Step-up authentication

Abstract

A method for identifying and/or authenticating a user on a device, the method comprising: requesting identification or authentication of the user for a first task; determining a first threshold in dependence on the first task; selecting a first authentication process from a plurality of authentication processes; determining a confidence score in dependence on a performance of the selected first authentication process, wherein the confidence score indicates a level of confidence in the user's identity; determining whether the confidence score is above or below the first threshold; and if the confidence score is below the first threshold, selecting a second authentication process from the plurality of authentication processes, otherwise identifying or authenticating the user for the first task.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a U.S. national phase application under 35 U.S.C. § 371 of International Application No. PCT/GB2017/051997, filed on Jul. 6, 2017, which claims the benefit of priority to GB Application No. 1611932.3, filed on Jul. 8, 2016, the entire contents of each of which are incorporated by reference herein for all purposes.

This invention relates to identifying or authenticating a user.

Identification and/or authentication of a user is an essential step in accessing many secure services or devices, such as banking, stored personal details or other restricted data. This identification and/or authentication is usually achieved by the use of passwords or personal identification numbers (PINs), which are usually assumed to be known only by the authorised user or users of a service or device.

However, knowledge of a user's password or PIN is enough for an unauthorised third party to gain access to the service or device. Thus, improved security measures have been introduced to reduce the risk of passwords and PINs from being used by unauthorised third parties. Such measures include using biometric information about the user, for example, scanning a user's fingerprint or using a camera to perform facial recognition. These improved measures have made it more difficult for unauthorised third parties to gain access but they can still be circumvented and may not always be available to the user. For example, a fingerprint scanner on a smartphone may not be functioning correctly and so a user may be required to use another less secure measure such as entering a PIN. There is, therefore, a need to ensure that a user can be securely identified/authenticated whilst also considering the user experience during identification/authentication so that the procedure is not overly onerous.

According to a first aspect there is provided a method for identifying and/or authenticating a user on a device, the method comprising: requesting identification or authentication of the user for a first task; determining a first threshold in dependence on the first task; selecting a first authentication process from a plurality of authentication processes; determining a confidence score in dependence on a performance of the selected first authentication process, wherein the confidence score indicates a level of confidence in the user's identity; determining whether the confidence score is above or below the first threshold; and if the confidence score is below the first threshold, selecting a second authentication process from the plurality of authentication processes, otherwise identifying or authenticating the user for the first task.

The second authentication process may be selected in dependence on a difference between the confidence score and the first threshold.

The first and/or second authentication process may be selected in dependence on the first task.

The method may further comprise updating the confidence score in dependence on a performance of the selected second authentication process.

The method may further comprise: requesting identification or authentication of the user for a second task; and determining a second threshold for the second task, wherein the second threshold is different to the first threshold.

The method may further comprise: determining whether the confidence score is above or below the second threshold; and if the confidence score is below the second threshold, selecting a third authentication process from the plurality of authentication processes, otherwise identifying or authenticating the user for the second task.

The first and/or second authentication process may be performed automatically by the device and/or a remote computing device.

The first threshold may be determined in dependence on the significance of the first task.

The plurality of authentication processes may comprise one or more biometric identification or authentication processes.

The method may further comprise: determining a lower threshold, wherein authentication of the user is rejected if the confidence score is determined to be below the lower threshold.

A system may be provided that is configured to perform the above method.

There may be provided computer program code for performing a method as claimed in any preceding claim. There may be provided non-transitory computer readable storage medium having stored thereon computer readable instructions that, when executed at a computer system, cause the computer system to perform the above method.

The above features may be combined as appropriate, as would be apparent to a skilled person, and may be combined with any of the aspects of the examples described herein.

The present invention will now be described by way of example with reference to the accompanying drawings. In the drawings:

FIG. 1 shows an example of a device for identifying and/or authenticating a user.

FIG. 2 shows a flow chart that illustrates one example of identifying or authenticating a user for a task.

The following description is presented to enable any person skilled in the art to make and use the invention, and is provided in the context of a particular application. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art.

The general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Thus, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.

For the purposes of this disclosure, identification typically involves the collection of data and a determination of who a user is from a database or other predetermined population of users, while authentication typically involves the use of data to confirm a user is who they present themselves to be (i.e. to verify a user's identity).

