference criteria may then be utilized such that a signal from a sensor, selected in accord with the type of sensing operation (e.g., camera for images/video, microphone for sound, etc.) is determined to differ by an acceptable amount, such as an acceptable difference from an ideal or at least know acceptable signal that would indicate an ideal compliance with the spatial challenge. Alternatively or additionally, components of the sensor signal may indicate compliance when then entirety of the sensor signal may not. Permitted differences may be determined via a combination of difference types and/or degrees. For example, one permitted difference allows for a captured image to be rotated twelve degrees, when the brightness is within 3% of an ideal image, however, the captured image can only be rotated by six degrees, if the brightness difference is greater than 3% but less than 15% and still be considered a permitted difference.

In another embodiment, successfully completing a first spatial challenge initiates a second spatial challenge, such as relocating to area202, capturing a subsequent artifact, etc. Area202may be defined by GPS signals from satellite204, radio triangulation such as from signals from one or more of network interface206, cellular tower208, and/or other user device210.

FIG. 3depicts challenge300in accordance with embodiments of the present disclosure. In one embodiment, user device102has display302operable to present an image for observation by a user, such as user104. In one embodiment, display302presents a hybrid image comprising camera captured portion306and augmented reality portion308.

In one embodiment, augmented reality portion308is presented in display302to coincide with a target location of a spatial challenge, such as location108and/or area202and provides a visual cue as to where location108and/or area202is located in physical space. Therefore, passing user device102through a virtual door, as presented by augmented reality portion308, causes user device102to pass into area202. Accordingly, a spatial challenge requiring user device102to enter area202may be successfully performed when, as presented on display302, user104with user device102passes through the virtual reality door. Additionally or alternatively, the “door” may comprise a “front” and/or “back” portion of the door, such that entering area202from an angle not indicating the “front” of the door may be considered a failure to comply with the spatial challenge comprising utilizing the “front” of the door. The “door” may be of any size or shape, and may or may not be of human scale. The “door” may appear the same size, larger or smaller than the area indicated by area202.

In another embodiment, augmented reality portion308may comprise additional or alternative visual, auditory, and/or haptic cues. For example, augmented reality portion308may indicate a spatial challenge that requires user device102to “tap” an augmented reality object. A sensor within user device102may output a signal in compliance with the spatial challenge when user104flicks user device102in a direction and/or location indicated by augmented reality portion308. In another example, an icon such as a speaker may be provided as at least a component of augmented reality portion308to indicate that a sound should be captured by a sensor (e.g., microphone) of user device102at the location coinciding with the location of the speaker provided by display302.

In another embodiment, annotation304may be provided as a portion of augmented reality portion308, such as to provide additional information (e.g., time remaining in before the spatial challenge is revoked, number of individuals who may complete the spatial challenge, status of secured asset or assets, etc.

Upon completion of the spatial challenge indicated by augmented reality portion308, user104and/or user device102may be granted access to the secured information or, alternatively, presented with a subsequent authentication challenge, such as a subsequent spatial challenge and/or non-spatial challenge (e.g., provide a user name, etc.). In one embodiment, a subsequent spatial challenge may comprise a further limitation upon a current spatial challenge, such as by entering area108but only from the “front” of a door, such that a direction of travel coincides with the front of the door as displayed by augmented reality portion308. In another embodiment, a particular orientation may be required, such that user104or at least user device102must be in a particular orientation (e.g., facing one direction and walking backwards to enter area108). In another embodiment, a subsequent action may require the actions of another user212utilizing another user device210. For example, user212may be presented with a different augmented reality portion, such as indicating a switch, trigger, or other action required in which “unlocks” or enables access to the “door” provided by augmented reality portion308. Successfully completing such a spatial challenge by two parties may enable one or both of user104and212to access the secured asset.

FIG. 4depicts secured assets402comprising a secured asset in accordance with embodiments of the present disclosure. In one embodiment, depicted secured assets402depict a corresponding electronic asset, which may be represented by rendered visual objects presented as at least a portion of augmented reality portion308on display302. For example, upon completion of a spatial challenge or authentication challenge comprising at least one spatial challenge, user104via user device102is presented with indicia of secured asset or secured assets402as one or more rendered objects. One or more render objects may be provided as text, symbol, image, geometric shape, object, etc. associated with a one or more secured assets402. One or more rendered objects may present depicted secured assets402themselves, such as text that displays the secured asset (e.g., “Access code to the second floor is ‘1234’”) or require further interaction to obtain the secured asset represented by depicted secured assets402. For example, one of depicted secured assets402may represent a media file and require user104, via user device102and/or other device, to load, play, download, or otherwise obtain the media file. Similarly, an icon or label for a document may be provided by, for example one of depicted secured assets402, which may then be available for presentation on user device102and/or other device associated with user104. In another embodiment, one of depicted secured assets402may be an object such as the subject of a transaction which may then be enabled such that user device102and/or other device associated with user104, is able to perform the transaction, such as a purchase, or obtain a reward or discount code, which may require accessing or obtaining additional information, such as payment information. In another embodiment, one of depicted secured assets402may indicate authorization to a secured location, whereby a code may be provided to obtain access to a controlling device (e.g., keypad door lock), indicia of the location itself, and/or other location information.

