Patent Description:
Biometric systems can be used to authenticate the identity of individuals to determine whether to grant or deny access to certain properties or resources. For example, cameras can be used by a biometric security system to identify an individual based on the individual's unique physical properties. Biometric data captured from an individual, such as during an enrollment process, can be stored as a template that is used to verify the identity of the individual at a later time. <CIT> describes a method of assessing the identity of a person by one or more of: internal non-visible anatomical structure of an eye represented by the Oculomotor Plant Characteristics (OPC), brain performance represented by the Complex Eye Movement patterns (CEM), iris patterns, and periocular information. In some embodiments, a method of making a biometric assessment includes measuring eye movement of a subject, making an assessment of whether the subject is alive based on the measured eye movement, and assessing a person's identity based at least in part on the assessment of whether the subject is alive. In some embodiments, a method of making a biometric assessment includes measuring eye movement of a subject, assessing characteristics from the measured eye movement, and assessing a state of the subject based on the assessed characteristics. <CIT> describes authenticating a user of a display device. One example includes displaying one or more virtual images on the display device, wherein the one or more virtual images include a set of augmented reality features. The method further includes identifying one or more movements of the user via data received from a sensor of the display device, and comparing the identified movements of the user to a predefined set of authentication information for the user that links user authentication to a predefined order of the augmented reality features. If the identified movements indicate that the user selected the augmented reality features in the predefined order, then the user is authenticated, and if the identified movements indicate that the user did not select the augmented reality features in the predefined order, then the user is not authenticated. <CIT> describes a system for eye movement and pupil size change matching for user authentication includes an ocular sensor that is configured to sense eyes of a user and collect data indicative of the user's eye movement and pupil size changes. When a user's eyes are detected, the logic analyzes data collected by the ocular sensor in order to determine whether the sensed data match data extracted from a template defined by the eye movement and pupil size changes of an authorized user. If so, the user is authenticated and is permitted to access at least one restricted resource. As an example, the user may be permitted to access an application or sensitive data stored on a computer system or to access a restricted area, such as a room of a building. <CIT> describes a method, system and media for authenticating a subject as a user. Examples generate visual stories specific to the user and for which the subject must select the corresponding images from among a plurality of decoy images. Gaze tracking can be used to determine which images the user has selected without allowing an observer to learn which images have been selected. Images for the visual story can be retrieved from the user's social networking profile, and corresponding text storied generated to indicate which images should be selected. Multiple security levels are possible by varying the number of story images and decoy images.

Implementations of the present disclosure are generally directed to passive affective and knowledge-based authentication (AKBA) using biometric signatures. More specifically, implementations are directed to capturing data associated with eye dynamics of the user as the user looks at a graphical user interface (GUI) of a device. An AKBA signature of the user is determined based on the captured data. The AKBA signature is employed to authenticate the users to enable the use of services.

In one implementation, a user is authenticated based on a passive AKBA, the method of authenticating the user is executed by one or more processors and has steps that includes: capturing data associated with eye movements and ocular dynamics of the user with a camera as the user looks at a GUI of a device; determining an AKBA signature of the user based on the captured data; authenticating the user based on a comparison of the AKBA signature with an AKBA template associated with the user; and granting access to a subset of functions of an application.

Particular implementations of the subject matter described in this disclosure can be implemented so as to realize one or more of the following advantages. One can argue that the real identity of a person is in accordance with his or her true memories, likes and dislikes, and other person-specific life experiences and the personality profile that they identify with. Such inner identity does not change with alterations to one's outward appearance, providing a distinct advantage over traditional biometrics relying only on physical characterization of spatially limited patterns such as those found in fingertips or irises. Spoofing inner traits is also much harder or even impossible. However, inferring the aforesaid information is not user-friendly. The knowledge discovery part, also known as KBA, is time-consuming and verbose. The derivation of affective component is even more complicated. In this work, we utilize dynamics of the eye, modulated naturally when the user is presented with preprogrammed visual stimuli with specific affective valence and memory relevance (or lack thereof), for AKBA.

It is appreciated that methods in accordance with the present disclosure can include any combination of the aspects and features described herein. That is, methods in accordance with the present disclosure are not limited to the combinations of aspects and features specifically described herein, but also may include any combination of the aspects and features provided.

Other features and advantages of the present disclosure will become apparent from the Detailed Description, the Claims, and the accompanying drawings.