FIG. 1 illustrates an example of a device 10 which could be used to identify and/or authenticate a user for particular tasks. Identification and/or authentication of a user may be required in order to, for example: access the device 10 (e.g. unlocking the device); access local functions on the device 10 (e.g. accessing files or programs stored at the device 10); access remote functions via device 10 (e.g. accessing online banking facilities or databases at a remote server via a communications connection on the device 10), etc. Device 10 may be, for example, a smart device such as a smartphone or smartwatch, an ATM or other type of banking terminal, a payment terminal (such as a credit card machine) or any other suitable computing device.

The device 10 may comprise a camera 11, a display 12, a processor 13, a non-volatile memory or ROM 14, working memory or RAM 15, one or more sensors 16, a user input device 17 such a keypad or mouse and a communications interface 18 (which may a wired or wireless transceiver). In one example the display 12 may be a touchscreen, so it provides user input to the processor 13 in addition or alternatively to a separate user input device 17. The device may comprise a storage medium 19 such as flash memory. The ROM 14 may store program code that is executable by the processor 13. The program code may be stored in a non-transient form. The program code is executable by the processor 13 to perform some or all of the processes and functions described herein. Some of the processes and functions described herein may be performed at a computing device or system that is remote to device 10, such as one or more servers or cloud computing devices. The distribution of the processing burden may at least partly depend on the computational capabilities of the device 10 and remote computing device, and on the communication capabilities between the device 10 and remote computing device and/or the availability of communications networks between the devices. Preferably, device 10 collects information and sends that information to the remote computing device, where the majority of the processing is performed. However, the processes and functions described herein could be performed wholly or partly at either device.

The sensors 16 may be one or more sensors that are capable of gathering information about the user. For example, a GPS may be used to determine the location of the device and thus the user of the device. A motion sensor(s) (such as a gyroscope, accelerometer, pedometer, etc) may be used to derive biometric information about the user of the device (e.g. by using the sensors to determine typical movements and motions made by the user). The sensors 16 could be biometric sensors such as a fingerprint sensor, iris scanner, etc. Other ways of determining information about the user via other means are possible, for example, facial recognition via camera 11 and voice recognition via a microphone (not shown). The information gathered about the user may be used for certain authentication processes, as described below.

In operation, processor 13 may receive information from the user or information gathered about the user via the user input devices, the camera, sensors and/or the communications interface. That information may be processed to identify and/or authenticate the user, as described below. As mentioned above, some or all of the processing of this information may be performed at a remote computing device.

One way of providing increased security is to use multiple identification and/or authentication methods/processes and require that the user to pass all of the methods/processes before granting access. For example, a user may be required to position themselves in front camera for facial recognition as well as providing a passcode via a keypad. Although requiring a user to perform both of these methods increases security compared to performing just one of the methods, it also increases the time and effort required by the user to identify/authenticate themselves. Disclosed herein is an identification/authentication method that provides the improved security achieved from using multiple, different authentication processes but also allows the user to be identified/authenticated in a user-friendly manner.

A user may wish to be granted access for a particular task (e.g. accessing a smartphone, viewing bank account details, making a payment, etc). Each task may have different security requirements based on their significance or value. For example, it could be considered that accessing emails on a smartphone is more significant or valuable than taking a picture with that smartphone and so accessing emails may be considered to be a task requiring higher security than taking a picture. In another example, initiating a bank transfer may be considered to be more significant or valuable than viewing a bank statement and so initiating a bank transfer may be considered to be a task requiring higher security than viewing a bank statement. Thus, each task may be associated with certain level of security that is required to be met in order to allow a user to perform that task and each task may have a different level of security to other tasks. As will be discussed in more detail below, the present system may be configured such that in order for a user to be permitted to undertake an operation of greater significance or value that user must be identified or authenticated to a greater degree of confidence than in order for a user to be permitted to undertake an operation of lesser significance or value.