FIG. 5illustrates depicted secured asset402D in accordance with embodiments of the present disclosure. In one embodiment, user device102, such as when in possession of user104, is placed proximate to a particular rendered object, the display is zoomed in on a particular rendered object, gestured to indicate a particular rendered object, or other selection means provided to indicate a particular one depicted secured asset402, such a secured asset402is available for interaction as an augmented reality object as presented on display302. Additional information504may be provided such as a label, identifier, number of associated physical items remaining, alternate configurations, etc. User104, via user device102, may then utilize and/or obtain secured information depicted by depicted secure asset402D, such as, obtaining a media file (e.g., audio, video, document, image, etc.), performing a transaction (e.g., purchasing a physical item depicted by depicted secured asset402D), gaining access to a secured location depicted by depicted secured asset402D, etc. In another embodiment, depicted secured asset402D may be manipulated on user device102such as to customize, embellish, select options, etc. for a secured object depicted by depicted secured asset402D.

FIG. 6depicts system600in accordance with embodiments of the present disclosure. In one embodiment, user device102comprises a wireless network interface to network602, which may comprise one or more wired or wireless networks or a combination thereof, to be in communication with server604. Server604may comprise one or more processors and access data storage606, such as a memory location, database, or media (e.g., magnetic, optical, electronic media) to obtain data and/or instructions. For example, server604may receive a request for access to a secured asset by user device102, which optionally has been previously authenticated to user104. In response, server604may access data and/or instructions from data storage606in generate and/or provide an authentication challenge, comprising a spatial challenge, to user device102. User device102then provides an output signal to server604. Upon determining the sensor output signals received by server604indicate compliance with the spatial challenge, the processor may then determine the authentication challenge has been successfully completed or access a subsequent challenge, which may comprise a subsequent spatial challenge, to user device102. If a subsequent challenge is presented to user device102, which comprises a subsequent spatial challenge, a subsequent signal is received from a sensor output of user device102. Upon determining the subsequent sensor output signal indicates compliance with the subsequent spatial challenge, determining the authentication challenge has been successfully completed and granting user104and/or user device102access to the secured asset. It should be appreciated that the authentication challenge comprises one or more spatial challenges and may optionally comprise one or more non-spatial challenge (e.g., provide a user name and password).

In another embodiment, server604may provide instructions to user device102to provide objects to be rendered upon an augmented reality portion of an image displayed on a display of user device102. The rendered objects may illustrate cues on how to successfully complete the spatial challenge and/or indicia of secured assets upon completing the authentication challenge.

In another embodiment, server604and/or user derive102may communicate with other systems and devices, such as user devices of other users, network interfaces, etc. as either a component of a spatial challenge or to allow user104and/or user device102to obtain the secured asset.

FIG. 7depicts process700in accordance with embodiments of the present disclosure. In one embodiment, optional step702authenticates a user to a user device, such as user104to user device102, which may comprise user104entering a password, code, and/or presenting a body portion of user104to a sensor (e.g., camera) of user device102for imaging and biometric recognition, or speaking for capture by a sensor (e.g., microphone) to perform speech-based identification of user102.

Step704presents a spatial challenge upon user device102. Alternatively, the presentation of the spatial challenge may be provided by audio output or via another component. Accordingly, the presentation may be visual, as presented on a display of user device102; audio, as presented by a speaker of user device102, haptic, as presented by a vibrator of user device102, etc. Next, step706determines whether the spatial challenge has been successfully completed. In one embodiment, a sensor of user device102outputs signals to a processor, which may be a processor of user device102and/or a server604in communication with user device102. The output signals are compared to a model signal known to indicate compliance. The model signal may be an average of a plurality of observed successful completions or other signal associated with an ideal completion of the spatial challenge. If the output signals match the model signal, or differ in a previously determined acceptable type and/or amount, step706is determined in the affirmative, otherwise step706is determined in the negative.

Step708determines if there are more challenges and, if determined in the affirmative, step710selects the next challenge. Process700then continues to step704utilizing the selected next challenge. If step708is determined in the negative, process700may continue to step712whereby access to the secured asset is provided. Should step706be determined in the negative, step714may deny access to the secured asset. Alternatively, step706may allow process700to be restarted with the same and/or different spatial challenge or challenges.