Patent Description:
User devices such as portable computing devices, tablet computers, smartphones, mobile terminals and the like are increasingly mobile and pervasive. Access control security measures for such devices typically involve a password, codeword, numeric or pattern-based lock or employ biometrics such as fingerprint or facial recognition. However, once access is gained to a device, the access is typically persistent while the device is in-use or at least until some expiry condition. Accordingly, accessing an unlocked device provides access to the device limited recourse to access control mechanisms.

Thus, there is a challenge in providing access control for user devices that address and/or mitigate these challenges.

In <CIT> variety of techniques for authenticating a user of a client are described. In <CIT> method for implicit authentication is described. In <CIT> method of using behavioral analysis for continuous authentication is described.

According to a first aspect of the present invention, there is a provided a computer implemented method of access control for a user device having at least one component for determining behaviours of the user, the method comprising: accessing a machine learning classifier trained based on at least one prior behaviour of the user using the device, the classifier classifying user behaviour as compliant or non-compliant such that compliant behaviour is determined by the classifier to be consistent with prior behaviour for permitting access to the device; initialising a measure of a period since a most recent compliant behaviour occurred; and responsive to a determination that a subsequent behaviour is classified as non-compliant and that the period meets a threshold beyond which access to the device is to be prevented, requesting a credential-based authentication of the user and permitting access to the device in response to the credential-based authentication, wherein permitting access to the device further includes re-initialising the measure of the period and constructively training the classifier based on the subsequent behaviour as a compliant behaviour by providing the subsequent behaviour as an additional training example.

Preferably, the period is measured as a number of occasions when access to the device is prevented based on non-compliant behaviour. Preferably, preventing access to the device further includes constructively training the classifier based on the subsequent behaviour as a non-compliant behaviour by providing the subsequent behaviour as an additional training example. Preferably, the component is one or more of: a location sensor; a position sensor; an orientation sensor; an accelerometer; an input device; a touch-screen; a temperature sensor; a time determiner; a pressure sensor; an olfactory sensor; a chemical sensor; a biometric sensor; a heart rate sensor; a cardiogram generator; a sound sensor; a voice recognition component; a handwriting recognition component; a global positioning system; and a gyroscope. Preferably, the credential-based authentication includes one or more of: an authentication scheme using a user identifier and password; a key-based user authentication scheme; a token-based user authentication scheme; and a multi-factor authentication scheme in which authentication is requested via a different device.

According to a second aspect of the present invention, there is a provided a computer system including a processor and memory storing computer program code for performing the steps of the method set out above.

According to a third aspect of the present invention, there is a provided a computer system including a processor and memory storing computer program code for performing the steps of the method set out above.

<FIG> is a block diagram of a computer system suitable for the operation of embodiments of the present invention. A central processor unit (CPU) <NUM> is communicatively connected to a storage <NUM> and an input/output (I/O) interface <NUM> via a data bus <NUM>. The storage <NUM> can be any read/write storage device such as a random-access memory (RAM) or a non-volatile storage device. An example of a non-volatile storage device includes a disk or tape storage device. The I/O interface <NUM> is an interface to devices for the input or output of data, or for both input and output of data. Examples of I/O devices connectable to I/O interface <NUM> include a keyboard, a mouse, a display (such as a monitor) and a network connection.

<FIG> is a component diagram of an arrangement for access control for a user device <NUM> according to an embodiment of the present invention. The user device <NUM> is a computing device such as a portable computing device, tablet computer, smartphone, mobile terminal, gaming device, in-vehicle information system, in-vehicle control device, medical device, communications device, entertainment device or other device as will be apparent to those skilled in the art and as may be conceived even after the relevant date of the present application. The user device <NUM> is used by at least one user in a manner that constitutes user behaviour. Such behaviours can include, by way of example only and inter alia: a particular holding, handling, orientation and/or movement of the device <NUM>; a rotation, degree of pressure, speed of interaction, frequency of interaction of the device <NUM>; a location, position, relative location, speed, velocity or altitude of the device; an environmental characteristic, temperature, humidity or pressure of the device; the use of a particular hand, finger, limp, facial feature to handle, hold or interact with the device; particular biometric characteristics of the user using the device; characteristics of use of the device including particular user interaction behaviours such as user interface gestures, characteristic interactions, swipes, button presses, style of interaction, pressure of interaction; and other behavioural characteristics as will be apparent to those skilled in the art. Notably, certain of the exemplary behaviours are described in terms characteristics of a user, an environment, the device or interaction therebetween and these are considered to constitute behaviours of the user who, for example, places the device in such environment, or interacts using such user characteristics.