Implementations of the present disclosure are generally directed to capturing passive AKBA signature for biometric authentication. More particularly, implementations of the present disclosure are directed to a biometric authentication system deployed within a device (such as a mobile device, a kiosk, etc.) that employs one or more cameras to capture information containing eye movements and other ocular dynamics of a user. The information can be used by the biometric authentication system to authenticate users. The device provides access to services based on the authentication.

Authentication allows users to confirm his or her identity to, for example, a Web application. Various biometric identification/authentication systems are based on capturing one or more images, which are then compared with or analyzed with reference to template images captured during an enrollment process. For example, a biometric authentication system using facial identification may require enrolling users to pose for one or more images of their face during an enrollment process. The images captured during the enrollment process, or more commonly, the unique features derived from them, are called an enrollment template and may be stored on a storage device accessible to the biometric authentication system. During run-time, a facial image of a user can be captured and compared with one or more face templates to determine if the user may be authenticated.

Affective and knowledge-based authentication is based on knowledge and/or affective profile the individual has. To verify a user, a KBA system can ask the user a series of questions, either based on information within the data source the user is using (i.e., a dynamic KBA) or based on information collected from a user (i.e., a static KBA). Interface to a KBA system can be text-based (e.g., answer to the question "what is your mother's maiden name?"), or graphic-based (e.g., asking a user to pick an image that represents his hometown from a set of images). The present disclosure describes a passive AKBA system that established the identity of a user through tracking the eye movements and other ocular dynamics of the user when the user is presented with various preprogrammed visual stimuli. That is, instead of asking the user questions and authenticating the user based on their direct answers to those questions, the disclosed AKBA system authenticates users by measuring various distinguishing features of eye movements and dynamics of the users, and the features are measured when users are looking at different preprogrammed and person-specific affective-cognitive visual stimuli. One can argue that the real identity of a person is in accordance to his or her true memories, likes and dislikes, and other person-specific life experiences and personality profile that they identify with. Such inner identity does not change with alterations to one's outward appearance, providing a distinct advantage for AKBA over traditional biometrics relying only on physical characterization of spatially limited patterns such as those found in fingertips or irises. Spoofing inner traits are also much harder or even impossible. However, inferring the aforesaid information is not user-friendly. The knowledge discovery part, as utilized by traditional KBA, is time-consuming and verbose. The derivation of affective component is even more complicated. Here, we present utilization of ocular dynamics modulated naturally when the user is presented with preprogrammed visual stimuli with specific affective valence and memory relevance (or lack thereof), for AKBA for a more user-friendly and more secure AKBA system.

Features of eye movement can be measured through various techniques. Eye tracking refers to the process of identifying the gaze or movement of an eye. Distinctive features of an individual's gazing behavior in response to preprogrammed visual stimuli with certain relevance (or lack thereof) to the user may be used to identify or authenticate the individual. For example, images of a user's eye can be obtained and analyzed to compare features of the eye to reference records to authenticate the user and grant or deny the user access to a resource. Techniques used in this disclosure are based on the theories that human eyes respond to different environmental triggers in different ways. Such different environmental triggers can be verbal, imagery, etc. Different responses corresponding to these environmental triggers can be observed and quantified by features such as pupil dilation, gazing fixation, blink rate, etc..

The pupillary response is a physiological response that can have a variety of causes, from an involuntary reflex reaction to exposure or inexposure to light. Pupils dilate and constrict in response to both environmental changes (e.g., ambient light), and changes in mental states. For example, a larger pupil allows the eye to welcome a larger volume of light and attain higher clarity in the absence of suitable illumination. On the other hand, the pupil becomes smaller when subject to a glut of light, as excess exposure would have deleterious effects on the eye's lens and retina. In addition, pupil size is also sensitive to mental activity. Pupil size increases in proportion to the difficulty of a task at hand. For example, people solving difficult math problems can demonstrate a slightly more enlarged pupil than those whose are tested with easier problems. The mental effort entailed by accessing memory and maintaining attention is positively correlated with pupil size-more work means a larger pupil.

