With sensitive data becoming more commonly stored on user devices, more robust security features are being implemented to safeguard such user devices and prevent access to unauthorized users. Conventional security features, for example login credentials, single fingerprint scans, or security tokens, however, can be insufficient as an unauthorized user can still gain access to the user device. For instance, in the case of conventional biometric authentication (e.g. fingerprint scanning alone) several shortcomings can be taken advantage of to gain unauthorized access to the user device; a plastic fingerprint can be used, the finger of an authorized user can be used after death, and the finger of an authorized user can still be utilized if the authorized user is sleeping or under duress. According to the technology described herein, the deficiencies of conventional authentication systems and processes are overcome through the use of a multifactor biometric authentication scheme.
This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used in isolation as an aid in determining the scope of the claimed subject matter.
Embodiments of the technology described herein are directed towards methods and systems for authenticating a user on a user device through multifactor biometric authentication. In some embodiments, a heartrate based “liveness” test can be integrated into the authentication process to achieve advanced user authentication. A biometric sensor, or button, can be integrated into a user device to gather fingerprint data and heartrate data, to be used in conjunction with other data acquired by the user device to determine biometric results for authenticating a user and enable access to the user device. According to some embodiments of the technology described herein, the biometric sensor combines a fingerprint scanner and a heartrate detector into a single biometric sensor to implement the multifactor biometric authentication process. Thus the single biometric sensor mechanism can be employed to authenticate a user based on multiple biometric factors in a single login or authentication event.
In some embodiments, the biometric sensor can detect a physical contact between a user's finger and the biometric sensor. The fingerprint scanner can scan a user's fingerprint and the heartrate detector can measure the heartrate of the user. The scanned fingerprint data and the measured heartrate data can be compared to stored fingerprint and heartrate data to authenticate the user and enable access to the user device. In some embodiments, the user device can utilize one or more validation profiles and other acquired data to determine if the heartrate data is valid. Accordingly, an improvement in authentication processes and mechanisms on user devices is provided by enabling the multifactor biometric authentication technology described herein.
Aspects of the technology presented herein are described in detail below with reference to the attached drawing figures, wherein:
The subject matter of aspects of the present disclosure is described with specificity herein to meet statutory requirements. However, the description itself is not intended to limit the scope of this patent. Rather, the inventors have contemplated that the claimed subject matter might also be embodied in other ways, to include different steps or combinations of steps similar to the ones described in this document, in conjunction with other present or future technologies. Moreover, although the terms “step” and/or “block” can be used herein to connote different elements of methods employed, the terms should not be interpreted as implying any particular order among or between various steps herein disclosed unless and except when the order of individual steps is explicitly described. As used herein, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.
According to some aspects of the technology described herein, a mechanism for biometric authentication of a user on a user device can be implemented that combines a fingerprint scanner and a heart rate monitor into a single scanner button, for example a single biometric sensor. The fingerprint scanner, or fingerprint reader, comprises a camera on or around the edge of a biometric sensor button and can detect the ridges and minutia of a user's fingerprint. Once a user's fingerprint is scanned it can be compared to a stored fingerprint, for example the user device's or account owner's fingerprint, to authenticate the potential user's fingerprint and identity. The biometric sensor can also comprise a light-emitting diode (LED) and an optical input device, for example a camera, in the middle of the biometric sensor, more specifically in the middle of the fingerprint scanner. The LED shines a sharp light to illuminate the finger of the user and the device can measure biometric signals, for example, color variations in the illuminated finger, to detect and/or establish a heart rate of the user. Through a variety of algorithms stored in association with the user device, and stored data about the user's heart rate, in some instances corresponding to various activity levels, the user device can determine if the fingerprint is coming from a live person or if the person is under duress or sleeping. The received heartrate data can then be validated, in some instances validated within allowable parameters for the user, and if the validation is successful access to the user device can be enabled. According to various embodiments, the technology described herein combines a fingerprint scanner and a heart rate detector into one biometric sensor button such that multiple modes of user biometric information may be used simultaneously for authentication, i.e. during a single login event. In some implementations, various benchmarks and tolerances may be recorded and loaded into the authentication modules and mapped against real-time received data to authenticate a user attempting to access a user device or an application on the user device.
The biometric sensor can be integrated into a user device or in otherwise operable communication with the user device. The biometric sensor comprising the fingerprint scanner and the heartrate detector, the heartrate detector comprising the optical input device and the LED, can initially detect a physical contact between a user's finger and the biometric sensor. When the physical contact is detected by the biometric sensor, the fingerprint scanner and the heartrate detector can be activated or otherwise initialized. The fingerprint scanner, which can be implemented as a camera, can scan the user's fingerprint and detect, amongst other things, the ridges and other minutiae to obtain a full scan or representation of the user's fingerprint. The scanned fingerprint can then be compared to a stored fingerprint, or authentication fingerprint, to authenticate the fingerprint of the user. In some instances the user device can compare, using for example imaging technologies, the features of the scanned print pattern to the authentication print pattern to determine that the prints are a match. The stored authentication fingerprint can be received by the user device during an enrollment process.