The device <NUM> includes at least one behaviour component <NUM> as a hardware, software, firmware or combination component adapted to determine a behaviour of a user of the device <NUM>. For example, the behaviour component <NUM> can include one or more of, inter alia: a location sensor; a position sensor; an orientation sensor; an accelerometer; an input device; a touch-screen; a temperature sensor; a time determiner; a pressure sensor; an olfactory sensor; a chemical sensor; a biometric sensor; a heart rate sensor; a cardiogram generator; a sound sensor; a voice recognition component; a handwriting recognition component; a global positioning system; a gyroscope; and other behaviour components as will be apparent to those skilled in the art.

An access control component <NUM> is provided as a hardware, software, firmware or combination component for providing access control for the device <NUM>. Access control includes determining, for a user seeking to access or accessing the device <NUM>, whether the user's access is authorised and providing or continuing access for such user, or alternatively whether the user's access is not authorised and preventing access for such user. Preventing access can include, for example, locking, powering off, disabling or otherwise securing the device <NUM> from use by the unauthorised user.

The access control component <NUM> is arranged to perform access control interventions for the device <NUM> by which access to the device <NUM> by a user is granted or prevented, the interventions being triggered according to one or more predetermined rules. In one embodiment, the access control component <NUM> is configured to undertake continuous authentication of a user such that access control is implemented on a regular, routine or substantially continuous basis, such as, for example, inter alia: every predetermined period of time according to a particular frequency; whenever a particular operation or class of operation is performed by the device <NUM> such as opening an application, performing a data transfer, accessing a screen or the like; on the basis of a stochastic variable such that authentication is triggered periodically stochastically; or on some other continuous, regular or similar basis as will be apparent to those skilled in the art.

The access control component <NUM> is operable with a classifier <NUM> constituted as a machine learning algorithm such as, by way of example: a perceptron classifier; a naive Bayes classifier; a decision tree classifier; a logistic regression classifier; a k-nearest neighbour classifier; an artificial neural network or deep learning classifier; a support vector machine or other classifier as will be apparent to those skilled in the art. The classifier is trained by a trainer <NUM> as a software, hardware, firmware or combination component adapted to undertake training of the classifier <NUM> based on training examples. In particular, the classifier <NUM> is trained based on behaviour of a user (or, conceivably, multiple users) of the device <NUM> determined by the behaviour component <NUM> such that the classifier is able to classify subsequent user behaviour as either compliant with training examples for an authorised user or non-compliant. Notably, a classification of non-compliance is a classification that behaviour is not consistent with behaviour of an authorised user as learned by the classifier <NUM>. In some embodiments, the classifier <NUM> can be further trained with training examples including behaviour of non-authorised users such that the determination of non-compliance by way of the classifier <NUM> can also be effected as a consistency of behaviour with the training examples for non-authorised users. Accordingly, the trainer <NUM> initially trains the classifier <NUM> with at least one prior behaviour of an authorised user, each training example including a characterisation of a behaviour and, in some embodiments, an indication of whether such behaviour related to an authorised or un-authorised user. Behaviour characteristics can be encoded for use in training and sampling the classifier <NUM> using any suitable method such as a one-hot or multi-hot vector encoding.

