Intelligent authentication mechanism for applications

Aspects of the disclosure relate to user authentication. A computing platform may validate, after launch of an application, initial authentication credentials and geolocation information for a user of a client device. The computing platform may cause the client device to activate the integrated camera. The computing platform may receive, from the client device, video information indicating multiple viewpoints from perspectives of the client device, and including any individuals within a predetermined distance of the client device. The computing platform may generate faceprints, each corresponding to one of the individuals within the predetermined distance. The computing platform may compare, using an AI engine, the faceprints to stored faceprints of authenticated users. Based on identifying that at least one of the individuals is not authenticated, the computing platform may mask an application user interface for the application. The computing platform may direct the client device to display the masked application user interface.

BACKGROUND

Aspects of the disclosure relate to computing hardware and software, particularly distributed computing hardware and software configured for authentication and information display. In some instances, enterprise users may launch an application, and may be prompted for log in credentials such as a user name and password. Once authenticated via the log in credentials, the users may be granted access to the application. However, in some instances, once initial access is granted to the user, other unauthenticated users (who may e.g., enter and leave a room, shift positions within a room, or the like) may be able to view the application. In some instances, such applications may display confidential or otherwise sensitive information. Given the importance of information security, it may be important to prevent access to such sensitive information by unauthorized users.

SUMMARY

Aspects of the disclosure provide effective, efficient, scalable, and convenient technical solutions that address and overcome the technical problems associated with user authentication and interface masking. In accordance with one or more embodiments of the disclosure, a computing platform comprising at least one processor, a communication interface, and memory storing computer-readable instructions may validate, after launch of an application, initial authentication credentials for a user of a client device. After validating the initial authentication credentials, the computing platform may validate geolocation information of the client device. After validating the geolocation information of the client device, the computing platform may send one or more commands directing the client device to activate an integrated camera, which may cause the client device to activate the integrated camera. The computing platform may receive, from the client device, video information indicating multiple viewpoints from perspectives of the client device, and including any individuals within a predetermined distance of the client device. The computing platform may generate, from the video information, one or more faceprints, each corresponding to one of the individuals within the predetermined distance of the client device. The computing platform may compare, using an artificial intelligence (AI) engine the one or more faceprints to stored faceprints of authenticated users. Based on identifying that at least one of the individuals is not authenticated, the computing platform may mask an application user interface for the application. The computing platform may send, to the client device, one or more commands directing the client device to display the masked application user interface, which may cause the client device to display the masked application user interface.

In one or more instances, the computing platform may fail to validate, for a second user, the initial authentication credentials. Based on failing to validate the initial authentication credentials for the second user, the computing platform may: 1) mask the application user interface for the application, and 2) send, to the client device, the one or more commands directing the client device to display the masked application user interface, which may cause the client device to display the masked application user interface.

In one or more examples, the computing platform may fail to validate, for a second user, the geolocation information. Based on failing to validate the geolocation information for the second user, the computing platform may: 1) mask the application user interface for the application, and 2) send, to the client device, the one or more commands directing the client device to display the masked application user interface, which may cause the client device to display the masked application user interface.

In one or more instances, based on identifying that all of the individuals are authenticated, the computing platform may determine that the application user interface for the application may be displayed. The computing platform may send, to the client device, one or more commands directing the client device to display the application user interface, which may cause the client device to display the application user interface.

In one or more examples, the computing platform may receive historical image information comprising images of users and corresponding labels indicating whether or not the corresponding user is authenticated. The computing platform may train, using the historical image information, the AI engine to distinguish between authenticated and non-authenticated users based on the one or more faceprints.

In one or more instances, the computing platform may receive historical application sensitivity information comprising application names and corresponding labels indicating whether or not the corresponding applications include sensitive data. The computing platform may train, using the historical application sensitivity information, the AI engine to distinguish between applications that include the sensitive data and non-sensitive data based on current application sensitivity information.

In one or more examples, the computing platform may determine, using the AI engine, whether the application includes the sensitive data, and validating the initial authentication credentials may be in response to determining that the application includes sensitive data. In one or more examples, the AI engine may be a convolutional neural network (CNN).