In the process described below, one or more processes for identifying and/or authenticating a user (also referred to herein as “authentication processes”) may be performed in order to determine if a user has met the security requirements for a particular task. These authentication processes could require the user to perform some sort of action and could be authentication processes such as entering a password/passcode, placing a finger on a fingerprint sensor, etc. The authentication processes could also be passive processes that could help identify or authenticate a user without requiring the user to perform a specific action or an action whose function is solely for identification or authentication purposes. For example, a passive authentication process could be determining a user location via GPS, monitoring user movement characteristics via an accelerometer, determining characteristics of a user's typing behaviour, etc.

The results of each authentication process may be checked against known data about an authorised user to determine a likelihood that the user being authenticated is the authorised user. The determined likelihood from each process may be used to determine a confidence score that indicates how likely the user is an authorised user. The confidence score may be generated based on the results from the authentication processes individually or a collective score from the results from multiple authentication processes.

FIG. 2 shows a flow diagram for identifying or authenticating a user for a task. That task may be, for example, unlocking a smartphone, accessing a bank account, accessing an email account, etc. The task may be associated with a level of security, as described above.

At step 201, an acceptance threshold for the task is determined. The acceptance threshold may be determined in dependence on the nature of the task. The acceptance threshold may be derived from the significance or level of security required for the task. For example, accessing a bank account may require a higher level of security than accessing an email account and so the acceptance threshold for accessing the bank account will be higher than the acceptance threshold for accessing the email account. The acceptance threshold may be a minimum confidence score that is required to be met in order to identify/authenticate the user for the particular task. The acceptance threshold for each task may be predetermined by the entity requesting the authentication (e.g. by a bank requesting authentication of a user attempting to access a bank account).

At step 202, an initial authentication process is determined. The initial authentication process for a particular task may be predetermined or may be selectable from a number of different authentication processes. In a first example, an initial authentication process for accessing a smartphone may be selected or predetermined to be a behavioural biometric associated with a user's activity with the smartphone, such as the user's location. In a second example, an initial authentication method for accessing a bank account may be selected or predetermined to be inputting a bank account number by a user.

At step 203, the initial authentication process is performed. For a passive authentication process (as described above) the process is performed automatically without requesting or requiring an input from the user. E.g., in the first example above, to perform the behavioural biometric authentication process, a processor at the smartphone may access a GPS sensor to determine the user's location. The initial authentication process may require a user to perform an action for the process. E.g., in the second example above, a user may be prompted to enter their bank account number.

At step 204, an initial confidence score is determined based on the performance of the initial authentication process. The confidence score determined may indicate the likelihood of the user being an authorised user based on the performance of the authentication process. Data generated about the performance of the authentication process may be compared to known data/attributes about an authorised user and the confidence score may be determined based on how closely the generated data correlates with the known data/attributes. The comparison may be performed by the user device 10 or at a remote computing device. E.g., in the first example above, the GPS data may indicate that the user of the smartphone is at the home address of the authorised user and so it is likely that the smartphone user is an authorised user. Whereas, if the GPS data indicated that the smartphone user was at a location that an authorised user had never visited before, then it is less likely that the smartphone user is an authorised user. The likelihood (which may be a probability value) of the user being an authorised user may be used to determine the confidence score. In the second example, a user may enter a correct or an incorrect bank account number and a confidence score is determined based on the entry. If incorrect numbers are entered, a confidence score may be determined based on how closely the inputted numbers match the correct bank account number. For example, if only a single digit was incorrect, a higher confidence score may be determined than if multiple numbers were incorrect.

Each authentication process may be weighted according to how secure or risky it is, or the level of confidence that it can provide in the identity of a user. For example, fingerprint scanning may be considered to be more secure (and less risky) at identifying a user than entering a pin number and so the result (whether positive or negative) of the fingerprint scanning process may be provided with a greater weighting than the result of the pin number process. The confidence score may be determined in dependence on the weighting attributed to each authentication process.

At step 205, it is determined if the confidence score is greater than or equal to the acceptance threshold. If so, then the process moves on to step 206, where the user is authorised and accepted for the task. If not, then the process moves on to step 207.

A lower rejection threshold may be provided. A user may be rejected from being identified/authorised for a task if the confidence score is below the rejection threshold. The rejection threshold may be adjustable and dependent on which authentication process is used. For example, a negative result from a facial recognition process is more reliable than a negative result from a behavioural biometric associated with the way a device is held (e.g. because an injured arm may cause a false-negative result). Thus, the rejection threshold for the facial recognition authentication process may be higher than the rejection threshold for the behavioural biometric associated with the way a device is held. The rejection threshold may be based on a measure of the cumulative reliability of multiple authentication processes. Alternatively, the rejection threshold may be a fixed, predetermined threshold.