Thus, in use, the access control component <NUM> provides a determination of whether a user of the device <NUM> is authorised to access the device based on behaviour characteristics received from the behaviour component <NUM> and with reference to the classifier <NUM>. According to embodiments of the present invention, the access control component <NUM> is further adapted to trigger or perform additional training of the classifier <NUM> responsive to at least positive authentications of a user accessing the device <NUM> so as to further improve a model, data structure, neural network or other machine learning construct of the classifier <NUM> and, therefore, the suitability of the classifier <NUM> for classifying user behaviours as compliant (for authorisation) or non-compliant (for non-authorisation). Thus, on determination of at least a positive authorisation of a user based on a behaviour classification for the user, the access control component <NUM> formulates a new training example including the user's behaviour and, depending on the machine learning approach, its classification as a compliant behaviour, and triggers the trainer <NUM> to perform a further training process of the classifier using such new training example, such further training being additional to all prior training of the classifier <NUM>. Thus, the classifier <NUM> is constructively trained in that it is trained additionally to its existing training so as to progressively improve the suitability of the classifier <NUM>.

Where user behaviour is classified by the classifier <NUM> as non-compliant, the access control component <NUM> is arranged to invoke a credential-based authenticator <NUM> to confirm a state of authorisation for the user. The credential-based authenticator <NUM> is a hardware, software, firmware or combination component for authenticating a user's authorisation to access the device <NUM> based on credential and/or challenge responses of the user. For example, a credential-based authentication scheme can include, inter alia: an authentication scheme using a user identifier and password; a key-based user authentication scheme; a token-based user authentication scheme; a multi-factor authentication scheme in which authentication is requested via a different device, and other credential-based authentication schemes as will be apparent to those skilled in the art. The premise of a credential-based authentication scheme is that an ability to present authorised credentials or suitably respond to an authentication challenge serves to confirm a state of authorisation to access the device <NUM>. Thus, the authentication-based authentication scheme is used as a definitive confirmation of a state of authorisation of a user. Thus, a user exhibiting behaviour classified by the classifier <NUM> as non-compliant but nonetheless able to successfully authenticate using the credential-based authentication scheme is permitted to access the device <NUM> by the access control component <NUM>. Furthermore, such a user exhibiting behaviour classified as non-compliant and nonetheless being permitted access to the device <NUM> based on the credential-based authentication scheme is used by the access control component <NUM> to generate a new training example for the classifier <NUM>. Such new training example is used to constructively train the classifier <NUM> in the manner previously described so as to improve the suitability of the classifier to classify behaviour such as that which was previously classified as non-compliant but which was nonetheless determined to be behaviour of an authorised user based on the credential-based authentication scheme. Notably, the new training example in the case of a user authenticated by a credential-based authentication scheme, will include the behaviour of the user and the credential-based authentication outcome: i.e., that the user is authorised and, thus, should be deemed compliant in the classifier.

Where user behaviour is classified by the classifier <NUM> as non-compliant and the user fails to successfully authenticate using the credential-based authentication scheme, access to the device for the user is prevented. In this way, unauthorised users are prevented from accessing the device <NUM>. Preferably, the access control component <NUM> is further adapted to trigger or perform additional training of the classifier <NUM> responsive also to negative authentications of a user accessing the device <NUM> so as to further improve a model, data structure, neural network or other machine learning construct of the classifier <NUM> and, therefore, the suitability of the classifier <NUM> for classifying user behaviours as compliant (for authorisation) or non-compliant (for non-authorisation). That is, where a user is found to be non-compliant based on the classifier <NUM> and the user fails to authenticate using the credential-based authentication scheme, the behaviour of such user can be used to reinforce the non-compliance in the classifier <NUM> by a further training example generated from the behaviour and the non-authorised status of the user.

In this way, the classifier <NUM> is progressively improved through constructive training during repeated authentication processes.

