Technologies for enhanced user authentication using advanced sensor monitoring

Patent metadata

Field	Value
Publication number	US-10083304-B2
Application number	US-201715445298-A
Country	US
Kind code	B2
Filing date	Feb 28, 2017
Priority date	Dec 23, 2014
Publication date	Sep 25, 2018
Grant date	Sep 25, 2018

Abstract

Technologies for information security include a computing device with one or more sensors. The computing device may authenticate a user and, after successful authentication, analyze sensor data to determine whether it is likely that the user authenticated under duress. If so, the computing device performs a security operation such as generating an alert or presenting false but plausible data to the user. Additionally or alternatively, the computing device, within a trusted execution environment, may monitor sensor data and apply a machine-learning classifier to the sensor data to identify an elevated risk of malicious attack. For example, the classifier may identify potential user identification fraud. The computing device may trigger a security response if elevated risk of attack is detected. For example, the trusted execution environment may trigger increased authentication requirements or increased anti-theft monitoring for the computing device. Other embodiments are described and claimed.

First claim

The invention claimed is:

1. A computing device for elevated risk response, the computing device comprising:
a processor; and
one or more memory devices having stored therein a plurality of instructions that, when executed by the processor, cause the computing device to:
monitor, by a trusted execution environment, sensor data from a plurality of sensors of the computing device, wherein the sensor data is indicative of a physical condition of a user of the computing device;
apply, by the trusted execution environment, a machine-learning classifier to the sensor data to identify an elevated risk of malicious attack to the computing device, wherein the elevated risk is based on the physical condition of the user of the computing device;
trigger, by the trusted execution environment, a security response in response to identification of the elevated risk;
establish, by the trusted execution environment, a secure connection with a reference server; and
receive, by the trusted execution environment, training data for the machine learning classifier via the secure connection; wherein to apply the machine-learning classifier to the sensor data comprises to supply the training data to the machine-learning classifier.

2. The computing device of claim 1 , wherein the sensor data comprises location data indicative of a location of the computing device.

3. The computing device of claim 1 , wherein the sensor data comprises soft behavioral biometric data indicative of usage of the computing device by a user.

4. The computing device of claim 1 , wherein to trigger the security response comprises to power on, by the computing device, one or more additional sensor of the computing device in response to the identification of the elevated risk.

5. The computing device of claim 1 , wherein to trigger the security response comprises to select a security response based on the elevated risk.

6. The computing device of claim 1 , wherein to trigger the security response comprises to increase, by the computing device, an authentication requirement of the computing device in response to the identification of the elevated risk.

7. The computing device of claim 1 , wherein to trigger the security response comprises to:
increase anti-theft monitoring by the computing device m response to the identification of the elevated risk; or
increase intrusion monitoring by the computing device m response to the identification of the elevated risk.

8. The computing device of claim 1 , wherein to trigger the security response comprises to restrict user access to the computing device in response to the identification of the elevated risk.

9. The computing device of claim 1 , wherein the one or more memory devices further comprise a plurality of instructions that when executed cause the computing device to:
generate, by the trusted execution environment, threat reference data in response to application of the machine-learning classifier, wherein the reference data is indicative of normal usage of the computing device or malicious attack of the computing device;
anonymize, by the trusted execution environment, the threat reference data to generate anonymized reference data; and
transmit, by the trusted execution environment, the anonymized reference data to the reference server via the secure connection.

10. A method for elevated risk monitoring, the method comprising:
monitoring, by a trusted execution environment of a computing device, sensor data from a plurality of sensors of the computing device, wherein the sensor data is indicative of a physical condition of a user of the computing device;
applying, by the trusted execution environment, a machine-learning classifier to the sensor data to identify an elevated risk of malicious attack to the computing device, wherein the elevated risk is based on the physical condition of the user of the computing device; and
identifying, by the trusted execution environment, the elevated risk of malicious attack in response to applying the machine-learning classifier;
triggering, by the trusted execution environment, a security response in response to identifying the elevated risk;
establishing, by the trusted execution environment, a secure connection with a reference server; and
receiving, by the trusted execution environment, training data for the machine learning classifier via the secure connection; wherein applying the machine-learning classifier to the sensor data comprises supplying the training data to the machine-learning classifier.

11. The method of claim 10 , wherein monitoring the sensor data comprises:
monitoring soft behavioral biometric data indicative of usage of the computing device by a user.

12. The method of claim 10 , wherein triggering the security response comprises powering on, by the computing device, one or more additional sensor of the computing device in response to identifying the elevated risk.

13. The method of claim 10 , wherein triggering the security response comprises selecting a security response based on the elevated risk.

14. The method of claim 10 , wherein triggering the security response comprises increasing, by the computing device, an authentication requirement of the computing device in response to identifying the elevated risk.

15. One or more non-transitory, computer-readable storage media comprising a plurality of instructions that in response to being executed cause a computing device to:
monitor, by a trusted execution environment of the computing device, sensor data from a plurality of sensors of the computing device, wherein the sensor data is indicative of a physical condition of a user of the computing device;
apply, by the trusted execution environment, a machine-learning classifier to the sensor data to identify an elevated risk of malicious attack to the computing device, wherein the elevated risk is based on the physical condition of the user of the computing device; and
identify, by the trusted execution environment, the elevated risk of malicious attack in response to applying the machine-learning classifier;
trigger, by the trusted execution environment, a security response in response to identifying the elevated risk;
establish, by the trusted execution environment, a secure connection with a reference server; and
receive, by the trusted execution environment, training data for the machine learning classifier via the secure connection; wherein to apply the machine-learning classifier to the sensor data comprises to supply the training data to the machine-learning classifier.

16. The one or more non-transitory, computer-readable storage media of claim 15 , wherein to monitor the sensor data comprises to:
monitor soft behavioral biometric data indicative of usage of the computing device by a user.

17. The one or more non-transitory, computer-readable storage media of claim 15 , wherein to trigger the security response comprises to power on one or more additional sensor of the computing device in response to identifying the elevated risk.

18. The one or more non-transitory, computer-readable storage media of claim 15 , wherein to trigger the security response comprises to select a security response based on the elevated risk.

19. The one or more non-transitory, computer-readable storage media of claim 15 , wherein to trigger the security response comprises to increase an authentication requirement of the computing device in response to identifying the elevated risk.

Assignees

• Intel Corp

Inventors

• Chhabra Jasmeet
• Smith Ned M
• Sheller Micah J
• Heldt-Sheller Nathan

Classifications

• G06F21/316 Primary

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• H04W12/06

  Authentication · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title