At step 207, it is determined if the confidence score is less than the rejection threshold. If the confidence score is less than the rejection threshold, then the process moves on to step 208 where the user is not authorised and rejected (and the process ends for the task). If the confidence score is greater than the rejection threshold, then the process moves on to step 209. As mentioned above, the confidence score and rejection threshold used at this step may a confidence score and rejection threshold determined from a single authentication process. Alternatively, the confidence score may be a cumulative confidence score determined from the performance of multiple authentication processes and compared with a predetermined rejection threshold or a threshold based on the multiple authentication processes used.

At step 209, the confidence score has not yet met the acceptance threshold and so another authentication process is selected. The next authentication process may be selected from a set of authentication process available to the device performing the identification/authentication. The set of authentication processes may depend on the type of device and it capabilities. For example, a smartphone may have a camera, microphone, motion sensors and so numerous types of authentication process can be carried out at the smartphone. An ATM machine, however, may only be equipped with a keypad and touchscreen and so only a limited number of authentication process are available to the ATM machine.

If a cumulative confidence score is being used, the next authentication process may be selected based on a difference between the confidence score and the acceptance threshold. For example, if there is a large difference between the confidence score and the acceptance threshold, a more secure and reliable authentication process may be selected. If there is a small difference between the confidence score and the acceptance threshold, then a less secure and less reliable authentication process may be selected but may provide a confidence score sufficient to meet the threshold. E.g., in the first example above, there may be a large difference in the confidence score and the acceptance threshold (e.g. because the smartphone was in an unfamiliar location for the location test) and so a secure and reliable authentication process may be selected such as a fingerprint scan. Alternatively, if in the first example, there was a small difference in the confidence score, then an authentication process that may be considered to be less secure and reliable may be selected, such as a behavioural biometric associated with the way the user is holding the smartphone (e.g. in a portrait or landscape orientation). This authentication process is convenient for the user as it does not require any additional action from the user and can be determined automatically from accelerometer information indicating the smartphone's orientation.

At step 210, the selected authentication process is performed. Depending on the authentication process selected, performance of the process may require a user input or the authentication process may be performed by a processor and without user input, as described above.

At step 211, a confidence score is determined based on the performance of the selected authentication process. The confidence score for the selected authentication process may be determined as described above.

The process then returns to step 205, where the new confidence score is tested against the threshold. The new confidence score tested at step 205 may be the last determined confidence score based on a single authentication process being performed or a combined score of some or all of the confidence scores that that been determined (e.g. from step 204 and from the loops around steps 205-211). If the confidence score is now above the acceptance threshold, the process moves on to step 206. If the confidence score remains below the acceptance threshold, then the process continues again from step 207.

If a combined confidence score is accumulated from the performance of some of all of the authentication processes, then a confidence score may be maintained in memory and updated each time the process loops from step 211 to step 205. Each update may increase or decrease the maintained confidence score depending on the result of the authentication process. For example, a positive result may increase the confidence score and a negative result may decrease the score. The amount of increase or decrease may be dependent on the likelihood that the user is an authorised user from each authentication process performed.

The process can loop between steps 205 and 211 until all of the available authentication process have been exhausted. If, after all of the available authentication process have been used and the confidence score is still below the acceptance threshold (and above the rejection threshold) then the user may be rejected. This is indicated in FIG. 2 by the dashed arrow from step 209 to step 208.

The confidence score determined by the end of the process of FIG. 2 for a particular task may be maintained and used for the identification or authentication of the user for a subsequent task. For example, if a user was accepted for a first task (at step 206), the confidence score used to accept the user for that first task may be stored so that it can be used for a subsequent second task. For the subsequent second task, an acceptance threshold for that task is determined, similarly to step 201. Subsequently, steps 202 and 203 may be skipped as a confidence score has already been determined from authenticating the user for the first task. At step 204, the initial confidence score for the second task is determined to be the confidence score from the first task. This confidence score is then compared with the threshold for the second task at step 205. The process for the second task then continues from step 205 until the user is either accepted or rejected for that task. In the time between the first and second tasks, the maintained confidence score may be updated in dependence on behavioural biometrics sensed about the user. For example, after the user is authenticated for the first task on a smartphone, the user's activity with the smartphone may be monitored and compared with previous known activity of an authorised user to update the confidence score. The updated confidence score may then be compared against the thresholds determined for the second task.