It will be appreciated that, while the access control component <NUM>, the classifier <NUM>, the trainer <NUM> and the credential-based authenticator <NUM> are illustrated in <FIG> (and other Figures) as being separate from the device <NUM>, any or all of these components can be included in, integrated with, provided by, stored in and/or executed by the user device <NUM>. In a preferred embodiment, all of these components are provided as services, facilities or features of the device <NUM> such that the device <NUM> is operable to perform access control without external assistance. In alternative embodiments, any of the components <NUM> to <NUM> may be provided by a separate computer system such as a network connected computer system accessible to the device <NUM> by way of a communications network, such as by secure network communication using encryption. Furthermore, any of components <NUM> to <NUM> can be provided as cloud based or virtual services. The same applied to the other embodiments described with respect to <FIG>.

<FIG> is a flowchart of a method of access control according to an embodiment of the present invention. Initially, at step <NUM>, the access control component <NUM> accesses the machine learning classifier <NUM> that is trained based on at least one prior behaviour of a user using the device. At step <NUM> the access control component <NUM> receives a subsequent behaviour of a user and determines, at step <NUM>, if the subsequent behaviour is compliant by classifying the subsequent behaviour using the classifier <NUM>. If the classifier <NUM> classifies the behaviour as compliant the method proceeds to step <NUM>. Otherwise, the method proceeds to step <NUM>. At step <NUM> the access control component <NUM> employs a credential-based authentication scheme by way of the credential-based authenticator <NUM> to authenticate the user. If the user fails to authenticate by the credential-based authentication at step <NUM> the method proceeds to step <NUM> where access to the device is prevented or ceased. Alternatively, if the method determines, at step <NUM>, that the user successfully authenticates by the credential-based authentication, the method proceeds to step <NUM>.

Step <NUM> is arrived at either from step <NUM> in the event of a compliant classification of user behaviour, or from step <NUM> in the event of successful authentication of the user by the credential-based authentication scheme. At step <NUM> the access control component <NUM> permits the user access to the device <NUM>. At step <NUM>, the access control component <NUM> generates a new training example for the trainer <NUM> to constructively train the classifier <NUM>, the training example being based on the subsequent user behaviour and the appropriate authentication outcome. Notably, the appropriate authentication outcome for users authorised by way of compliant classification or authenticated by way of the credential-based authentication scheme is "authorised" (or "compliant"), even if (in the event of credential-based authorised users) the original classification for the user was non-compliant.

As previously described, in the event of non-compliant behaviour of a user that further fails to authenticate by way of the credential-based authentication scheme, access is prevented as step <NUM>. In some embodiments, the behaviour, non-compliant and non-authorised state of such a user is additionally used as a new training example at step <NUM> to constructively train the classifier <NUM>. This serves to improve the classifier's suitability in respect of non-authorised users. This optional step from step <NUM> is indicated by a broken line in <FIG>.

<FIG> is an alternative arrangement of the access control component <NUM> of <FIG> in accordance with an embodiment of the present invention. Notably, the access control component <NUM> of <FIG> is identical to, and used in the same arrangement as, that described with respect to <FIG> except for differences described below.

The access control component <NUM> includes a period <NUM> as a variable, parameter or other suitable data item for storing an indication of a period since a most recent compliant behaviour of a user occurred. Notably, the period can be a time period measured in, for example, seconds, minutes and/or hours. Thus, the period can be recorded as a time of a most recent compliant behaviour such that a period since such time can be readily evaluated. Alternatively, the period can be a measure of a number of authentication attempts that have occurred resulting in non-compliance. For example, the period can be a measure of a number of occasions when access to the device <NUM> is prevented based on non-compliant behaviour.

The access control component <NUM> further includes a threshold period <NUM> as a predefined size, length or value of a period (whether measured in terms of, for example, time or non-compliant behaviour classifications), beyond which access to the device <NUM> is to be prevented. In use, the access control component <NUM> of <FIG> operates in substantially the same way as that of <FIG> except that non-compliant behaviour (as determined by the classifier <NUM>) does not lead to credential-based authentication and potential access prevention until a period <NUM> since a most recent compliant behaviour meets or exceeds the threshold period <NUM>. Thus, in this way, the access control component <NUM> can be seen to be permissive in the event of non-compliant behaviour for a predetermined period up to the threshold period <NUM>. Such a permissive approach to authentication is useful, for example, for non-critical devices, services or resources such as subscription resources where non-compliance indicates non-subscription (e.g. a user has not paid to use the device <NUM>) but cessation of access can be postponed for a period (the threshold period <NUM>) in the event that behaviour transitions to compliant behaviour. A tangible example of the usefulness of such an approach can be seen in the event that an authorised user of the device <NUM> (e.g. a paid-up subscriber) hands the device to a third party briefly for demonstration purposes. The third party is not a paid-up subscriber and is not an authorised user. The third party behaviours will be classified as non-compliant, but for the period up to the threshold period <NUM> access is not prevented such that the third party can utilise the device within the period. Once the threshold period is reached then the access control component <NUM> reverts to the approach described with respect to <FIG> in which a credential-based authentication scheme is invoked.

<FIG> is a flowchart of a permissive access control mechanism for a user device <NUM> according to an embodiment of the present invention. Many of the steps of <FIG> are identical to those described above with respect to <FIG> and a description of these will not be repeated here. Where <FIG> differs from <FIG>, <FIG> additionally includes a step <NUM> following step <NUM> at which the measure of a period <NUM> since a most recent compliant behaviour is initialised, for example, by setting the period <NUM> to zero or, in the case of a period measured in time, setting the period <NUM> to a current or predetermined time. Further, in <FIG>, where a user behaviour is classified as compliant at step <NUM>, the method proceeds to reset the period since most recent compliant behaviour at step <NUM>, for example by setting the period <NUM> to zero or, in the case of a period measured in time, setting the period <NUM> to a current time. In <FIG>, where a user behaviour is classified as non-compliant at step <NUM>, the method proceeds to step <NUM> where the access control component <NUM> determines if the threshold period <NUM> is reached. This can be achieved by a comparison between the period <NUM> and the threshold <NUM>. While the threshold is not reached the method proceeds to step <NUM> where the period measure <NUM> is adjusted by, for example, incrementing it or updating it to indicate an increase in the time since a most recent compliant behaviour. Subsequently, step <NUM> leads to step <NUM> where access to the device is permitted while the threshold is not reached. Where the threshold period is determined to be reached at step <NUM>, the method proceeds to step <NUM> where credential-based authentication is performed as described above with respect to <FIG>. All other steps of <FIG> are as previously described with respect to <FIG>.

<FIG> is an alternative arrangement of the access control component <NUM> of <FIG> in accordance with an embodiment of the present invention. Notably, the access control component <NUM> of <FIG> is identical to, and used in the same arrangement as, that described previously with respect to <FIG> and/or <FIG> except for differences described below.

The access control component <NUM> of <FIG> is adapted for initial training of the classifier <NUM> such that the classifier <NUM> is suitable for classifying behaviour of a user as compliant or non-compliant as indicative of authorised and non-authorised users respectively. Notable, access control component <NUM> as will be described here with reference to <FIG> is used to undertake or trigger initial training of the classifier <NUM>. This initial training is required for a classifier <NUM> that is as yet untrained or not sufficiently trained for the purpose of use in the arrangements of, for example, <FIG>, <FIG>, <FIG>. Thus, the training triggered or performed by the access control component <NUM> during the authentication process of, for example, <FIG> and <FIG>, is the same as previously described. The initial training provided by the access control component <NUM> here and with respect to <FIG> is additional to this.

The access control component <NUM> of <FIG> further includes a training period <NUM> variable, parameter or other suitable data item. The training period <NUM> is a predetermined indication of a period during which training of the classifier <NUM> is performed and during which all authentication of users to access the device <NUM> is performed using the credential-based authenticator <NUM> as previously described. The training period <NUM> can be constituted as, for example, a time period, a duration, a number of training examples, a number of authentication attempts or other suitable definition of a period for training as will be apparent to those skilled in the art. In use, the access control component <NUM> determines if an authentication is to take place within the training period <NUM> and, if so, performs a credential-based authentication process to authenticate a user. Behaviour information is nonetheless received by the access control component <NUM> and is used along with the result of the credential-based authentication process to generate training data as training examples for training the classifier <NUM> by the trainer <NUM>. Notably, training examples are generated for both authenticated users (such examples including the user behaviour and compliant state), and non-authenticated users (such examples including the user behaviour and non-compliant state). Once the training period <NUM> has ended, passed or otherwise expired then the training examples are used to train the classifier <NUM> such that the classifier <NUM> is suitable for use in methods of behavioural authentication such as those described with respect to <FIG>, <FIG>, <FIG> or <FIG>.

<FIG> is a flowchart of a method of training a classifier <NUM> for use with the embodiments of <FIG>, <FIG>, <FIG> and/or <NUM> in accordance with an embodiment of the present invention. Initially, at step <NUM>, the training period <NUM> is defined. At step <NUM> user behaviour for a user is received from the behaviour component <NUM>. At step <NUM> a credential-based authentication scheme is used to determine a state of authentication of the user - either authorised or non-authorised. At step <NUM>, a new training example is generated as training data for the classifier <NUM> based on the received behaviour information and the state of authorisation for the user. At steps <NUM>, <NUM> and <NUM> access to the device is permitted or prevented in dependence on the state of authentication of the user based on the credential-based authentication scheme. At step <NUM> the method determines if the training period has ended and loops to step <NUM> until the training period has ended. Once the training period ends the method proceeds to step <NUM> where the access control component <NUM> undertakes or triggers training of the classifier <NUM> by the trainer <NUM> based on the training examples generated at the iterated step <NUM>. Subsequently, the trained classifier <NUM> is used in methods of behavioural authentication such as those described with respect to <FIG>, <FIG>, <FIG> or <FIG>.

<FIG> is a component diagram of an arrangement for behaviour-based access control for a user device <NUM> according to an embodiment of the present invention. Many of the elements of <FIG> are identical to those described above with respect to <FIG> and these will not be repeated here. The device <NUM> of <FIG> includes a plurality of behaviour components <NUM> each adapted to provide different behaviour information for a user of the device. For example, each behaviour component <NUM> can constitute a different sensor or set of sensors for determining behaviour of a user. Further, in <FIG> multiple classifiers <NUM> are provided, each corresponding to a behaviour component <NUM> of the device. While each of the classifiers <NUM> acts substantially as previously described with respect to <FIG>, the multiplicity of classifiers <NUM> is such as to provide a classifier for each different behaviour information received from the different multiple behaviour components <NUM>. Thus, for example: a location sensor behaviour component can have associated a classifier for classifying location information; a user gesture behaviour component can have associated a classifier for classifying user gestures; and so on.

Further, the access control component <NUM> of <FIG> includes a predetermined compliance threshold <NUM> as a parameter, variable or other data item for determining a strength, confidence or other degree of compliance of all classifiers <NUM> in aggregate required in order to authenticate a user and provide access to the device <NUM>. Thus, in use, each classifier <NUM> classifies behaviour information from the behaviour components <NUM> as previously described in order to determine a classification as either compliant or non-compliant. Furthermore, each classifier is operable to provide a strength, confidence or other degree of membership of received behaviour with its determined classification such that a degree of membership of behaviour with a compliant or non-compliant classification is provided. Such a degree of membership can be provided as, for example, a weight of connections in a neural network leading to the classification outcome, a confidence measure of the classifier, or other suitable measure of a degree of membership of behaviour with a classification. For example, state vector machines can allow the retrieval of classification confidence on which basis a prediction classification is generated. Alternatively, a classifier <NUM> that provides a probabilistic score for its classifications, such as logistic regression classifiers, can be used whereby the score can constitute such degree of membership.