In one or more instances, masking the application user interface may include inputting the application user interface into a chaotic sha-3 algorithm to transform the application user interface to greyscale, and inputting the application user interface into the chaotic sha-3 algorithm may include: 1) scrambling pixel values of the application user interface based on a chaotic parameter input for each pixel, 2) compressing the scrambled pixel values using batch normalization, and 3) pooling the compressed scrambled pixel values.

In one or more examples, the scrambled pixel values may be uncorrelated. In one or more examples, the computing platform may decrypt the masked application user interface using the chaotic parameter input.

In one or more instances, new video information may be continuously analyzed by the computing device to detect a presence of a new individual within the predetermined distance, and the authentication process may be repeated based on detection of the presence of the new individual.

DETAILED DESCRIPTION

In the following description of various illustrative embodiments, reference is made to the accompanying drawings, which form a part hereof, and in which is shown, by way of illustration, various embodiments in which aspects of the disclosure may be practiced. In some instances, other embodiments may be utilized, and structural and functional modifications may be made, without departing from the scope of the present disclosure.

As a brief introduction to the concepts described further herein, one or more aspects of the disclosure relate to improved user authentication and interface masking. For example, information security may be an integral part of enterprise organizations. Accordingly, it may be important to modify security protocols to avoid security breaches.

Authentication methods may be restricted to the input of log in credentials, and access may be governed by rights assigned to the used who may be authenticated. However, although there may be procedures for initial log-in, further checks might not be performed to verify if the applications, system screens, and/or terminals are being viewed by the same authorized personnel or not. Such absence of a fool proof method to prevent unauthorized access may be a gap in current access security frameworks.

In some instances, applications such as trading applications may have access to sensitive customer data (e.g., unique user identifier, account details, or the like), which may benefit from enhanced security and/or authorization mechanisms. An intelligent authentication mechanism may be powered by a deep learning algorithm, and may be aimed at incorporating facial recognition as a way of recognizing a human face. Accordingly, personal identity may be verified throughout the application usage. Restrictions from other viewing angles and geolocation may be additional parameters used to validate the authentication. Upon failure of authentication, the application window may be masked.

In some instances, the intelligent authentication mechanism may be able to detect fake video (e.g., poor pixel clarity, a separate video clip of an individual, or the like). The solution may feed intermittent visual snippets of the user to the intermittent real-time facial module, which may validate the user by comparing it with the recent video snippet when the user is moving in and out from the application, device, or otherwise from the video frame.

Accordingly, access control and continuous authentication of applications may be performed for users/employees performing financial transactions by implementing an intermittent real time facial identification as an authentication mechanism for critical front-end applications. Accordingly, the application might not be viewed by others from any other viewing angle (e.g., by implementing a chaotic sha-3 algorithm) other than the authenticated user in front of the webcam. Additionally, the user's geolocation may be a parameter to authenticate and view the application to prevent any form of unauthorized access or hacking from other regions. In some instances, the application front end may be masked if any of the above authentication fails.

These and other features are described in further detail below.

FIGS.1A-1Bdepict an illustrative computing environment that provides improved user authentication and interface masking in accordance with one or more example embodiments. Referring toFIG.1A, computing environment100may include one or more computer systems. For example, computing environment100may include intelligent authentication platform102, client device103, administrator computing device104, and data storage system105.

As described further below, intelligent authentication platform102may be a computer system that includes one or more computing devices (e.g., servers, server blades, or the like) and/or other computer components (e.g., processors, memories, communication interfaces) that may be used to perform user authentication and mask user interfaces as described further below. In these instances, the intelligent authentication platform102may be configured to train, host, and/or otherwise maintain an artificial intelligence engine that may be used to identify sensitive applications, authenticate users based on faceprints, and/or perform other functions.