The heartrate detector can receive a plurality of detectable biometric signals corresponding to a user's heartrate to determine a measured heartrate of the user during the physical contact between the user's finger and the biometric sensor. The LED can shine a sharp light to illuminate the finger of the user and the camera can receive optical input data, such as color variations in the illuminated finger. The optical input data can be processed by the user device to determine the measured heartrate. The measured heartrate of the user can subsequently be mapped to a stored validation profile for the user comprising a heartrate benchmark. The user device can determine that the measured heartrate is within or outside of a tolerance range corresponding to the heartrate benchmark of the validation profile. The measured heartrate can then be validated based on a generated indication that the measured heartrate is within the tolerance range. The measured heartrate will not be validated based on a generated indication that the measured heartrate is outside of the tolerance range. Access to the user device can be enabled based on a validated measured heartrate and an indication that the fingerprint is authenticated. In some embodiments, the validation profile can be created during an enrollment process. In some further embodiments, the validation profile can be one of a plurality of stored validation profiles each comprising a benchmark, a variance, and a tolerance. In some instances, each validation profile can correspond to an activity level of a user, for example walking, running, or at rest. During the heartrate validation process, the user device can utilize, for example, GPS and/or gyroscope technology to determine which validation profile the measured heartrate needs to be mapped to.
Referring now to the figures, with reference to
Among other components not shown, example operating environment 100 includes a client device or user device, such as client device 104. Each of the components shown in
It should be understood that any number of user devices, servers, and data sources 105 can be employed within operating environment 100 within the scope of the present disclosure. Each can comprise a single device or multiple devices cooperating in a distributed environment. Additionally, other components not shown can also be included within the distributed environment.
User device 104 can comprise any type of computing device or client device capable of use by a user that includes a biometric sensor as described herein. By way of example and not limitation, a user device 104 can include a biometric authentication engine 110 configured to run on the user device. The biometric authentication engine 110 can comprise a fingerprint authentication module 112 and a heartrate validation module 114. The biometric authentication module 110 can operate in conjunction with user device 104 and more particularly the biometric sensor of user device 104. In some embodiments, the functions of the technology described herein can be interpreted, analyzed, or otherwise processed by biometric authentication engine 110. Biometric authentication engine 110 can be configured to operate in conjunction with a biometric sensor integrated into user device 104. Based on biometric input data received by the biometric sensor (e.g. biometric sensor 204 of
Data storage 105 can comprise data sources and/or data systems, which are configured to make data available to any of the various constituents of operating environment 100, or systems 200 and 400 described in connection to
Continuing with
Heartrate validation module 224 can determine a measured heartrate of the user based on a plurality of detectable biometric signals received by the heartrate detector 207. LED 210 can illuminate the user's finger during the physical contact with the biometric sensor and optical input device 208 can read or otherwise receive the plurality of biometric signals, for example the variations in color or other optically perceivable signals. Based on the plurality of biometric signals, heartrate detection module 228 can determine a measured heartrate of the user. Validation profile selection module 230 can select a validation profile 212 based on the measured heartrate of the user. In some embodiments, one validation profile 212 is stored in association with the user and user device 202. In other embodiments, a plurality of validation profiles 212a, 212b, 212c, can be stored in association with the user and user device 202. Each validation profile 212a, 212b, 212c can comprise a benchmark 228 and a tolerance 230. In some embodiments, validation profile selection module 230 can select a validation profile 212a, 212b, 212c based on a determined activity level of the user. Additional technology integrated into user device 202 (e.g. GPS, gyroscope technology, or other positioning and movement recognition technology) can be utilized by validation profile selection module 230 to select an appropriate validation profile 212a, 212b, 212c based on the determined activity level. For example, if it is determined that the user is at rest, validation profile 212a may be selected for the authentication process. Alternatively, if a user is walking validation profile 212b may be selected for the authentication process. It will be appreciated that each validation profile 212a, 212b, 212c can have different benchmarks 228 or tolerance ranges 230.
Heartrate analysis module 232 can map the measured heartrate of the user to the selected validation profile 212, for example the measured heartrate of the user can be mapped to benchmark 228 of validation profile 212. Heartrate analysis module 232 can analyze, process, or otherwise determine is the measured heartrate of the user is within a tolerance range 230 corresponding to the heartrate benchmark 228 of the validation profile 212. If the measured heartrate is within tolerance range 230, an indication can be generated that the measured heartrate is validated. If the measured heartrate is outside of tolerance range 230, an indication can be generated that the measured heartrate is not validated. Access to the user device can subsequently be enabled by biometric authentication engine 222 based on the authenticated fingerprint (via fingerprint authentication module 226) and the validated measured heartrate (via heartrate validation module 224).