The degree of membership of each classifier for behaviours of a user are aggregated such as by statistical average, summation, or other suitable means. Thus, a degree of compliance of a user is evaluated. This degree of compliance is compared with the compliance threshold <NUM> and only where the threshold degree is met will compliance of a user be determined for the purpose of permitting access to the device. Non-compliance can result in the use of a credential-based authentication scheme as previously described.

<FIG> is a flowchart of a method of access control for the embodiment of <FIG> in accordance with an embodiment of the present invention. Many of the steps of <FIG> are identical to those described previously with respect to <FIG> and these will not be repeated here. <FIG> additionally includes, after step <NUM>, new step <NUM> in which the threshold degree of compliance <NUM> is initialised to a predetermined threshold degree. Subsequently, after receipt of a set of behaviours <NUM> from the behaviour components <NUM>, the method evaluates a degree of compliance at step <NUM> on aggregate for all behaviours based on the classifiers <NUM> for the behaviours. At step <NUM> the method determines if the degree of compliance meets the threshold degree <NUM> and, if the threshold is met, the method proceeds to step <NUM> where access to the device is permitted. Alternatively, if the threshold is not met, the method proceeds to step <NUM> where a credential-based authentication scheme is employed. All other steps of the method of <FIG> are identical to those described with respect to <FIG>.

<FIG> is a component diagram of an arrangement for multi-classifier access control for a user device <NUM> according to an embodiment of the present invention. Many of the elements of <FIG> are identical to those described above with respect to <FIG>, <FIG>, <FIG> and <FIG> and these will not be repeated here. <FIG> includes a pair of classifiers - a first classifier <NUM> and a second classifier <NUM>, each of which is substantially consistent with the classifiers as hereinbefore described. The first and second classifiers <NUM>, <NUM> of <FIG> are used to provide a multi-level classification scheme of user behaviour such that atypical behaviour that is classified as non-compliant by the first classifier <NUM> can be processed by the second classifier <NUM> to determine if such atypical behaviour is nonetheless typical for the user of non-compliant behaviour according to the first classifier <NUM>. Such an approach is particularly beneficial where the device <NUM> transitions between two distinct contexts such as: a primary context in which the device is primarily used and in which user behaviour is modelled by the first classifier <NUM> as most typical or prevalent behaviour; and a secondary context in which the device is occasionally used an in which user behaviour is modelled by the second classifier <NUM>. Such different contexts are widely experienced in real use-cases, with examples including: a secondary context in which the device <NUM> is used in an aircraft or other vehicle that is occasional and can restrict, constrain or otherwise affect user behaviour due to, for example, constraints of space or usage permission; a secondary context in which the device <NUM> is occasionally used in different environmental conditions such as in the dark, at night, in a sunny location or the like, such that user behaviour is affected due to, for example, a need to operate the device differently to provide illumination or avoid glare or the like; a secondary context in which the device is put to a different use-case such as, for example, an everyday device being used as a presentation device for sharing content with a group in which case the device may be handled, operated or otherwise used differently exhibited by differing behaviours; and other such secondary contexts in which behaviours occasionally differ from a primary context as will be apparent to those skilled in the art. Notably, the exact nature, cause and type of such distinction between a primary and secondary context are not important to embodiments of the present invention which are arranged to learn classification schemes and model behaviour in contexts irrespective of the nature or cause.

Thus, in the arrangement of <FIG>, the first classifier <NUM> operates substantially as previously described with respect to <FIG> to classify user behaviour to determine compliance or non-compliance as a basis for access control for the device <NUM>. The second classifier <NUM> provides a secondary classification scheme for behaviours that are classified non-compliant by the first classifier <NUM> but where a user otherwise successfully authenticates using a credential-based authentication scheme. The second classifier <NUM> is therefore trained based on training examples arising from behaviours found non-compliant by the first classifier <NUM> so as to classify such behaviours as compliant or non-compliant with typical behaviours in a secondary user context. Preferably, such behaviours found to be non-compliant by the first classifier <NUM> but authenticated by the credential-based authenticator <NUM> are not used as training examples for the first classifier <NUM> to provide a distance between the two classifiers <NUM>, <NUM> allowing each classifier to specialise in their respective user contexts. In contrast, behaviours leading to a complete failure to authenticate by classification as non-compliant by both the first and second classifiers <NUM>, <NUM> and a failure to authenticate by credential-based authentication can be used as training examples for both classifiers <NUM>, <NUM> since such behaviours are indicative of non-compliant user behaviour in both primary and secondary user contexts and for which device access should be prevented.

<FIG> is a flowchart of a method of access control for the embodiment of <FIG> in accordance with an embodiment of the present invention. Initially, at step <NUM>, the method accesses the first machine learning classifier <NUM> and receives a user behaviour at step <NUM>. The first classifier <NUM> classifies the received behaviour and where the behaviour is classified as compliant at step <NUM> the method proceeds to step <NUM> where the first classifier is constructively trained using the behaviour and compliant status as a new training example. Following constructive training at step <NUM>, access to the device is provided to the user at step <NUM>.

Where the behaviour is determined at step <NUM> to be non-compliant based on the first classifier <NUM>, the method proceeds to step <NUM>. At step <NUM> the second classifier <NUM> is accessed and the behaviour is classified according to the second classifier <NUM>. Where the behaviour is classified as compliant by the second classifier <NUM> at step <NUM> the method proceeds to step <NUM> where the second classifier <NUM> is constructively trained using the behaviour and compliant status as a new training example. Following constructive training at step <NUM>, access to the device is provided to the user at step <NUM>.

Where the behaviour is determined at step <NUM> to be non-compliant based on the second classifier <NUM>, the method proceeds to step <NUM> where a credential-based authentication scheme is employed to authenticate the user. If the user is successfully authenticated using the credential-based authentication scheme at step <NUM>, the method proceeds to step <NUM> which as been previously described. If the user is not successfully authenticated using the credential-based authentication scheme at step <NUM>, the method proceeds to step <NUM> where access to the device <NUM> is prevented. Notably, on failure to authenticate by the credential-based authentication scheme, the behaviour and it's status as non-compliant in both the first and second classifiers <NUM>, <NUM> can be used to constructively train either or both classifiers <NUM>, <NUM> to improve the suitability of the classifiers <NUM>, <NUM> to classify non-compliance effectively. This is indicated by the logical flows in <FIG> depicted by broken lines.

Suitably, the computer program is stored on a carrier medium in machine or device readable form, for example in solid-state memory, magnetic memory such as disk or tape, optically or magneto-optically readable memory such as compact disk or digital versatile disk etc., and the processing device utilises the program or a part thereof to configure it for operation. The computer program may be supplied from a remote source embodied in a communications medium such as an electronic signal, radio frequency carrier wave or optical carrier wave. Such carrier media are also envisaged as aspects of the present invention.

It will be understood by those skilled in the art that, although the present invention has been described in relation to the above described example embodiments, the invention is not limited thereto and that there are many possible variations and modifications which fall within the scope of the invention.

Claim 1:
A computer implemented method of access control for a user device having at least one component for determining behaviours of the user, the method comprising:
accessing (<NUM>) a machine learning classifier trained based on at least one prior behaviour of the user using the device, the classifier classifying user behaviour as compliant or non-compliant such that compliant behaviour is determined by the classifier to be consistent with prior behaviour for permitting access to the device;
initialising (<NUM>) a measure of a period since a most recent compliant behaviour occurred; and
responsive to a determination that a subsequent behaviour is classified as non-compliant and that the period meets a threshold beyond which access to the device is to be prevented, requesting (<NUM>) a credential-based authentication of the user and permitting access to the device in response to the credential-based authentication,
wherein permitting access to the device further includes re-initialising (<NUM>) the measure of the period and constructively training (<NUM>) the classifier based on the subsequent behaviour as a compliant behaviour by providing the subsequent behaviour as an additional training example.