Client device103may be and/or otherwise include one or more devices such as a laptop computer, desktop computer, mobile device, tablet, smartphone, and/or other device that may be used by an individual to access an application interface (which may, in some instances, include sensitive information). In some instances, the client device103may be configured to receive user input requesting access to one or more applications, some of which may include sensitive data. The client device103may be configured to launch such applications, and prompt for authentication. In some instances, the client device103may be configured with a web camera and/or other video or photo camera configured to capture video and/or images from different perspectives of the client device103. In some instances, client device103may be configured to display one or more user interfaces (e.g., application interfaces, masked application interfaces, or the like). Although a single client device103is shown, any number of such devices may be deployed in the systems/methods described below without departing from the scope of the disclosure.

Administrator computing device104may be and/or otherwise include one or more devices such as a laptop computer, desktop computer, mobile device, tablet, smartphone, and/or other device that may be used by an individual to monitor network or system security. In some instances, the administrator computing device104may be configured to display one or more user interfaces (e.g., application interfaces, masked application interfaces, or the like). Although an administrator computing device104is shown, any number of such devices may be deployed in the systems/methods described below without departing from the scope of the disclosure.

Data storage system105may be and/or otherwise include one or more computing devices (e.g., servers, server blades, and/or other devices) and/or other computer components (e.g., processors, memories, communication interfaces) that may be used to train the artificial intelligence engine of the intelligent authentication platform102. For example, data storage system105may be configured to store historical application information, faceprints, and/or other information, and may be configured to communicate with the intelligent authentication platform102.

Computing environment100also may include one or more networks, which may interconnect intelligent authentication platform102, client device103, administrator computing device104, and/or data storage system105. For example, computing environment100may include a network101(which may interconnect, e.g., intelligent authentication platform102, client device103, administrator computing device104, and/or data storage system105).

In one or more arrangements, intelligent authentication platform102, client device103, administrator computing device104, and/or data storage system105may be any type of computing device capable of sending and/or receiving requests and processing the requests accordingly. For example, intelligent authentication platform102, client device103, administrator computing device104, data storage system105, and/or the other systems included in computing environment100may, in some instances, be and/or include server computers, desktop computers, laptop computers, tablet computers, smart phones, and/or other devices that may include one or more processors, memories, communication interfaces, storage devices, and/or other components. As noted above, and as illustrated in greater detail below, any and/or all of intelligent authentication platform102, client device103, administrator computing device104, and/or data storage system105may, in some instances, be special-purpose computing devices configured to perform specific functions.

Referring toFIG.1B, intelligent authentication platform102may include one or more processors111, memory112, and communication interface113. A data bus may interconnect processor111, memory112, and communication interface113. Communication interface113may be a network interface configured to support communication between intelligent authentication platform102and one or more networks (e.g., network101, or the like). Memory112may include one or more program modules having instructions that when executed by processor111cause intelligent authentication platform102to perform one or more functions described herein and/or one or more databases that may store and/or otherwise maintain information which may be used by such program modules and/or processor111. In some instances, the one or more program modules and/or databases may be stored by and/or maintained in different memory units of intelligent authentication platform102and/or by different computing devices that may form and/or otherwise make up intelligent authentication platform102. For example, memory112may have, host, store, and/or include intelligent authentication module112a,intelligent authentication database112b,and/or artificial intelligence (AI) engine112c.

Intelligent authentication module112amay have instructions that direct and/or cause intelligent authentication platform102to execute advanced techniques for user authentication and interface masking, as discussed in greater detail below. Intelligent authentication database112bmay be or include. Artificial intelligence engine112cmay have instructions that direct and/or cause the intelligent authentication platform102to perform user authentication, interface masking, and/or to set, define, and/or iteratively refine optimization rules and/or other parameters used by the intelligent authentication platform102and/or other systems in computing environment100.

FIGS.2A-2Hdepict an illustrative event sequence for improved user authentication and interface masking in accordance with one or more example embodiments. Referring toFIG.2A, at step201, the intelligent authentication platform102may establish a connection with the data storage system105. For example, the intelligent authentication platform102may establish a first wireless data connection with the data storage system105to link the intelligent authentication platform102to the data storage system105(e.g., in preparation for requesting historical information). In some instances, the intelligent authentication platform102may identify whether or not a connection is already established with the data storage system105. If a connection is already established with the data storage system105, the intelligent authentication platform102might not re-establish the connection. If a connection is not yet established with the data storage system105, the intelligent authentication platform102may establish the first wireless data connection as described herein.

At step202, the intelligent authentication platform102may request historical information from the data storage system105. For example, the intelligent authentication platform102may request historical images such as images of enterprise employees who may have authorization (or at least some level of authorization) within the enterprise to view application interfaces that include sensitive information (e.g., account numbers, unique user identifiers, account balances, account holdings, credentials, and/or other sensitive information). In addition, the intelligent authentication platform102may request historical application information indicating information displayed by, accessed, or otherwise affiliated with various applications, which may e.g., be either sensitive or non-sensitive. For example, information for a trading application may indicate that it is sensitive, whereas information for a web browser might not be sensitive. In some instances, the intelligent authentication platform102may request the historical image and application information via the communication interface113and while the first wireless data connection is established.

At step203, the data storage system105may send the requested historical information (e.g., historical image information and historical application information) to the intelligent authentication platform102. For example, the data storage system105may send the requested historical information to the intelligent authentication platform102while the first wireless data connection is established.

At step204, the intelligent authentication platform102may receive the historical information sent at step203. For example, the intelligent authentication platform102may receive the historical image information and historical application information via the communication interface113and while the first wireless data connection is established.

At step205, the intelligent authentication platform102may train the AI engine112cusing the historical image information and the historical application information. For example, the intelligent authentication platform102may feed the historical image information, which may, e.g., include images of both authorized and/or unauthorized individuals, and corresponding labels indicating whether or not the corresponding image depicts an authorized or unauthorized individual, into the AI engine112c.This may train the AI engine112c(which may, e.g., be a supervised learning engine) to distinguish between authorized and unauthorized individuals, in real time, based on historical labelled data. In some instances, in training the AI engine112c,the intelligent authentication platform102may train a convolutional neural network (CNN).

In addition, the intelligent authentication platform102may input the historical application information into the AI engine112c,along with corresponding labels indicating an associated application name and whether or not that application displays or includes sensitive information. This may train the AI engine112c(once again, in a supervised learning process) to distinguish between applications that use, display, or otherwise implement sensitive data, and those that do not. Once the AI engine112cis trained, it may be used to perform authentication and/or grant application access accordingly, as described further below.

Referring toFIG.2B, at step206, the client device103may launch an application. In some instances, the client device103may automatically launch the application, or may launch the application in response to a user input requesting that the application be launched. In some instances, the client device103may launch an application that includes or otherwise displays sensitive data (e.g., banking application, trading application, sensitive messaging application, and/or other sensitive application), or may launch an application that does not include such sensitive data (e.g., web browser, video conferencing, word processor, slide deck application, and/or other non-sensitive applications).

At step207, the client device103may establish a connection with the intelligent authentication platform102. For example, the client device103may establish a second wireless data connection to link the client device103to the intelligent authentication platform102(e.g., in preparation for communicating information of the launched application). In some instances, the client device103may identify whether or not a connection is already established with the intelligent authentication platform102. If a connection is already established with the intelligent authentication platform102, the client device103might not establish the connection. If a connection is not yet established with the intelligent authentication platform102, the client device103may establish the second wireless data connection as described herein.

At step208, the client device103may communicate with the intelligent authentication platform102to provide information of the launched application that may be used to determine its sensitivity. For example, the client device103may share an application name, information about the application (e.g., data used or otherwise displayed by the application), and/or other information.

At step209, the intelligent authentication platform102may feed the application information, received at step208, into the AI engine112c.In doing so, the AI engine112cmay analyze the application information using supervised learning techniques (e.g., a CNN), which may compare the application information to historical application information stored in the AI engine112cto identify whether the launched application includes sensitive information or not. If the intelligent authentication platform102determines that the application does not include sensitive information, it may proceed to step226. In doing so, the intelligent authentication platform102may conserve processing resources by only applying further authentication and/or masking techniques for sensitive applications. If the intelligent authentication platform102determines that the application does include sensitive information, it may proceed to step210.