As mentioned above, the acceptance threshold may vary depending on the task for which the user is being identified/authenticated for. Providing a variable threshold in this way allows a device to select an appropriate authentication process for each task. For example, an appropriate high-security or low-security authentication process can be selected depending on the confidence score required to meet the acceptance threshold. E.g., as mentioned above, if the difference between the confidence score and the acceptance threshold is low, a low-security authentication process may be selected instead of a high-security process, which may be more onerous than a low-security process. In some cases, the low-security authentication process selected may not require any effort by the user and the device can automatically perform the low-security process without involving the user. This can lead to an overall reduction in the amount of actions required to be performed by the user without compromising on the increased security afforded by the use of multiple authentication processes.

If a user has been identified and/or authenticated to a first level of confidence by a first process and it is desired to select a second process for identify and/or authenticate the user to an increased level of confidence, the method for selecting the second process may take account of the degree of independence between the two processes. The second process may be selected as being one with a relatively high independence of the first process. For example, if in a first process the user has been identified based on their location, a second process that is dependent on the wireless networks currently available to the device might be considered to have a low level of independence. This allows the second process to provide a greater degree of additional confidence than would otherwise be the case.

The device of FIG. 1 is shown as comprising a number of functional blocks. This is schematic only and is not intended to define a strict division between different logic elements of such entities. Each functional block may be provided in any suitable manner.

Generally, any of the functions, methods, techniques or components described above can be implemented in software, firmware, hardware (e.g., fixed logic circuitry), or any combination thereof. The terms “module,” “functionality,” “component”, “element”, “unit”, “block” and “logic” may be used herein to generally represent software, firmware, hardware, or any combination thereof. In the case of a software implementation, the module, functionality, component, element, unit, block or logic represents program code that performs the specified tasks when executed on a processor. The algorithms and methods described herein could be performed by one or more processors executing code that causes the processor(s) to perform the algorithms/methods. Examples of a computer-readable storage medium include a random-access memory (RAM), read-only memory (ROM), an optical disc, flash memory, hard disk memory, and other memory devices that may use magnetic, optical, and other techniques to store instructions or other data and that can be accessed by a machine.

A processor, computer, or computer system may be any kind of device, machine or dedicated circuit, or collection or portion thereof, with processing capability such that it can execute instructions. A processor may be any kind of general purpose or dedicated processor, such as a CPU, GPU, System-on-chip, state machine, media processor, an application-specific integrated circuit (ASIC), a programmable logic array, a field-programmable gate array (FPGA), or the like. A computer or computer system may comprise one or more processors.

The applicant hereby discloses in isolation each individual feature described herein and any combination of two or more such features, to the extent that such features or combinations are capable of being carried out based on the present specification as a whole in the light of the common general knowledge of a person skilled in the art, irrespective of whether such features or combinations of features solve any problems disclosed herein. In view of the foregoing description it will be evident to a person skilled in the art that various modifications may be made within the scope of the invention.

Claims

1. A method for identifying and/or authenticating a user on a device capable of performing a plurality of tasks, the method comprising:

2. The method as claimed in claim 1, wherein the first and/or second authentication process is performed automatically by the device and/or a remote computing device.

3. The method as claimed in claim 1, wherein the ATV is determined in dependence on the significance of the first task.

4. The method as claimed in claim 1, wherein the plurality of authentication processes comprises one or more biometric identification or authentication processes.

5. A non-transitory storage medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform a method, wherein the method is a method for identifying and/or authenticating a user on a device capable of performing a plurality of tasks, the method comprising:

6. A system comprising: one or more processors, operably associated with one or more memory units;wherein the one or more processors are configured to identify and/or authenticate a user on a device capable of performing a plurality of tasks,wherein the one or more processors are configured: