Patent Publication Number: US-10764281-B1

Title: Systems and methods for authenticating a user using an image capture device

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
     This application claims priority from and benefit of U.S. Provisional Application Ser. No. 62/444,173, filed Jan. 9, 2017, entitled “Systems and Methods for Authenticating a User Using an Image Capture Device,” which is hereby incorporated by reference in its entirety for all purposes. 
    
    
     BACKGROUND 
     The present disclosure relates generally to authenticating a user, and more particularly to systems and methods for authenticating the user using an image capture device. 
     This section is intended to introduce the reader to various aspects of art that may be related to various aspects of the present disclosure, which are described and/or claimed below. This discussion is believed to help provide the reader with background information to facilitate a better understanding of the various aspects of the present disclosure. Accordingly, it is understood that these statements are to be read in this light, and not as admissions of prior art. 
     A user authentication system may authenticate users attempting to access account information (e.g., of a financial account, an insurance account, a social media account, an electronic device profile, and the like). The user authentication system determines whether a user is who they declare to be. The user authentication system may compare credentials provided by the user to those stored in a database of authorized users&#39; information. In human-to-computer interactions, the user typically enters or chooses a username and enters a password or personal identification number via an input device, such as a keyboard, touchscreen, card reader, and the like. However, user names and passwords may be guessed, stolen, or accidentally revealed. For example, user names are frequently a combination of a user&#39;s first initial and last name. As another example, users often base passwords on date formats or phone numbers, making them easier to determine. 
     Some user authentication systems include biometric verification. For example, such user authentication systems may use facial recognition, retinal scanning, fingerprint analysis, and the like, to authenticate the identity of a user. Some user authentication systems may include recognizing natural movements or thermal capture of the user to determine that the user is a live person, and not a still image or video capture used to falsify the identity of the user. 
     However, collecting such biometric information or evidence of a live person may use additional hardware beyond an image capture device, and thus be expensive to implement. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       Various aspects of this disclosure may be better understood upon reading the following detailed description and upon reference to the drawings in which: 
         FIG. 1  is a user authentication system that includes an example electronic device that may authenticate a user, in accordance with an embodiment of the present disclosure; 
         FIG. 2  is the user authentication system of  FIG. 1  using another example electronic device, in accordance with an embodiment of the present disclosure; 
         FIG. 3  is a block diagram of the user authentication system of  FIG. 1 , in accordance with an embodiment of the present disclosure; 
         FIG. 4  is a flowchart illustrating a method for setting authentication information for a user, in accordance with an embodiment of the present disclosure; and 
         FIG. 5  is a flowchart illustrating a method for authenticating a user, in accordance with an embodiment of the present disclosure. 
     
    
    
     DETAILED DESCRIPTION OF SPECIFIC EMBODIMENTS 
     One or more specific embodiments will be described below. In an effort to provide a concise description of these embodiments, not all features of an actual implementation are described in the specification. It should be appreciated that in the development of any such actual implementation, as in any engineering or design project, numerous implementation-specific decisions must be made to achieve the developers&#39; specific goals, such as compliance with system-related and business-related constraints, which may vary from one implementation to another. Moreover, it should be appreciated that such a development effort might be complex and time consuming, but would nevertheless be a routine undertaking of design, fabrication, and manufacture for those of ordinary skill having the benefit of this disclosure. 
     The present disclosure relates generally to authenticating a user, and more particularly to systems and methods for authenticating the user using an image capture device. Such systems and methods may include authenticating the user matching a sequence of gestures, expressions, and the like, set up at a previous time by the user. Advantageously, the disclosed systems and methods may be implemented using less hardware than comparable systems that use biometric verification. 
     With the foregoing in mind,  FIG. 1  is a user authentication system  10  that includes an example electronic device  12  that may authenticate a user  14 , in accordance with an embodiment of the present disclosure. The electronic device  12 , such as an automatic teller machine, a passport verification machine, and the like, may provide a product or service to the user  14 . The electronic device  12  includes an image or video capture device  16  that captures images or videos of the user  14 . In some embodiments, the images may be frames that collectively form a video of the user  14 . The image capture device  16  may have any suitable viewing angle or range  18 , such that a face, portion of a body, or entire body of the user  14  may be captured. 
     The electronic device  12  may include an electronic display  20  that outputs information to the user  14 . The information may include instructions (e.g., authentication instructions) to the user  14  and/or information (e.g., account information of the user  14 ) requested by the user  14 . In some embodiments, the electronic display  20  may include touch functionality (e.g., in the form of a touch screen). As such, the user  14  may use the electronic display  20  to input information (e.g., changes to an account of the user  14 , authentication information, and the like). 
     The electronic device  12  may also include one or more input devices  22 , such as buttons, dials, a keyboard, a mousing device, a trackpad, a microphone, a retinal scanner, a fingerprint reader, a card reader, and the like. The input devices  22  may be used to enter authentication information, account information, changes to account information, and the like. The electronic device  12  may also include one or more output devices  24 , such as additional electronic displays  20  to provide information to the user  14  or dispensers to provide goods or other physical objects (e.g., for cash, tickets, receipts, and the like) to the user  14 . 
       FIG. 2  is the user authentication system  10  of  FIG. 1  using another example electronic device  12 , in accordance with an embodiment of the present disclosure. The electronic device  12  may be a mobile electronic device (e.g., a smartphone, a wearable device, a laptop, and the like) or a personal electronic device (e.g., a personal computer) of the user  14 . As with the electronic device  12  of  FIG. 1 , the electronic device  12  of  FIG. 2  may include the image capture device  16  that has any suitable viewing angle or range  18 , such that a face, portion of a body, or entire body of the user may be captured. The electronic device  12  may include the electronic display  20  that outputs information to the user  14 . In some embodiments, the electronic display  20  may include touch functionality. The electronic device  12  may also include the one or more input devices  22 . 
       FIG. 3  is a block diagram of the user authentication system  10  of  FIG. 1 , in accordance with an embodiment of the present disclosure. The user authentication system  10  includes a controller  30  that includes one or more processors  32  and one or more memory devices  34 . The one or more processors  32  (e.g., microprocessors) may execute software programs and/or instructions to authenticate a user  14 . Moreover, the one or more processors  32  may include multiple microprocessors, one or more “general-purpose” microprocessors, one or more special-purpose microprocessors, and/or one or more application specific integrated circuits (ASICs), or some combination thereof. For example, the one or more processors  32  may include one or more reduced instruction set (RISC) processors. The one or more memory devices  34  may store information such as control software, look up tables, configuration data, etc. In some embodiments, the one or more memory devices  34  may store credentials set by the user  14  to compare to for authentication. In some embodiments, the one or more processors  32  and/or the one or more memory devices  34  may be external to the controller  30 . The one or more memory devices  34  may include a tangible, non-transitory, machine-readable-medium, such as a volatile memory (e.g., a random access memory (RAM)) and/or a nonvolatile memory (e.g., a read-only memory (ROM)). The one or more memory devices  34  may store a variety of information and may be used for various purposes. For example, the one or more memory devices  34  may store machine-readable and/or processor-executable instructions (e.g., firmware or software) for the one or more processors  32  to execute, such as instructions to authenticate a user  14 . The one or more memory devices  34  may include one or more storage devices (e.g., nonvolatile storage devices) that may include read-only memory (ROM), flash memory, a hard drive, or any other suitable optical, magnetic, or solid-state storage medium, or a combination thereof. 
     As illustrated, the image capture device  16  is communicatively coupled to the controller  30 . As such, images (or videos) captured by the image capture device  16  may be sent to the controller  30  for storage (e.g., in the one or more memory devices  34 ), analysis (e.g., by the one or more processors  32 ), forwarding (e.g., via one or more communication interfaces  36 ), or any other suitable purpose. It should be noted that the image capture device  16  may include multiple image capture devices (e.g., cameras) for capturing different perspectives of the user  14 . This may facilitate further confirmation and analysis of facial aspects and expressions, for example. 