Gazing behavior is also a fundamental human behavior with important cognitive, affective, motivational, and social underpinnings that are likely to produce individual differences linking it to major personality traits. Eye movements that people make during free viewing can be associated with the properties of an image. A series of related gaze points (e.g., points show what the eyes are looking at) can form a fixation, denoting a period where the eyes are locked towards an object. The amount of fixation or gaze points that are directed towards a certain part of an image (relative to other parts) shows that more visual attention has been directed there. Order of attention can be used in eye tracking since it reflects a person's interest.

Blinking is a semi-autonomic rapid closing of the eyelid. There are a number of factors that can alter the blink rate and have a profound impact on the ocular surface. Blink rates may change depending on the activity being completed. The blink rate increases when engaged in conversation, and decreases when focusing on a specific visual task. Blink rates are also highly influenced by internal factors such as fatigue, stress medications, emotions, and surface conditions of the object. Blink rates may be altered by cognitive and emotional function. For example, people who experience emotional excitement, anxiety, or frustration have an increased blink rate; feelings of guilt have also been reported to affect normal blink patterns.

In an example context, an AKBA system may be deployed in a device, such as an automated teller machine (ATM), or a mobile device. The device may include one or more cameras that can be used by the AKBA system to capture run-time images of the user's eyes, along with an interactive display for preprogrammed visual stimuli. The information contained in these ocular videos can be analyzed to generate a signature or template for each user. The AKBA signature may include pupil dilation, gazing fixation, blinking rate, and so forth. The AKBA signature can be employed alone or in combination with other biometric data, such as described above, in biometric authentication.

In some implementations, a baseline or template can be captured during an enrollment process. In some implementations, the AKBA system may first ask the user a series of initial (visual) questions to determine the positive and negative preferences of the user. For example, questions like "what is your most favorite car?" or "what is your least favorite food?" Then the AKBA system requires the enrolling users to look at the GUI of the device while a set of images are displayed on the GUI. The displayed set of images include images representing the user's positive and negative preferences according to their answers to the initial questions (for example, designating images containing car A as positive preference images and images containing food B as negative reference images). The AKBA GUI may also gauge true memories vs. irrelevant recalls (e.g. which one is the image of your house?). A camera embedded on the device captures data associated with eye movements (and other additional features such as pupil dilation) of the users while the users look at these images. The AKBA system collects the user's eye movement data associated with positive and negative reference images as well as relevant/irrelevant memories, and creates templates (that can be positive templates or negative templates) based on the data, respectively. In some implementations, the templates created during the enrollment process may be stored on a storage device accessible to the biometric authentication system. During run-time, a sample AKBA signature of a user can be captured and compared with the AKBA templates to determine if the user may be authenticated. In some implementations, a similarity score may be generated based on the comparison of the sample AKBA signature and baseline AKBA templates.

<FIG> is a block diagram illustrating an example device <NUM> for a passive AKBA system, according to some implementations of the present disclosure. The device <NUM> includes one or more components that support a biometric authentication system. For example, the device <NUM> can include an image sensor <NUM>, a display <NUM>, an eye tracking component <NUM>, a processor <NUM>, a memory <NUM>, and a system bus that couples various system components, including the memory <NUM> to the processor <NUM>.

The device <NUM> can include, for example, a kiosk, a wearable device, and/or a mobile device. Examples of device <NUM> can include, but are not limited to, a smart phone, a smart watch, smart glasses, tablet computer, laptop, gaming device, palmtop portable computer, television, personal digital assistant, wireless device, workstation, or other computing devices that are operated as a general purpose computer or a special purpose hardware device that can execute the functionality described herein. The device <NUM> may be used for various purposes that require authenticating users via one or more biometric authentication processes. For example, the device <NUM> can be an ATM kiosk that allows a user to withdraw money from a bank account. In another example, the device <NUM> can be a mobile phone that allows a user to view or transfer money through an online banking application.

The image sensor <NUM> can be employed to capture images of eyes of, for example, the user who is interacting with the device <NUM>. The image sensor <NUM> can be a camera that is associated with the device <NUM>, or a camera that is existing independently of a device. By way of illustration, the camera can be a digital camera, a three-dimensional (3D) camera, or a light field sensor. In some implementations, the camera can be an inward facing module in a wearable device with a spectacle form factor, and used to capture images of the eye. In some implementations, multiple cameras at various locations on a device can be used together to capture the different images of both eyes. The image can be captured either in still mode or in video mode. In some implementations, the camera has near-infrared sensitivity and illumination to better capture pupils of dark irises.

The display <NUM> may display information to a user. The display may also be used by the user to interact with the device <NUM>. For example, the display may be a touch screen type of device displaying a user interface (UI) through which the user can enter and receive data.

Eye tracking component <NUM> can include hardware and/or software modules that perform operations on images captured by image sensor <NUM>. For example, eye tracking component <NUM> can process and analyze eye images to identify interest points, extract features around the interest points, create templates based on the features, and determine eye movement based on the templates over time.

In some implementations, the eye tracking component <NUM> may include a communication interface (not shown). The communication interface can be employed to provide digital signals to the biometric authentication system deployed to the device <NUM>. In some implementations, the communication interface may include communication via a Universal Serial Bus (USB), Bluetooth, Ethernet, wireless Ethernet, and so forth. In some implementations, through the eye tracking component <NUM>, the captured measurement data may be employed in conjunction with the image sensor <NUM> by the respective biometric authentication system deployed to the device <NUM>.

In some implementations, the image captured using the eye tracking component <NUM> along with the determined AKBA signature can be processed by the biometric authentication system to identify/authenticate the user. In some implementations, the biometric authentication system may extract from the images, various features, such as features associated with the pupil, iris, vasculature on or underlying the sclera of the eye (e.g. conjunctival and episcleral), and so forth, to identify/authenticate a particular user based on matching the extracted features to that of one or more template images and AKBA signatures generated and stored for the user during an enrollment process. In some implementations, the biometric authentication system may use a machine-learning process (e.g., a deep learning process implemented using a deep neural network architecture) to match the user to his or her stored templates. In some implementations, the machine-learning process may be implemented, at least in part, using one or more processing devices deployed on the device <NUM>. In some implementations, the device <NUM> may communicate with one or more remote processing devices (e.g., one or more servers) that implement the machine learning process (see <FIG>).

<FIG> is an example environment <NUM> for executing a passive AKBA system, according to some implementations of the present disclosure. The example environment <NUM> includes network <NUM>, a back-end system <NUM>, and devices <NUM> (for example, 202a and 202b, herein as "devices <NUM>"). The devices <NUM> are substantially similar to the device <NUM> of <FIG>.

In some implementations, the network <NUM> includes a local area network (LAN), wide area network (WAN), the Internet, or a combination thereof, and connects computing devices (e.g., devices <NUM>) and back-end systems (e.g., the back-end system <NUM>). In some implementations, the network <NUM> can be accessed over a wired and/or a wireless communications link.

In the depicted example, the back-end system <NUM> includes at least one server system <NUM> and a data store <NUM>. In some implementations, the back-end system <NUM> provides access to one or more computer-implemented services with which the devices <NUM> may interact. The computer-implemented services may be hosted on, for example, the at least one server system <NUM> and the data store <NUM>. The computer-implemented services may include, for example, an authentication service that may be used by the devices <NUM> to authenticate a user based on collected AKBA signatures and/or image data.

In some implementations, the back-end system <NUM> includes computer systems employing clustered computers and components to act as a single pool of seamless resources when accessed through the network <NUM>. For example, such implementations may be used in a data center, cloud computing, storage area network (SAN), and network attached storage (NAS) applications. In some implementations, the back-end system <NUM> is deployed and provides computer-implemented services through a virtual machine(s).

<FIG> is an example system <NUM> for executing a passive AKBA, according to some implementations of the present disclosure. The system <NUM> includes image sensing module <NUM>, an enrollment module <NUM>, an image processing module <NUM>, an authentication module <NUM>, and a display module <NUM>. In some implementations, the system <NUM> may be included within a device, such as described with reference to <FIG>. For example, the display module <NUM> can be the display <NUM> in <FIG> and the image sensing module <NUM> can be a component of the image sensor <NUM> of <FIG>. In some implementations, the display module <NUM> can be disposed on a mobile device, such as a smartphone, tablet computer, or an e-reader.

Outputs from the image sensing module <NUM> can be used as the inputs to the enrollment module <NUM> and the image processing module <NUM>. In some implementations, one or more eye images are captured with an image sensor at an image quality suitable for the image processing functionality described herein, such as 720p, 1080p, or equivalent/higher resolution in visible and/or near IR. The image sensor can be a one megapixel or a better image sensor such as the front-facing camera generally found in cellular phones and tablets or dedicated cameras. Upon detection of a stable gaze and at least one eye of the user, a stack of images of the user's eye(s) are captured. The enrollment module <NUM> creates biometric templates based on the images and performs various operations to increase template security while maintaining usability. Image processing module <NUM> can perform segmentation and enhancement on images of the eye of a user to assist in isolating various features such as eyeball and face pose, as well as pupil diameter.

The authentication module <NUM> validates the identity of a user, through one or more processing modules <NUM>, by performing matching operations between the biometric AKBA signatures formed upon capturing ocular AKBA reading and a previously stored enrollment template. At the time of verification, the stored AKBA enrollment template for the claimed identity is matched against the presented AKBA verification template. In some implementations, only a subset of the enrollment AKBA template may be used during verification. In one implementation, if the similarity score is within a range of a preset threshold, which also entails pairing of a certain minimum number of elements across enrollment and verification templates, then the claimant is accepted, and a match decision is issued. In some implementations, the length and complexity of verification process depend on the score attained during initial stages of AKBA verification (i.e. if the first series of AKBA responses do not achieve a high level of confidence, the tests continue in order to accrue additional affective-cognitive evidence of identity). Note that the eye images can be immediately discarded after the creation of the template, and only the enrollment templates stored. Key module <NUM> can encode a secret key for the user based on an AKBA biometric enrollment template and decode the key upon successful verification of the user's identity using a signature, since the derived responses provide specific knowledge that can be hashed into a private key.

In some implementations, the output of the authentication module <NUM> may be used to drive a display module <NUM>. The enrollment module <NUM>, the image processing module <NUM>, the authentication module <NUM>, the processing module <NUM>, and the key module <NUM> can be stored in a memory and executed on a processor. By way of illustration, the program modules can be in the form of one or more suitable programming languages, which are converted to machine language or object code to allow the processor or processors to execute the instructions. The software can be in the form of a standalone application, or implemented in a suitable programming language or framework.

<FIG> is a flowchart illustrating an example method <NUM> for executing a passive AKBA, according to some implementations of the present disclosure. At <NUM>, as a user looks at a graphical user interface (GUI) of a device, and data associated with eye movements of the user are captured by a camera. In some implementations, the user looks at a GUI of a device while a set of images are displayed on the GUI of the device. From <NUM>, the method <NUM> proceeds to <NUM>.

At <NUM>, an AKBA signature for the user is determined based on the captured data. In some implementations, an AKBA signature includes a plurality of measurements of features that are associated with eye movements, and the features comprise a pupil size, a gazing fixation and transition dynamic, and a blinking rate of at least one eye of the user. From <NUM>, the method <NUM> proceeds to <NUM>.

At <NUM>, the user is authenticated based on a comparison of the AKBA signature with an AKBA template associated with the user. In some implementations, the AKBA template also includes a plurality of measurements of features that are associated with eye movements, and the features comprise at least one of a pupil size, a fixation, gaze transition dynamics in response to AKBA GUI, or a blinking rate of at least one eye of the user.

In some implementations, the AKBA template of the user is generated during an enrollment process. In some implementations, the method of generating an AKBA template of a user during an enrollment process includes determining, a plurality of positive and negative preferences of a user or genuine biographical/life experience knowledge; displaying, a set of preprogrammed visual stimulus to the user on a GUI of a device, wherein the set of preprogrammed visual stimulus comprise visual stimulus corresponding to the determined positive and negative preferences of the user or true vs false memories; capturing, with a camera, data associated with eye movements of the user as the user looks at the set of preprogrammed visual stimulus; and generating, an AKBA template based on the captured data.

In some implementations, the method of authenticating the user includes performing: generating a similarity score based on a comparison of the AKBA signature to the AKBA template, and authenticating the user based on the similarity score, wherein the user is authenticated when the similarity score is within a range of a predetermined threshold.

In some implementations, the method of generating a similarity score includes: determining a plurality of first scores, wherein each first score is determined based on a comparison of a measurement of a feature comprised in the AKBA template and a measurement of the same feature comprised in the AKBA signature; determining a respective weight for each of the first scores, and combining the first scores weighted by their respective weights to determine the similarity score. From <NUM>, the method <NUM> proceeds to <NUM>.

At <NUM>, a subset of functions of an application is granted. After <NUM>, the method <NUM> ends.

<FIG> is an example of a computing device <NUM> and a mobile computing device <NUM> that are employed to execute implementations of the present disclosure, according to some implementations of the present disclosure. The mobile computing device <NUM> is intended to represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smart-phones, AR devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to be limiting.

The computing device <NUM> includes a processor <NUM>, a memory <NUM>, a storage device <NUM>, a high-speed interface <NUM>, and a low-speed interface <NUM>. In some implementations, the high-speed interface <NUM> connects to the memory <NUM> and multiple high-speed expansion ports <NUM>. In some implementations, the low-speed interface <NUM> connects to a low-speed expansion port <NUM> and the storage device <NUM>. Each of the processor <NUM>, the memory <NUM>, the storage device <NUM>, the high-speed interface <NUM>, the high-speed expansion ports <NUM>, and the low-speed interface <NUM>, are interconnected using various buses, and may be mounted on a common motherboard or in other manners as appropriate. The processor <NUM> can process instructions for execution within the computing device <NUM>, including instructions stored in the memory <NUM> and/or on the storage device <NUM> to display graphical information for a graphical user interface (GUI) on an external input/output device, such as a display <NUM> coupled to the high-speed interface <NUM>. In addition, multiple computing devices may be connected, with each device providing portions of the necessary operations (e.g., as a server bank, a group of blade servers, or a multi-processor system).

The memory <NUM> may also be another form of a computer-readable medium, such as a magnetic or optical disk.

In some implementations, the storage device <NUM> may be or include a computer-readable medium, such as a floppy disk device, a hard disk device, an optical disk device, a tape device, a flash memory, or other similar solid-state memory device, or an array of devices, including devices in a storage area network or other configurations. The instructions, when executed by one or more processing devices, such as processor <NUM>, perform one or more methods, such as those described above. The instructions can also be stored by one or more storage devices, such as computer-readable or machine-readable mediums, such as the memory <NUM>, the storage device <NUM>, or memory on the processor <NUM>.

The high-speed interface <NUM> manages bandwidth-intensive operations for the computing device <NUM>, while the low-speed interface <NUM> manages lower bandwidth-intensive operations. Such allocation of functions is an example only. In some implementations, the high-speed interface <NUM> is coupled to the memory <NUM>, the display <NUM> (e.g., through a graphics processor or accelerator), and to the high-speed expansion ports <NUM>, which may accept various expansion cards. In the implementation, the low-speed interface <NUM> is coupled to the storage device <NUM> and the low-speed expansion port <NUM>. The low-speed expansion port <NUM>, which may include various communication ports (e.g., USB, Bluetooth, Ethernet, wireless Ethernet) may be coupled to one or more input/output devices. Such input/output devices may include a scanner <NUM>, a printing device <NUM>, or a keyboard or mouse <NUM>. The input/output devices may also be coupled to the low-speed expansion port <NUM> through a network adapter. Such network input/output devices may include, for example, a switch or router <NUM>.

The computing device <NUM> may be implemented in a number of different forms, as shown in the <FIG>. Alternatively, components from the computing device <NUM> may be combined with other components in a mobile device, such as a mobile computing device <NUM>.

The mobile computing device <NUM> includes a processor <NUM>; a memory <NUM>; an input/output device, such as a display <NUM>; a communication interface <NUM>; and a transceiver <NUM>; among other components. In some implementations, the mobile computing device <NUM> may include a camera device(s) (not shown).

For example, the processor <NUM> may be a Complex Instruction Set Computers (CISC) processor, a Reduced Instruction Set Computer (RISC) processor, or a Minimal Instruction Set Computer (MISC) processor. The processor <NUM> may provide, for example, for coordination of the other components of the mobile computing device <NUM>, such as control of user interfaces (UIs), applications run by the mobile computing device <NUM>, and/or wireless communication by the mobile computing device <NUM>.

The display <NUM> may be, for example, a Thin-Film-Transistor Liquid Crystal Display (TFT) display, an Organic Light Emitting Diode (OLED) display, or other appropriate display technology.

The memory <NUM> stores information within the mobile computing device <NUM>. An expansion memory <NUM> may also be provided and connected to the mobile computing device <NUM> through an expansion interface <NUM>, which may include, for example, a Single in Line Memory Module (SIMM) card interface. The expansion memory <NUM> may provide extra storage space for the mobile computing device <NUM>, or may also store applications or other information for the mobile computing device <NUM>. Specifically, the expansion memory <NUM> may include instructions to carry out or supplement the processes described above, and may include secure information also. Thus, for example, the expansion memory <NUM> may be provided as a security module for the mobile computing device <NUM>, and may be programmed with instructions that permit secure use of the mobile computing device <NUM>.

The memory may include, for example, flash memory and/or non-volatile random access memory (NVRAM), as discussed below. In some implementations, instructions are stored in an information carrier. The instructions, when executed by one or more processing devices, such as processor <NUM>, perform one or more methods, such as those described above. The instructions can also be stored by one or more storage devices, such as one or more computer-readable or machine-readable mediums, such as the memory <NUM>, the expansion memory <NUM>, or memory on the processor <NUM>. In some implementations, the instructions can be received in a propagated signal, such as, over the transceiver <NUM> or the external interface <NUM>.

The mobile computing device <NUM> may communicate wirelessly through the communication interface <NUM>, which may include digital signal processing circuitry where necessary. The communication interface <NUM> may provide for communications under various modes or protocols, such as Global System for Mobile communications (GSM) voice calls, Short Message Service (SMS), Enhanced Messaging Service (EMS), Multimedia Messaging Service (MMS) messaging, code division multiple access (CDMA), time division multiple access (TDMA), Personal Digital Cellular (PDC), Wideband Code Division Multiple Access (WCDMA), CDMA2000, General Packet Radio Service (GPRS). Such communication may occur, for example, through the transceiver <NUM> using a radio frequency. In addition, short-range communication, such as using a Bluetooth or Wi-Fi, may occur. In addition, a Global Positioning System (GPS) receiver module <NUM> may provide additional navigation- and location-related wireless data to the mobile computing device <NUM>, which may be used as appropriate by applications running on the mobile computing device <NUM>.

The mobile computing device <NUM> may be implemented in a number of different forms, as shown in <FIG>. For example, it may be implemented the device <NUM> described in <FIG>. Other implementations may include a mobile device <NUM> and a tablet device <NUM>. The mobile computing device <NUM> may also be implemented as a component of a smart-phone, personal digital assistant, AR device, or other similar mobile device.

Computing device <NUM> and/or <NUM> can also include USB flash drives. The USB flash drives may store operating systems and other applications. The USB flash drives can include input/output components, such as a wireless transmitter or USB connector that may be inserted into a USB port of another computing device.

Various implementations of the systems and techniques described here can be realized in digital electronic circuitry, integrated circuitry, specially designed application specific integrated circuits (ASICs), computer hardware, firmware, software, and/or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be for a special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

These computer programs (also known as programs, software, software applications, or code) include machine instructions for a programmable processor, and can be implemented in a high-level procedural, object-oriented, assembly, and/or machine language.

To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a cathode ray tube (CRT) or liquid crystal display (LCD) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer.

The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a client computer having a GUI or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication. Examples of communication networks include a LAN, a WAN, and the Internet.

Claim 1:
A computer-implemented method (<NUM>) for authenticating a user based on passive affective and knowledge-based authentication, AKBA, the method being executed by one or more processors and comprising:
capturing (<NUM>), with a camera, data associated with eye movements and ocular dynamics of the user as the user looks at a graphical user interface, GUI, of a device;
determining (<NUM>) an AKBA signature of the user based on the captured data;
authenticating (<NUM>) the user based on a comparison of the AKBA signature with an AKBA template associated with the user; and
granting (<NUM>) an access to a subset of functions of an application in response to authenticating the user based on the comparison of the AKBA signature with the AKBA template;
wherein the AKBA template of the user is generated during an enrollment process wherein generating the AKBA template of the user during the enrollment process comprises
determining characteristics associated with at least one of positive preferences, negative preferences, and biographical experience based knowledge of a user,
displaying a set of person-specific affective-cognitive preprogrammed visual stimuli to the user on a GUI of a device, wherein the set of person-specific affective-cognitive preprogrammed visual stimuli comprise visual stimuli comprising the determined characteristics of the user,
capturing, with a camera, data associated with distinguishing features of eye movements and ocular dynamics of the user as the user looks at the set of person-specific affective-cognitive preprogrammed visual stimuli, and
generating the AKBA template based on the captured data.