Device, system, and method of password-less user authentication and password-less detection of user identity

Patent metadata

Field	Value
Publication number	US-2016197918-A1
Application number	US-201615051700-A
Country	US
Kind code	A1
Filing date	Feb 24, 2016
Priority date	Nov 29, 2010
Publication date	Jul 7, 2016
Grant date	—

Abstract

Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting possible attackers; as well as password-less user authentication, and password-less detection of user identity. A system or a computing device requires a user to perform a particular unique non-user-defined task, the task optionally being an on-screen connect-the-dots task. The system monitors user interactions, extracts user-specific features that characterizes the manner in which the user performs the tasks; and subsequently relies on such user-specific features as a means for user authentication, optionally without utilizing a password or passphrase. Optionally, a user interface anomaly or interference is intentionally introduced in order to elicit the user to perform corrective gestures, which are optionally used for extraction of additional user-specific features.

First claim

What is claimed is:

1 . A method comprising:
differentiating between a first user and a second user of a computerized service, by performing:
(a) autonomously selecting a unique and non-user-defined task, that is intended to be performed by a specific user via an input unit of an electronic device;
(b) generating the task, and collecting user interactions data via the input unit while the user is performing the task;
(c) repeating step (b) for at least N iterations for said specific user, wherein N is a positive integer;
(d) during step (b) and during step (c), determining from said user interactions data a user-specific cognitive behavioral biometric profile;
(e) storing the user-specific cognitive behavioral profile in a repository;
(f) subsequently, generating said task again upon a subsequent request of a user to access said computerized service, and collecting fresh user interactions data from fresh performance of said task;
(g) if the fresh user interactions data that was collected from said fresh performance of said task, does not match the previously-stored user-specific cognitive behavioral biometric profile, then un-authorizing access of the user to the computerized service.

2 . The method of claim 1 , wherein the task is unique to said user relative to all other users of the computerized service.

3 . The method of claim 1 , wherein the task is unique to said electronic device relative to all other electronic devices that access the computerized service.

4 . The method of claim 1 , wherein the task is both (i) unique to said electronic device relative to all other electronic devices that access the computerized service, and (ii) unique to said user relative to all other users of the computerized service.

5 . The method of claim 1 , wherein the task comprises an on-screen dot-connecting task.

6 . The method of claim 1 , wherein the task comprises an on-screen dot-connecting task in which all dots are visible to the user immediately upon commencement of the task.

7 . The method of claim 1 , wherein the task comprises an on-screen dot-connecting task in which only a single dot is visible to the user immediately upon commencement of the task, and each subsequent dot is exposed to the user gradually as the user connects each dot that was exposed to him.

8 . The method of claim 1 , wherein the task is generated by selecting at least: a particular shape from a pool of available shapes, a particular scale from a pool of available scales, a particular number of dots from a number-of-dots pool.

9 . The method of claim 1 , comprising:
while the user is performing the task, introducing an input/output interference that triggers the user to perform corrective gestures; extracting one or more user-specific features from said corrective gestures; taking into account said one or more user-specific features, that were extracted from said corrective gestures, during at least one of these steps: (i) during constructing the reference user-specific behavioral signature; (ii) during constructing the fresh user-specific behavioral signature.

10 . The method of claim 1 , comprising:
during a first K usage-sessions of the user with the computerized service, wherein K is a positive integer: (a) requiring the user to both enter a password and to perform the task; (b) relying on the password for user authentication towards the computerized service; (c) not-relying on the task for user authentication towards the computerized service; starting at the K+1 usage-session of the user with the computerized service: (i) enabling the user to authenticate towards the computerized service without entering any password, if the user performs the task in a manner that matches the reference user-specific behavioral profile.

11 . The method of claim 1 , comprising:
during a first K usage-sessions of the user with the computerized service, wherein K is a positive integer: (a) requiring the user to both enter a password and to perform the task; (b) relying on the password for user authentication towards the computerized service; (c) not-relying on the task for user authentication towards the computerized service; upon completion of the first K usage-sessions, discarding the password; starting at the K+1 usage-session of the user with the computerized service: (i) enabling the user to authenticate towards the computerized service without entering any password, if the user performs the task in a manner that matches the reference user-specific behavioral profile.

12 . The method of claim 1 , wherein said task is utilized for user authentication in addition to requiring the user to manually enter a password.

13 . The method of claim 1 , wherein said task is utilized for user authentication instead of requiring the user to manually enter a password.

14 . The method of claim 1 , wherein said task is utilized for user authentication as a condition for granting access to the user to a physical location.

15 . The method of claim 1 , wherein said task is utilized for user authentication as a condition for granting access to the user to a vehicle.

16 . The method of claim 1 , wherein said task is utilized for user authentication as part of a multi-factor authentication process.

17 . The method of claim 1 , wherein said task is utilized as a secret question that the user is required to successfully perform in order to reset user credentials.

18 . The method of claim 1 , wherein collecting the user interactions data comprises collecting user interactions data both (i) during performance of the task, and (ii) immediately prior to performance of the task;
wherein generating the user-specific cognitive behavioral biometric profile is performed based on both (I) the user interactions during performance of the task, and (II) the user interactions immediately prior to performance of the task.

19 . The method of claim 1 , wherein collecting the user interactions data comprises collecting user interactions data both (i) during performance of the task, and (ii) immediately after performance of the task;
wherein generating the user-specific cognitive behavioral biometric profile is performed based on both (I) the user interactions during performance of the task, and (II) the user interactions immediately after performance of the task.

20 . The method of claim 1 , wherein collecting the user interactions data comprises collecting user interactions data (i) during performance of the task, and (ii) immediately prior to performance of the task, and (iii) immediately after performance of the task;
wherein generating the user-specific cognitive behavioral biometric profile is performed based on (I) the user interactions during performance of the task, and (II) the user interactions immediately prior to performance of the task, and (III) the user interactions immediately after performance of the task.

21 . The method of claim 1 , wherein collecting the user interactions data comprises both (i) collecting user interactions data via the input unit, and (ii) collecting one or more sensed parameters that are sensed via a sensor of the electronic device during task performance;
wherein generating the user-specific cognitive behavioral biometric profile is performed based on both (I) the user interactions via the input unit during performance of the task, and (II) the one or more sensed parameters that are sensed via said sensor of the electronic device during task

Assignees

• Biocatch Ltd

Inventors

• Turgeman Avi
• Moyal Tal
• Azizi Yaron

Classifications

• G06F21/316

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• G06F21/31

  User authentication · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title