     Similarly, the one or more input devices  22  are communicatively coupled to the controller  30 . Information provided by the user  14  via the one or more input devices  22  may be sent to the controller  30  (e.g., to enter authentication information, account information, changes to account information, and the like). In some embodiments, the electronic display  20  may be an input device (e.g., a touchscreen) and send information provided by the user  14  to the controller  30 . 
     The one or more output devices  24  are also communicatively coupled to the controller  30 . The controller  30  may output information, goods, or other physical objects to the user  14 . The electronic display  20  may be also be used as an output device to provide information to the user  14 . 
     The user authentication system  10  also includes one or more communication interfaces  36 . The one or more communication interfaces  36  may enable the controller  30  to communicate with any suitable communication network  38 . For example, as discussed above, a communication interface  36  may enable the controller  30  to forward images captured by the image capture device  16  to a computing device  40 . The one or more communication interfaces  36  may also enable the user authentication system  10  to communicate with additional communication networks  38 . For example, a communication interface  36  may enable the controller  30  to communicate with wireless networks (e.g., mobile, WiFi, LAN, WAN, Internet, and the like). In this manner, the one or more communication interfaces  36  may enable the controller  30  to communicate with computing devices  40  to authenticate the user  14 , to analyze authentication information, to retrieve authentication information so that the controller  30  may authenticate the user  14 , to change information (e.g., account information) as requested by the user  14 , and the like. 
       FIG. 4  is a flowchart illustrating a method  50  for setting authentication information for a user  14 , in accordance with an embodiment of the present disclosure. The method  50  may be performed by any suitable device that may control components of the user authentication system  10 , such as the controller  30 . While the method  50  is described using steps in a specific sequence, it should be understood that the present disclosure contemplates that the described steps may be performed in different sequences than the sequence illustrated, and certain described steps may be skipped or not performed altogether. In some embodiments, the method  50  may be implemented by executing instructions stored in a tangible, non-transitory, computer-readable medium, such as the one or more memory devices  34 , using a processor, such as the one or more processors  32  of the controller  30 . 
     The controller  30  may prompt the user  14  for user identification information. For example, when the user  14  initially creates or sets up an account (e.g., a financial account, an insurance account, a social media account, an electronic device profile, and the like), the user  14  may enter the user identification information. The user identification information may include image data (e.g., of the face) of the user, and the controller  30  may use the image capture device  16  to capture the image data. As a result, the controller  30  receives (process block  52 ) first image data associated with the user identification information from the image capture device  16 . The user identification information may also or alternatively include a username, a login, a password, a personal identification number, security questions and corresponding answers, an address, an email address, a phone number, a facial image or series of facial images, and the like. As such, the user identification information may also or alternatively be entered by the user  14  via the input device  22  (e.g., a keyboard, mousing device, a camera, and the like) and/or the electronic display  20  (e.g., a touch screen). In some embodiments, the user identification information may include biometric data, such as retinal or fingerprint information, which may be provided via the input device  22 . The controller  30  may use the user identification information to create or link a user profile identifying the user  14  to other information, such as biometric data, account data, historical data, and so forth. 
     The controller  30  generates (process block  53 ) a first set of biometric data based on the first image data. The controller  30  may identify biometric points of the user  14  in the first image data to generate the first set of biometric data. The biometric points may include facial muscles, eyes, shoulders, elbows, hands, fingers, sternum, hips, knees, and/or center of mass, of the user  14 . In alternative or additional embodiments, the first set of biometric data may be any suitable data that may identify the user or provide evidence of that the user is a live person, such as movement data, temperature data, and the like. 
     The controller  30  may prompt the user  14  to perform a first user action. The first user action may be captured by the image capture device  16 . As a result, the controller  30  receives (process block  54 ) second image data (e.g., one or more images or a video) associated with the first user action from the image capture device  16 . The first user action may be any suitable action that may be visually distinguishable, such as an expression (e.g., happiness, sadness, anger, disgust, and the like), a gesture (e.g., pointing, winking, looking in a direction, holding a hand up, tilting of the head, sticking the tongue out, and the like), a movement (e.g., waving, blinking, clapping, nodding, shaking of the head, and the like). In some embodiments, the controller  30  may provide a list of possible actions that the user  14  may perform via the electronic display  20  or the output device  24 . 
     The controller  30  generates (process block  56 ) a second set of biometric data based on the second image data. The controller  30  may identify biometric points of the user  14  in the second image data to generate the second set of biometric data. In some embodiments, the controller  30  may identify facial muscle activation points based on an expression or gesture performed by the user  14 . The controller  30  may also or alternatively identify biomechanical points of the body of the user  14  to identify gestures or movements performed by the user  14 . In alternative or additional embodiments, the second set of biometric data may be any suitable data that may identify the user or provide evidence of that the user is a live person, such as movement data, temperature data, and the like. 
     In some embodiments, the controller  30  may use the communication interface  36  to send the second image data to the computing device  40  over the communication network  38 . The computing device  40  may generate the second set of biometric data from the second image data. It should be noted that in some embodiments, only biometric data may be used to identify the user  14  (e.g., such that no username is used). 
     The controller  30  may prompt the user  14  to perform a second user action. The second user action may be captured by the image capture device  16 . As a result, the controller  30  receives (process block  58 ) third image data (e.g., one or more images or a video) associated with the second user action from the image capture device  16 . The controller  30  may or may not expressly prompt the user  14  to perform the second action such that it is different from the first action. The user  14  may be instructed to provide the second action for user as a confirmation code. 
     The controller  30  generates (process block  60 ) a third set of biometric data based on the third image data. The controller  30  may identify biometric points of the user  14  in the third image data to generate the third set of biometric data. The third set of biometric data may be based on similar or different biometric points used to generate the second set of biometric data. In some embodiments, the controller  30  may use the communication interface  36  to send the third image data to the computing device  40  over the communication network  38 . The computing device  40  may generate the third set of biometric data from the third image data. In alternative or additional embodiments, the third set of biometric data may be any suitable data that may identify the user or provide evidence of that the user is a live person, such as movement data, temperature data, and the like. 
     In some embodiments, the controller  30  (or the computing device  40 ) may determine whether the third set of biometric data is the same as the second set of biometric data. If so, the controller  30  may prompt the user  14  to perform the second action, such that the second action is different from the first action. The controller  30  may not save the third image data associated with the second action until the user  14  performs a second action that is different from the first action. 
     Other authentication information may be provided in addition to the sets of biometric data, and may include biometric data or any other suitable data that may identify the user or provide evidence of that the user is a live person, such as movement data, temperature data, and the like. For example, a password or personal identification number may be entered using the one or more input devices  22  or the electronic display  20 . Thermal imaging may be used (e.g., via the image capture device  16 , where the image capture device  16  has thermal imaging capabilities) to facilitate determining whether thermal characteristics of the user  14  approximately match that of a living user. Fingerprint or retinal matching as provided by the one or more input devices  22  may also be used to further authenticate the user  14 . In some embodiments, such authentication information may be combined with the sets of biometric data. For example, the user  14  may perform the first action and/or the second action while entering a keystroke on a keyboard, having a fingerprint read, drawing a pattern on a trackpad, speaking a code phrase, and the like. 
     In some embodiments, the controller  30  may replay the first image data, the second image data, and/or the third image data on the electronic display  20  and request that the user  14  confirm whether the image data is/are acceptable. In this way, the user  14  may review the image data, and decide whether other actions are preferable. If the user  14  does not confirm the actions, the controller  30  may return to process block  52  or process block  58  such that the user  14  may again perform the first or second user action. 
     While only three sets of biometric data are discussed, it should be understood that any suitable number (e.g., 4-10) of sets of biometric data may be used for authentication. As such, there may be a threshold number (e.g., 2-9) of corresponding user actions that the user  14  is prompted to perform before saving the sets of biometric data. In some embodiments, after the threshold number is reached, the controller  30  may request that the user  14  confirm whether the user  14  is done setting the authentication actions. The user  14  may indicate completion or non-completion by touching the electronic display  20 , using the one or more input devices  22 , and/or performing a prompted action (e.g., nodding, shaking the head, and the like). 
     The controller  30  then saves (process block  62 ) the sets of biometric data as authentication data for the user  14 . The authenticated sets of biometric data may be used to identify and authenticate the user  14  when the user  14  subsequently attempts to access the account. The controller  30  may save the second and third sets of biometric data as a sequence, such that an order in which the user  14  performed the corresponding actions is preserved. 
     The controller  30  may save the sets of biometric data in the one or more memory devices  34 . The controller  30  may associate or link the sets of biometric data to an account or profile of the user  14 . The controller  30  may also or alternatively use the communication interface  36  to send the sets of biometric data to the computing device  40  so that the computing device  40  saves the sets of biometric data. 
       FIG. 5  is a flowchart illustrating a method  70  for authenticating a user  14 , in accordance with an embodiment of the present disclosure. The method  70  may be performed by any suitable device that may control components of the user authentication system  10 , such as the controller  30 . While the method  70  is described using steps in a specific sequence, it should be understood that the present disclosure contemplates that the described steps may be performed in different sequences than the sequence illustrated, and certain described steps may be skipped or not performed altogether. In some embodiments, the method  70  may be implemented by executing instructions stored in a tangible, non-transitory, computer-readable medium, such as the one or more memory devices  34 , using a processor, such as the one or more processors  32  of the controller  30 . 
     The controller  30  may prompt the user  14  for user identification information. The user identification information may include image data (e.g., of the face) of the user, and the controller  30  may use the image capture device  16  to capture the image data. As a result, the controller  30  receives (process block  71 ) first image data associated with user identification information from the image capture device  16 . The user identification information may also or alternatively include a username, a login, a password, a personal identification number, security questions and corresponding answers, an address, an email address, a phone number, a facial image or series of facial images, and the like. In some embodiments, the user identification information may include biometric data, such as retinal or fingerprint information, which may be provided via the input device  22 . 
     The controller  30  generates (process block  72 ) a first set of biometric data based on the first image data. The controller  30  may identify biometric points of the user  14  in the first image data to generate the first set of biometric data. The biometric points may include facial muscles, eyes, shoulders, elbows, hands, fingers, sternum, hips, knees, and/or center of mass, of the user  14 . In alternative or additional embodiments, the first set of biometric data may be any suitable data that may identify the user or provide evidence of that the user is a live person, such as movement data, temperature data, and the like. 
     The controller  30  may determine (decision block  73 ) whether the first set of biometric data approximately matches the first set of authenticated biometric data. The first set of authenticated biometric data may be associated with user identification information. For example, the first set of authenticated biometric data may correspond to first image data associated with the user identification information as received by the controller  30  in process block  52  of method  50 . In alternative or additional embodiments, the first set of authenticated biometric data may be any suitable data that may identify the user or provide evidence of that the user is a live person, such as movement data, temperature data, and the like. In some embodiments, the controller  30  may determine that the first set of biometric data approximately matches the first set of authenticated biometric data when a threshold percentage (e.g., 50-98%) or number of matching biometric points (e.g., 5-500) is exceeded. For example, if 80% of the biometric points associated with the first set of biometric data matches the biometric points associated with the first set of authenticated biometric data, the controller  30  may determine that the first set of biometric data approximately matches the first set of authenticated biometric data. 
     If the controller  30  determines (decision block  73 ) that the first set of biometric data does not approximately match a first set of authenticated biometric data, then the controller  30  determines (decision block  74 ) whether a threshold number of access requests has been exceeded. This determination may add security to the authentication process by preventing multiple access request violations (e.g., from attempts to access the account without authentication). The threshold number of access requests may be any suitable number (e.g., 2-10) to enable the user  14  to authenticate himself or herself, but prevent attempts to access the account without authentication. 
     If the controller  30  determines (decision block  74 ) that a threshold number of authentications has been exceeded, the controller  30  locks (block  76 ) the user account. The controller  30  may then inform the user  14  (e.g., via the electronic display  20 ) that the account has been locked. The controller  30  may provide contact information and/or instructions to the user  14  to unlock the account. 
     If the controller  30  determines (decision block  74 ) that a threshold number of authentications has not been exceeded, the controller  30  returns to process block  71  to receive the user identification information. 
     If the controller  30  determines (decision block  73 ) that the first set of biometric data approximately matches the first set of authenticated biometric data, the controller  30  may prompt the user  14  to perform a first user action. In one embodiment, this includes merely requesting authentication and the user  14  performing a visually detectable action or facial change as the authentication. The first user action may be captured by the image capture device  16 . For security reasons, the controller  30  may prompt the user  14  to perform the first user action without providing any indication of what the first user action is, as only the user  14  should know the first user action. As a result, the controller  30  receives (process block  78 ) second image data (e.g., one or more images or a video) associated with the first user action from the image capture device  16 . 
     The controller  30  generates (process block  80 ) a second set of biometric data based on the second image data. In some embodiments, the controller  30  may use the communication interface  36  to send the second image data to the computing device  40  over the communication network  38 . The computing device  40  may generate the second set of biometric data from the second image data. The controller  30  may identify biometric points of the second image data to generate the second set of biometric data. In alternative or additional embodiments, the second set of biometric data may be any suitable data that may identify the user or provide evidence of that the user is a live person, such as movement data, temperature data, and the like. 
     The controller  30  may prompt the user  14  to perform a second user action. In one embodiment, this includes merely requesting authentication and the user  14  performing a visually detectable action or facial change as the authentication. The second user action may be captured by the image capture device  16 . For security reasons, the controller  30  may prompt the user  14  to perform the second user action without providing any indication of what the second user action is, as only the user  14  should know the second user action. As a result, the controller  30  receives (process block  82 ) third image data (e.g., one or more images or a video) associated with the second user action from the image capture device  16 . 
     The controller  30  generates (process block  84 ) a third set of biometric data based on the third image data. In some embodiments, the controller  30  may use the communication interface  36  to send the third image data to the computing device  40  over the communication network  38 . The computing device  40  may generate the third set of biometric data from the third image data. In alternative or additional embodiments, the third set of biometric data may be any suitable data that may identify the user or provide evidence of that the user is a live person, such as movement data, temperature data, and the like. 
     In some embodiments, the controller  30  may request that the user  14  confirm whether the user  14  has completed each or all of the authentication actions via the electronic display  20 . The user  14  may indicate completion or non-completion by touching the electronic display  20 , using the one or more input devices  22 , and/or performing a prompted action (e.g., nodding, shaking the head, and the like). 
     The controller  30  may receive second and third sets of authenticated biometric data for the user  14 . The second and third sets of authenticated biometric data may be acquired as a result of saving previous sets of biometric data as described in process block  62  of method  50 . The controller  30  may receive the second and third sets of authenticated biometric data from the one or more memory devices  34  or the computing device  40  via the communication network  38  using the communication interface  36 . For example, the controller  30  may use the user identification information acquired from process block  72  to identify the associated second and third sets of authenticated biometric data for the user  14 . 
     The controller  30  may determine (decision block  86 ) whether the second set of biometric data approximately matches the second set of authenticated biometric data and the third set of biometric data approximately matches the third set of authenticated biometric data. In some embodiments, the controller  30  may determine that a set of biometric data approximately matches a set of authenticated biometric data when a threshold percentage (e.g., 50-98%) or number of matching biometric points (e.g., 5-500) associated with the sets of biometric data is exceeded. If additional sets of biometric data are used for authentication, then the controller  30  may also determine whether the subsequent sets of biometric data approximately match the subsequent sets of authenticated biometric data. In alternative or additional embodiments, the second, third, and/or additional sets of biometric data may be any suitable data that may identify the user or provide evidence of that the user is a live person, such as movement data, temperature data, and the like. 
     In some embodiments, the controller  30  may determine whether the sets of biometric data are in the same sequence or order as the sets of authenticated biometric data. That is, the controller  30  determines whether the actions performed by the user  14  associated with the sets of biometric data are in the same sequence or order as the actions associated with the sets of authenticated biometric data. 
     If the controller  30  determines (decision block  86 ) that the second set of biometric data approximately matches the second set of authenticated biometric data and the third set of biometric data approximately matches the third set of authenticated biometric data, then the user  14  is authenticated, and the controller  30  grants (process block  88 ) access to the user account. 
     If the controller  30  determines (decision block  86 ) that the second set of biometric data does not approximately match the second set of authenticated biometric data or the third set of biometric data does not approximately match the third set of authenticated biometric data, then the controller  30  determines (decision block  74 ) whether a threshold number of authentications has been exceeded. 
     If the controller  30  determines (decision block  86 ) that the threshold number of authentications has not been exceeded, the controller  30  returns to process block  71  to receive the first image data associated with the user identification information. In some embodiments, the controller  30  may return to other steps of the method  70 , such as to process block  78  to receive the second image data associated with the first user action. If the controller  30  determines (decision block  74 ) that the threshold number of authentications has been exceeded, the controller  30  locks (block  76 ) the user account. 
     While only three sets of biometric data are discussed, it should be understood that any suitable number (e.g., 4-10) of sets of biometric data may be used for authentication. As such, the controller  30  may prompt the user  14  to perform subsequent actions (e.g., provide further authentication) and generate subsequent sets of biometric data based on subsequent acquisitions. 
     Advantageously, the electronic device  12  may perform the methods  50  and  70  without adding new hardware. That is, because the authentication process uses multiple actions performed by the user  14  that are captured by the image capture device  16 , the electronic device  12  may not use additional hardware, such as a retinal scanner, a fingerprint reader, a card reader, and the like. As such, standalone machines that perform the methods  50  and  70  (e.g., the electronic device  12  of  FIG. 1 ) may be manufactured quicker and for less cost. Moreover, the methods  50  and  70  may be performed by mobile electronic devices, wearable electronic devices, personal electronic devices, and the like, such as the electronic device  12  of  FIG. 2 . As such, the number of standalone machines may be reduced, as users may carry such electronic devices on their person, which may be even more cost efficient. 
     Present embodiments provide a simplified and secure process and system for accessing protected data and resources. For example, the user  14  may provide a user identification by merely providing an image of himself or herself via the image capture device  16  when prompted to provide identification when logging into an account. Further, the user  14  can provide authentication via a gesture in response to prompting for authentication. For example, instead of providing a personal identification number to confirm identity, the user  14  may wink or make a facial expression for capture by the image capture device  16 , the user  14  knowing that the image corresponds to the authentication. Other facial expressions or gestures (e.g., facial changes alone or in addition to hand gestures) may be employed for this purpose in accordance with present embodiments. Indeed, authentication data may account for facial and other body movements. For example, authentication may include winking and snapping fingers. By using such data, users do not need to memorize usernames and passwords and acquisition of such information by criminals becomes more difficult. 
     While the embodiments set forth in the present disclosure may be susceptible to various modifications and alternative forms, specific embodiments have been shown by way of example in the drawings and have been described in detail herein. However, it should be understood that the disclosure is not intended to be limited to the particular forms disclosed. The disclosure is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the disclosure as defined by the following appended claims. 
     The techniques presented and claimed herein are referenced and applied to material objects and concrete examples of a practical nature that demonstrably improve the present technical field and, as such, are not abstract, intangible or purely theoretical. Further, if any claims appended to the end of this specification contain one or more elements designated as “means for [perform]ing [a function] . . . ” or “step for [perform]ing [a function] . . . ”, it is intended that such elements are to be interpreted under 35 U.S.C. 112(f). However, for any claims containing elements designated in any other manner, it is intended that such elements are not to be interpreted under 35 U.S.C. 112(f).