Validation profile generator 214 can be implemented to create and/or update one or more validation profiles 212a, 212b, 212c. During an initial enrollment process, a validation profile 212 can be created by validation profile generator 214 by measuring and recording (e.g. by heartrate recorder 216) a user's heartrate. Profiler module can generate or otherwise build a validation profile 212 based on a measured heartrate of the user received by heartrate detector 207. Profile module 218 can generate a benchmark (e.g. benchmark 228), tolerance range (e.g. tolerance 230), and determine a heartrate variance (e.g. 310 of
Turning now to
Turning now to
Turning now to
At step 502, physical contact is detected between a user's finger and a biometric sensor of a user device, the biometric sensor comprising a fingerprint scanner and a heartrate detector. Based on the detected physical contact, at step 504 the fingerprint scanner and the heartrate detector of the biometric scanner are activated. At step 506, a fingerprint, or fingerprint data, of the user can be received by the fingerprint scanner. Heartrate data of the user can be received by the heartrate detector, and at step 508 a measured heartrate of the user can be determined. At step 510, the measured heartrate of the user can be mapped to a validation profile, in some instances the validation profile is selected from amongst a plurality of validation profiles. The measured heartrate of the user can be mapped to the validation profile based on at least one of a heartrate benchmark corresponding to the validation profile and an activity level corresponding to the validation profile. At step 512 it can be determined that the measured heartrate is with a tolerance range corresponding to the validation profile, and based on that determination, the measured heartrate of the user can be validated. At step 516 the acquired fingerprint or fingerprint data of the user can be authenticated, e.g. by a biometric matching function. Based on the validated measured heartrate of the user and the authenticated fingerprint of the user, at step 518 access to the user device can be enabled.
Turning now to
Having described various embodiments of the invention, an exemplary computing environment suitable for implementing embodiments of the invention is now described. With reference to
Embodiments of the invention can be described in the general context of computer code or machine-useable instructions, including computer-useable or computer-executable instructions, such as program modules, being executed by a computer or other machine, such as a personal data assistant, a smartphone, a tablet PC, or other handheld device. Generally, program modules, including routines, programs, objects, components, data structures, and the like, refer to code that performs particular tasks or implements particular abstract data types. Embodiments of the invention can be practiced in a variety of system configurations, including handheld devices, consumer electronics, general-purpose computers, more specialty computing devices. Embodiments of the invention can also be practiced in distributed computing environments where tasks are performed by remote-processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.
With reference to
Computing device 700 typically includes a variety of computer-readable media. Computer-readable media can be any available media that can be accessed by computing device 700 and includes both volatile and nonvolatile, removable and non-removable media. By way of example, and not limitation, computer-readable media can comprise computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVDs) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by computing device 700. Computer storage media does not comprise signals per se. Communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media, such as a wired network or direct-wired connection, and wireless media, such as acoustic, RF, infrared, and other wireless media. Combinations of any of the above should also be included within the scope of computer-readable media.
Memory 712 includes computer storage media in the form of volatile and/or nonvolatile memory. The memory can be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical-disc drives. Computing device 700 includes one or more processors 614 that read data from various entities such as memory 712 or I/O components 720. Presentation component(s) 716 presents data indications to a user or other device. Exemplary presentation components include a display device, speaker, printing component, vibrating component, and the like.
The I/O ports 718 allow computing device 700 to be logically coupled to other devices, including I/O components 720, some of which can be built in. Illustrative components include a microphone, joystick, game pad, satellite dish, scanner, printer, wireless device. Some embodiments of computing device 700 can include one or more radio(s) 724 (or similar wireless communication components). The radio 724 transmits and receives radio or wireless communications. The computing device 700 can be a wireless terminal adapted to receive communications and media over various wireless networks. Computing device 700 can communicate via wireless protocols, such as code division multiple access (“CDMA”), global system for mobiles (“GSM”), or time division multiple access (“TDMA”), as well as others, to communicate with other devices. The radio communications can be a short-range connection, a long-range connection, or a combination of both a short-range and a long-range wireless telecommunications connection. When we refer to “short” and “long” types of connections, we do not mean to refer to the spatial relation between two devices. Instead, we are generally referring to short range and long range as different categories, or types, of connections (i.e., a primary connection and a secondary connection). A short-range connection can include, by way of example and not limitation, a Wi-Fi® connection to a device (e.g., mobile hotspot) that provides access to a wireless communications network, such as a WLAN connection using the 802.11 protocol; a Bluetooth connection to another computing device is a second example of a short-range connection, or a near-field communication connection. A long-range connection can include a connection using, by way of example and not limitation, one or more of CDMA, GPRS, GSM, TDMA, and 802.16 protocols.
Many different arrangements of the various components depicted, as well as components not shown, are possible without departing from the scope of the claims below. Embodiments of the present invention have been described with the intent to be illustrative rather than restrictive. Alternative embodiments will become apparent to readers of this disclosure after and because of reading it. Alternative means of implementing the aforementioned can be completed without departing from the scope of the claims below. Certain features and sub-combinations are of utility and can be employed without reference to other features and sub-combinations and are contemplated within the scope of the claims.