Referring toFIG.2C, at step210, the client device103may receive initial authentication credentials for the application. For example, the client device103may receive a user name and password combination, authentication token, and/or other authentication mechanism (e.g., via a user interface of the client device103).

At step211, the client device103may send initial authentication information to the intelligent authentication platform102(e.g., based on the initial authentication credentials). For example, the client device103may send the initial authentication information to the intelligent authentication platform102while the second wireless data connection is established.

At step212, the intelligent authentication platform102may receive the initial authentication information sent at step211. For example, the intelligent authentication platform102may receive the initial authentication information via the communication interface113and while the second wireless data connection is established.

At step213, the intelligent authentication platform102may attempt to validate the initial authentication information received at step212. For example, the intelligent authentication platform102may compare the received authentication information to anticipated or otherwise previously validated authentication information. If the intelligent authentication platform102identifies that the initial authentication information is invalid, the intelligent authentication platform102may proceed to step229. In doing so, the intelligent authentication platform102may conserve processing resources by avoiding further authentication mechanisms if the initial authentication information is invalid. If the intelligent authentication platform102identifies that the initial authentication information is valid, it may proceed to step214.

At step214, the client device103may send geolocation information (e.g., of the client device103) to the intelligent authentication platform102. For example, the client device103may send the geolocation information to the intelligent authentication platform102while the second wireless data connection is established.

At step215, the intelligent authentication platform102may receive the geolocation information sent at step214. For example, the intelligent authentication platform102may receive the geolocation information via the communication interface113and while the second wireless data connection is established.

Referring toFIG.2D, at step216, the intelligent authentication platform102may validate the geolocation information. For example, the intelligent authentication platform102may compare the geolocation information against a known list of valid geolocations, which may, e.g., correspond to office locations of the enterprise or other trusted locations. If the intelligent authentication platform102determines that the geolocation information is invalid, the intelligent authentication platform102may proceed to step229. In doing so, the intelligent authentication platform102may conserve processing resources by avoiding further authentication mechanisms if the geolocation information is invalid. If the intelligent authentication platform102determines that the geolocation information is valid, the intelligent authentication platform102may proceed to step217.

At step217, the intelligent authentication platform102may send one or more commands to the client device103directing the client device103to activate an integrated or otherwise connected camera (e.g., webcam, video camera, photo camera, or other camera). In some instances, the intelligent authentication platform102may send the camera initiation commands to the client device103via the communication interface113and while the second wireless data connection is established.

At step218, the client device103may receive the camera initiation commands sent at step217. For example, the client device103may receive the camera initiation commands while the second wireless data connection is established.

At step219, based on or in response to the camera initiation commands, the client device103may activate the camera. For example, the client device103may configure the camera to capture video frame, photos, and/or other information at a plurality of perspectives (e.g., of the client device103). For example, in some instances, the camera may be configured to rotate up and down and/or from side to side to capture additional perspectives.

At step220, the client device103may use the camera to capture video input. For example, the client device103may capture video footage from multiple perspectives, which may, in some instances include one or more individuals within a predetermined distance of the client device103(and thus, may, in some instances, hypothetically be able to view content displayed at the client device). For example, the client device103may capture video input that includes a user of the client device103, who may be directly in front of the client device103, and/or one or more individuals in the background, to the side, and/or otherwise present within the predetermined distance of the client device103.

Referring toFIG.2E, at step221, the client device103may send video information (e.g., the video input captured at step220) to the intelligent authentication platform102. For example, the client device103may send the video information to the intelligent authentication platform102via the communication interface113and while the second wireless data connection is established.

At step222, the intelligent authentication platform102may receive the video information sent at step221. For example, the intelligent authentication platform102may receive the video information via the communication interface113and/or while the second wireless data connection is established.

At step223, the intelligent authentication platform102may generate faceprints based on the video information. For example, the intelligent authentication platform102may perform one or more facial recognition techniques to identify one or more individuals within view of the client device103, and to generate images of these individuals that may be compared to the stored/authenticated historical image information of the AI engine112c.In some instances, in identifying the one or more individuals, the intelligent authentication platform102may also tag each faceprint based on a perspective of the corresponding individual (e.g., is the individual directly in front of the client device103(e.g., a user of the client device103), an onlooker next to the user of the client device103, located in the periphery, or otherwise located within the predetermined distance of the client device103).

At step224, the intelligent authentication platform102may compare the faceprints, generated at step223, to the historical image information of the AI engine112c.For example, the intelligent authentication platform102may feed the faceprints into the AI engine112c,which may use one or more supervised learning techniques (e.g., such as CNN) to identify whether individuals corresponding to the faceprints are authenticated. For example, if the intelligent authentication platform102detects a match between at least one faceprint and the authenticated historical image information, the intelligent authentication platform102may determine that individuals corresponding to the at least one faceprint are authenticated. If the intelligent authentication platform102does not detect a match between at least one faceprint and the authenticated historical image information (and/or detects a match between at least one faceprint and the authenticated historical image information), the intelligent authentication platform may determine that individuals corresponding to the at least one faceprint are not authenticated. In some instances, the intelligent authentication platform102may determine that all individuals are authenticated, some individuals are authenticated/others are not authenticated, or that all individuals are not authenticated.

At step225, the intelligent authentication platform102may generate one or more decisions about whether to conceal or expose the application interface based on the authentication results of the faceprint matching at step224. For example, if the intelligent authentication platform102determined that all individuals are authenticated, the intelligent authentication platform102may determine that the application interface may be displayed in its regular state, and may proceed to step226. If the intelligent authentication platform102determined that all individuals were not authenticated, the intelligent authentication platform102may determine that the application interface should be masked, and may proceed to step229. If the intelligent authentication platform102determined that some individuals were authenticated and others were not, the intelligent authentication platform102may determine that the application interface should be masked (to the extent possible) from those not authenticated individuals, while displaying the application interface in its regular state to the authenticated individuals (e.g., the application interface may appear masked to those viewing from the periphery, but might not be masked to a direct user of the client device103). In these instances, the intelligent authentication platform102may perform a hybrid masking procedure that may include the steps of both the normal display process of steps226-228and the masking procedure of steps229-232.

Referring toFIG.2F, at step226, the intelligent authentication platform102may send one or more commands to the client device103directing the client device to display the application interface in its regular state (e.g., not masked) (e.g., based on a determination that all users are authenticated). For example, the intelligent authentication platform102may send the one or more application display commands to the client device103via the communication interface113and while the second wireless data connection is established.

In some instances, the intelligent authentication platform102might not have previously masked the application user interface, and thus may proceed with directing the client device103to display the application interface accordingly as described above. However, in some instances, the intelligent authentication platform102may have previously masked the application user interface, and thus might need to unmask/decrypt the application user interface prior to directing the client device103to display it. In these instances, the intelligent authentication platform102may use convolutional decoding, batch normalization, upsampling, and/or softmax methods to decrypt the masked application user interface. As described below, in some instances, pixels of the original image may have been scrambled and encoded using a chaotic parameter for increased security. In these instances, the intelligent authentication platform102may use this chaotic parameter to revert the previously scrambled pixels to their original state, which may result in the original application user interface. Once decrypted, the intelligent authentication platform102may direct the client device103to display the application user interface accordingly.

At step227, the client device103may receive the one or more application display commands sent at step226. For example, the client device103may receive the one or more application display commands while the second wireless data connection is established.

At step228, based on or in response to the one or more application display commands, the client device103may display the application user interface in its regular, unmasked state (which may, e.g., include sensitive information). For example, the client device103may display a graphical user interface similar to graphical user interface405, which is shown inFIG.4, and which depicts the interface of a sensitive application. If no masking is to be performed, the event sequence may then proceed to step237.

At step229, the intelligent authentication platform102may mask the application user interface (e.g., based on a determination that all users are not authenticated). For example, the intelligent authentication platform102may feed the application user interface into a chaotic sha-3 algorithm, which may use convolutional encoding, batch normalization, and pooling to encode the application user interface. In doing so, the intelligent authentication platform102may produce a greyscale image, which might not reveal any sensitive information, which might otherwise be displayed on the application user interface. In some instances, the intelligent authentication platform102may perform scrambling of the original application user interface image, and may encrypt each scrambled pixel using a chaotic parameter (which may, e.g., be automatically and/or randomly generated, input by a user, or otherwise generated). In these instances, the intelligent authentication platform102may scramble the pixel values of the application user interface based on the chaotic parameters, compress the scrambled pixel values using batch normalization, and pool the compressed scrambled pixel values. In these instances, scrambling the pixel values may result in an uncorrelated group of pixel values. Combining this technique of scrambling with the implementation of the chaotic sha-3 algorithm may provide a technical improvement over any existing image masking techniques by introducing a further level of security (e.g., the chaotic parameter), which may be needed to subsequently decrypt the application user interface (and which may thus increase security accordingly).

At step230, the intelligent authentication platform102may send one or more commands directing the client device103to display the masked application interface. For example, the intelligent authentication platform102may send the one or more masked application display commands via the communication interface113and while the second wireless data connection is established.

At step231, the client device103may receive the one or more masked application display commands sent at step230. For example, the client device103may receive the one or more masked application display commands while the second wireless data connection is established.

Referring toFIG.2G, at step232, based on or in response to the one or more masked application display commands, the client device103may display the masked application interface (which may, e.g., be a greyscale interface in which any sensitive information is masked). For example, the client device103may display a graphical user interface similar to graphical user interface505, which is shown inFIG.5, and which comprises a greyscale image.

At step233, the intelligent authentication platform102may establish a connection with the administrator computing device104. For example, the intelligent authentication platform102may establish a third wireless data connection with the administrator computing device104to link the intelligent authentication platform102to the administrator computing device104(e.g., in preparation for sending an unauthorized user notification). In some instances, the intelligent authentication platform102may identify whether a connection is already established with the administrator computing device104. If a connection is already established with the administrator computing device104, the intelligent authentication platform102might not re-establish the connection. If a connection is not yet established with the administrator computing device104, the intelligent authentication platform102may establish the third wireless data connection as described herein.

At step234, the intelligent authentication platform102may send an unauthorized user notification to the administrator computing device104indicating that one or more unauthorized users attempted to access a sensitive application. In some instances, the intelligent authentication platform102may also send one or more commands directing the administrator computing device104to display the unauthorized user notification. For example, the intelligent authentication platform102may send the unauthorized user notification and the one or more commands directing the administrator computing device104to display the unauthorized user notification via the communication interface113and while the third wireless data connection is established.

At step235, the administrator computing device104may receive the unauthorized user notification. In some instances, the administrator computing device104may also receive the one or more commands directing the administrator computing device104to display the unauthorized user notification. For example, the administrator computing device104may receive the unauthorized user notification and the one or more commands directing the administrator computing device104to display the unauthorized user notification while the third wireless data connection is established.

At step236, based on or in response to the one or more commands directing the administrator computing device104to display the unauthorized user notification, the administrator computing device104may display the unauthorized user notification. For example, the administrator computing device104may display a graphical user interface similar to graphical user interface605, which is illustrated inFIG.6. For example, the administrator computing device104may notify a security analyst, administrator, and/or other individual that an unauthorized access attempt has been detected, and may prompt the individual to take action accordingly (or may, in some instances, cause automated remediation to occur). For example, in some instances, the administrator computing device104may receive user feedback re-enforcing a determination that a particular individual is not authorized to access the application interface. Additionally or alternatively, the administrator computing device104may receive user feedback indicating that an individual, identified as unauthorized, is in fact authorized. In either instance, the administrator computing device104may provide this feedback to the intelligent authentication platform102for use in further refining the AI engine112c.

Referring toFIG.2H, at step237, the intelligent authentication platform102may dynamically refine the AI engine112cusing the faceprints, decisions about whether or not to mask application interfaces for individuals corresponding to the faceprints, the administrator feedback, and/or other information. For example, the intelligent authentication platform102may implement a dynamic feedback loop that may be used to iteratively refine the AI engine112c,and thus improve performance, accuracy, and efficiency of the AI engine. Specifically, the intelligent authentication platform102may continue to train the AI engine112cin a supervised manner using the above describe information.

At step238, the intelligent authentication platform102may detect that a new user has entered within the predetermined distance of the client device103. For example, the client device103may continuously provide the video information to the intelligent authentication platform102in real time for analysis. Once application interface exposure and masking decisions have been made for a particular group of individuals, present within the predetermined distance of the client device103at a particular time, the intelligent authentication platform102may maintain the implemented regular/masked displays until detection of a new individual entering the predetermined distance of the client device103. For example, if such an individual is detected, authentication may be performed as described above. In some instances, the intelligent authentication platform102may similarly re-perform masking decisions based on movement of existing individuals within the predetermined distance. For example, if an unauthorized individual was previously in the periphery of the client device103, and thus the interface was being masked for their perspective, but not masked for a user of the client device103(e.g., who may be directly in front of the client device103), but now has relocated to viewing the client device103over the shoulder of the user of the client device103(or otherwise directly in front of the client device103), the intelligent authentication platform102may re-perform the masking decision (which may, e.g., result in masking the user interface for both the authorized user and the unauthorized user, given that they are both now viewing the client device103from the same perspective). In instances where such re-authentication or re-determination of whether to mask is to be performed, the event sequence may return to steps223or225respectively.

In doing so, a method is described that addresses the current absence of a fool proof method to prevent unauthorized access to high risk applications. Continuous authentication may be performed using cognitive intelligence for employees who may, in some examples, be using high risk applications. Furthermore, access may be encrypted (e.g., greyed out) from any other viewing angles other than perpendicular to the screen using a chaotic sha-3 algorithm. In addition, continuous authentication may be performed along with viewing angle restrictions and geo-location verification to secure an application.

FIG.3depicts an illustrative method for improved user authentication and interface masking in accordance with one or more example embodiments. Referring toFIG.3, at step305, a computing platform having at least one processor, a communication interface, and memory may request and receive historical information (e.g., image information, application information, and/or other information). At step310, the computing platform may train an AI engine using the historical information. At step320, the computing platform may receive current application information from a client device (e.g., from a launched application). At step325, the computing platform may identify whether the application includes sensitive information. If the application does not include sensitive information, the computing platform may proceed to step370. If the application does include sensitive information, the computing platform may proceed to step330.

At step330, the computing platform may receive authentication credentials for the application. At step335, the computing platform may identify whether or not the authentication credentials are valid. If the authentication credentials are not valid, the computing platform may proceed to step375. If the authentication credentials are valid, the computing platform may proceed to step340.

At step340, the computing platform may receive geolocation information. At step345, the computing platform may identify whether or not the geolocation information is verified. If the geolocation is not verified, the computing platform may proceed to step375. If the geolocation is verified, the computing platform may proceed to step350.

At step350, the computing platform may direct the client device to activate a webcam. At step355, the computing platform may receive video information from the webcam/client device. At step360, the computing platform may generate faceprints based on the video information. At step365, the computing platform may determine whether or not the faceprints are authenticated. If the faceprints are not authenticated, the computing platform may proceed to step375. If the faceprints are authenticated, the computing platform may proceed to step370.

At step370, the computing platform may direct the client device to display an unobscured interface for the application. At step375, the computing platform may generate a masked application interface. At step380, the computing platform may direct the client device to display a masked application interface. At step385, the computing platform may send an unauthorized user notification to an administrator device. At step390, the computing platform may update the AI engine based on the video information, the faceprints, administrative feedback, and/or other information. At step395, the computing platform may identify whether a new user is detected. If a new user is detected, the computing platform may return to step360. If no new users are detected, the computing platform may return to step395, so as to perform continuous monitoring for new users.