Activity recognition to confirm secure authentication of a user

Patent metadata

Field	Value
Publication number	US-10169562-B2
Application number	US-201514837334-A
Country	US
Kind code	B2
Filing date	Aug 27, 2015
Priority date	Aug 27, 2015
Publication date	Jan 1, 2019
Grant date	Jan 1, 2019

Abstract

A method of two-factor authentication for gaining access to an application using at least a first device and a second device registered to a user. The first and second devices each have a plurality of sensors for detecting activity modalities of the user on the first and the second devices and are in communication with a server computer. In the method, the server computer: receives credentials and detected activity modality for gaining access to the application from the first device; sends a request to the second device registered to the user for activity modality of the user; receives the detected activity modality from the second device; compares the detected activity modality of first device to the detected activity modality of the second device; and if the detected activity modalities of first device and the second device match, granting access to the user on the first device to the application.

First claim

What is claimed is:

1. A method of two-factor authentication for gaining access to an application using a first device and a second device registered to a user, the first device and the second device each having a plurality of sensors for detecting activity modalities indicative of a user's behavior relative to the first device and the second device, the first device and the second device in communication with a server computer, comprising the steps of:
the server computer receiving credentials from the first device for gaining access to the application and at least two detected activity modalities of a locomotive state of the user indicating a type of locomotion of the user and a geographical location state of the user detected by the first device;
the server computer sending a request to the second device registered to the user for at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user;
the server computer receiving the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user from the second device;
the server computer comparing the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user detected by the first device to the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user received from the second device; and
the server computer granting access to the user on the first device to the application if the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user detected by the first device matches the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user received from the second device.

2. The method of claim 1 , wherein if the detected activity modalities of first device to the detected activity modalities of the second device mismatch, the server computer denies access to the application.

3. The method of claim 2 , further comprising the step of the server computer sending a notification to the second device regarding the denied access to the application.

4. The method of claim 1 , wherein the detected active modality of the locomotive state of the user received from the second device includes a working state of the user relative to the second device.

5. The method of claim 1 , further comprising the step of the server computer receiving registration information of the user from the first device and the second device.

6. The method of claim 1 , further comprising the steps of:
the first device receiving credentials to access the application;
the first device capturing the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user; and
the first device sending the credentials and the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user to the server computer.

7. The method of claim 1 , further comprising the steps of:
the second device receiving the request for at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user from the server computer;
the second device capturing the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user; and
the second device sending the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user to the server computer.

8. A computer program product for two-factor authentication for gaining access to an application using a first device and a second device registered to a user, the first device and the second device in communication with a server computer comprising at least one processor, one or more memories, one or more non-transitory computer readable storage media and the first device and the second device each having:
a computer comprising at least one processor, one or more memories, one or more computer readable storage media, and a plurality of sensors for detecting activity modalities indicative of a user's behavior relative to the first device and the second devices, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by the computer to perform a method comprising:
receiving, by the server computer, credentials from the first device for gaining access to the application and at least two detected activity modalities of a locomotive state of the user indicating a type of locomotion of the user and a geographical location state of the user detected by the first device;
sending, by the server computer, a request to the second device registered to the user for at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user;
receiving, by the server computer, the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user from the second device;
comparing, by the server computer, the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user detected by the first device to the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user received from the second device; and
granting, by the server computer, access to the user on the first device to the application if the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user detected by the first device matches the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user received from the second device.

9. The computer program product of claim 8 , wherein if the detected activity modalities of first device to the detected activity modalities of the second device mismatch, denying access, by the server computer, to the application.

10. The computer program product of claim 9 , further comprising the program instructions of sending, by the server computer, a notification to the second device regarding the denied access to the application.

11. The computer program product of claim 8 , wherein the detected active modality of the locomotive state of the user received from the second device includes a working state of the user relative to the second device.

12. The computer program product of claim 8 , further comprising the program instruction of receiving, by the server computer, registration information of the user from the first device and the second device.

13. The computer program product of claim 8 , further comprising the program instructions of:
receiving, by the first device, credentials to access the application;
capturing, by the first device, the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user; and
sending, by the first device, the credentials and the at least two detected activity modalities of the locomotive state of the user and the geographical location state of the user to the server computer.

14. The computer program product of claim 8 , further comprising the program instructions of:
rec

Assignees

• IBM

Inventors

• Bandyopadhyay Sambaran
• Ekambaram Vijay
• Sadacharam Saravanan
• Sree Prakash Ashok Pon Kumar

Classifications

• H04W12/06

  Authentication · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• G06F21/445

  by mutual authentication, e.g. between devices or programs · CPC title

• G06F21/34 Primary

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title