WO2019132642A1

WO2019132642A1 - Method and system for automated selection of login in a multi-modal authentication system

Info

Publication number: WO2019132642A1
Application number: PCT/MY2018/050075
Authority: WO
Inventors: Pei Shian CHANG; Hoon Sin Cheong; Chong Seak Sea; Dharmadharshni A/P MANIAM; Hon Loon WONG
Original assignee: Mimos Bhd
Current assignee: Mimos Bhd
Priority date: 2017-12-28
Filing date: 2018-11-09
Publication date: 2019-07-04
Anticipated expiration: 2020-06-28
Also published as: MY197625A

Abstract

The present invention discloses a computer-implemented method for automatic selection of authentication method in a multi-modal authentication system characterized by the steps of: determining a user (100) at a log-in interface and retrieves the user's behavioural data (104) by a user terminal (101); wherein the behavioural data (104) includes the user's login sessions, geolocation, and type of operating systems used; processing the behavioural data (104) to generate a user profile by a profiling module (103); evaluating the user's profile by factoring in environmental parameters of the user terminal to select an authentication method by an evaluation module (102); notifying the user (100) with the selected authentication method (105) for the user (100) to complete a authentication process by an authentication server (202); and updating, the user profile with data relating to a new successful login session for future evaluation by profiling module (103) upon successfully logged-in.

Description

METHOD AND SYSTEM FOR AUTOMATED SELECTION OF LOGIN IN A MULTI-MODAL AUTHENTICATION SYSTEM

FIELD OF INVENTION

The invention relates to an authentication method. More particularly, the invention relates to a method and system for facilitating frictionless user experience in a multi modal authentication system.

BACKGROUND OF THE INVENTION

The requirement for reliable techniques for user authentication has enhanced within the wake of heightened considerations regarding security and fast advancements in communication, quality and networking. A large kind of applications need reliable verification schemes to verify the identity of a person requesting their service. While providing flexibility to the users, multi-modal authentication can lead to some adverse effects. For instance, confusion and annoyance may occurred as unregistered authentication methods are shown. Furthermore, multi-modal authentication can also lead to undesirable friction in user experience where the users need to perform an additional step to choose the authentication method.

In one example as shown in US20070236330A1 discloses a system and method for performing user authentication based on behaviours patterns of a mobile terminal user. The system includes a mobile terminal having an input unit configured to receive authentication information from a user, an authentication unit configured to extract behaviour patterns of the user based on the authentication information, and a data communication unit configured to transmit the authentication information and the behaviour patterns to an authentication server. The behaviour patterns extracted based on the authentication information includes the user’s characteristic behaviour patterns such as typing patterns, motion patterns, voice patterns and writing patterns. However, the disclosed system has a limitation where the system could not predict the preferred authentication method of the user based on user’s preference.

In a second example as shown in patent document US 9185095B1 discloses a method and system for behavioural profiling. The methods includes observing behavioural characteristics of user interactions during a current session with the user through one of a plurality of channels. Variations between the behavioural characteristics of the user interactions observed during the current session and a behavioural profile previously developed based on prior usage pattern of the user through the plurality of channels are identified, in real-time or near real-time. However, the drawbacks of the system does not allow the user to reject the presented authentication and reduce the list of available authentication methods.

Accordingly, it would be desirable to provide a system that can automatically select a login method for a user based on the behaviour characteristics of a current session when compared to the user’s historical profile.

SUMMARY OF INVENTION

The main objective of the invention is to provide a computer-implemented method to automatically select an authentication method for a user based on a plurality of historical profiles corresponding to the user identifier to a multi-modal authentication system. The computer-implemented method for automatic selection of authentication method in a multi-modal authentication system comprising the steps of determining, by a user terminal, a user at a log-in interface and retrieves the user’s behavioural data; wherein the behavioural data includes the user’s login sessions, geolocation, and type of operating systems used; processing, by a profiling module, the behavioural data to generate a user profile; evaluating, by an evaluation module, the user’s profile by factoring in environmental parameters of the user terminal to select an authentication method; notifying, by an authentication server, the user with the selected authentication method for the user to complete the authentication process; and upon successfully logged-in, updating, by profiling module, the user’s profile with data relating to the new successful login session for future evaluation.

Preferably, the method further comprising the steps of providing, by the user terminal, the user with options to reject the selected authentication method; and upon the user rejects the selected authentication method, repeating, by evaluation module, the abovementioned steps with the current selected authentication method being excluded to select a new authentication method.

Preferably, the steps for evaluating the authentication method further comprising the steps of retrieving, by the evaluation module, a list of available authentication methods for the user; and calculating, by a computing means, a historical distribution of individual methods in previous successful login sessions which have the user’s profile identical to those in the current login session.

Preferably, the steps for evaluating the authentication method further comprising the steps of selecting, by the evaluation module, the authentication method with a highest distribution for the user in the current login session.

Preferably, the steps for evaluating the authentication method further comprising the steps of selecting, by the evaluation module, the authentication method with the most recent login timestamp for the user in the current login session, if no single authentication method can be determined by the calculation of historical distribution.

Preferably, the user terminal is a web browser or a native application running on a computing device. The second objective of this invention is to provide a computer-implemented system for allowing automated method selection in a multi-modal authentication system comprises a user terminal for determining a user at a log-in interface and retrieving the user’s behavioural data; wherein the behavioural data includes the user’s login sessions, geolocation, and type of operating systems used; a profiling module for processing the behavioural data to generate a user profile and updating the user profile with data relating to the new successful login session for future evaluation upon successfully logged-in; an evaluation module for evaluating the user profile by factoring in environmental parameters of the user terminal to select an authentication method; and an authentication server for notifying the user with the selected authentication method for the user to complete the authentication process.

One skilled in the art will readily appreciate that the invention is well adapted to carry out the objects and obtain the ends and advantages mentioned, as well as those inherent therein. The embodiments described herein are not intended as limitations on the scope of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

For the purpose of facilitating an understanding of the invention, there is illustrated in the accompanying drawing the preferred embodiments from an inspection of which when considered in connection with the following description, the invention, its construction and operation and many of its advantages would be readily understood and appreciated.

Figure 1 is a diagram illustrating a representative environment for implementing an automated method selection in a multi-modal authentication system, in accordance to an embodiment of the present invention. Figure 2 is a flow chart illustrating the process flow of the automated selection of authentication method in accordance to an embodiment of the present invention.

Figure 3 is a flow chart illustrating the overall process flow of the automated selection of authentication method in accordance to an embodiment of the present invention.

Figure 4 is a flow chart illustrating the detailed process flow of evaluation module in accordance to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

The invention will now be described in greater detail, by way of example, with reference to the drawings.

Fig. 1 shows the automated authentication system based on user behaviour profile. The system comprises a user terminal 101 for determining a user at a log-in interface and retrieving the user’s behavioural data, a profiling module 103 for processing the behavioural data to generate a user profile and updating the user profile with data relating to the new successful login session for future evaluation upon successful logged-in, an authentication module 102 for evaluating the user profile by factoring in environmental parameters of the user terminal to select an authentication method and an authentication server 202 for notifying the user with the selected authentication method 105 for the user 100 to complete the authentication process. Preferably, the behavioural data 104 includes the user’s login sessions, geolocation, and type of operating system used. Preferably, the computing device may be a personal computer, smartphones, tablets, personal digital assistants (PDA), netbooks, phablets, phoblets, or any suitable means which capable of receiving inputs from the user, processing the data and performing data transmission.

Fig. 2 illustrates the process flow of the current invention in detail description. During the authentication, the user 100 will first trigger a login session by launching a login page 201 via the user terminal 101. The authentication system will prompt the user 100 to enter his/her username on the login page 201 first instead of showing a list of login method for the user 100 to select. Preferably, the authentication server 202 which includes an evaluation module 102 to select a login method 105 for user 100 to login upon the verification of user's identity. The selected login method 105 is then send to the login page 201 on the user terminal 101 for allowing the user 100 to key in login credentials for the authentication. Preferably, the login credentials may be a One-Time Password (OTP), pin numbers, biometric information, barcodes or any combination thereof. The login credentials are then sent to the authentication server 202 for second verification of user's identity. Upon the successful of user verification, the login attempt will be added to the historical profiles for future evaluations.

In another embodiment as shown in Fig. 3, where in step 300 the authentication system automatically selects a login method 105 for the user 100 based on a plurality of historical profiles related to his/her username inside the database 106. However, in step 301 and 302, the user 100 can skipped to continue to login with the selected method 105. If the user 100 skipped the selected method 105, the authentication system will select another method for the user with exclude the skipped method. Next in step 303, where the user 100 continues and completed login with the selected method 105, the successful login attempt is added to the historical profiles as in step 304.

Fig. 4 shows the detailed process flow of evaluation module 102. The process starts with step 400 where after the username is verified, normalized distribution of the methods used is retrieved based on each of the extracted environment parameters. In steps 401, if more than one method having highest normalized distribution (HND), the automated authentication system will select the most recent last use login method from the timestamp table in profiling module. Meanwhile, the system will directly show the login method if only one method having the HND 402. However, user 100 is allowed to skip the selected method in step 403. In step 404, if the user 100 skips the selected method while the user 100 having one login method inside his/her profile, the system will show related error to the user 407. On the other hand, if the user 100 has more than one login method inside his/her profile, the system will exclude the skipped method and do evaluation again to select another login method for user 100 as described in steps 405 and 408. Lastly in step 406, if the user 100 does not skip the selected method and continue to login, the related behavioural data 104 will be stored by the authentication server 202 to keep as profiling module 103.

Table 1: Example of a profile based on Operating System The above table 1 shows an example of a profile based on Operating System. During the updating process, the profiling module 103 extracts the behavioural data 104 that is received, stored and transmitted by the authentication server 202 after the user 100 is verified. Successful login data are profiled based on the user behavioural data 104 such as operating system (OS), browser and geolocation. Preferably, the profile also includes the last successful login timestamp of each method for every successful login attempt as illustrated in the table 2 below.

Table 2: Example of profile including last successful login timestamp of each method

For the evaluation module 102, environmental parameters such as previously used authentication method and login timestamps of the login session are extracted after a username is verified. Hence, the normalized distribution of the methods used is retrieved with each of the extracted environment parameters as shown in the example in Table 3 and Table 4.

Overall distribution of each method, is calculated and tabulated in table 3.

Method 1 = 0.2 X 0.5 X 0.3 = 0.03

Table 3: Overall distribution of each method

Based on table 3, method 3 is selected for user to login as it has the highest normalized distribution (HND).

In another example as shown in table 4 below, two or more methods may have the same highest normalized distribution for a current login user. The evaluation module 102 will select the method with the most recent last use method based on the timestamp table which stored during every successful login attempt of the user.

Table 4: Timestamp table for every successful login attempt of the user

Based on table 4, method 1 which has the most recent last use record is selected for user to login.

The present disclosure includes as contained in the appended claims, as well as that of the foregoing description. Although this invention has been described in its preferred form with a degree of particularity, it is understood that the present disclosure of the preferred form has been made only by way of example and that numerous changes in the details of construction and the combination and arrangements of parts may be resorted to without departing from the scope of the invention.

Claims

1. A computer-implemented method for automatic selection of authentication method in a multi-modal authentication system characterized by the steps of:

determining a user (100) at a log-in interface and retrieves the user’s behavioural data (104) by a user terminal (101); wherein the behavioural data

(104) includes the user’s login sessions, geolocation, and type of operating systems used;

processing the behavioural data (104) to generate a user profile by a profiling module (103);

evaluating the user’s profile by factoring in environmental parameters of the user terminal (101) to select an authentication method by an evaluation module (102);

notifying the user (100) with the selected authentication method (105) for the user (100) to complete an authentication process by an authentication server (202); and

updating, the user profile with data relating to a new successful login session for future evaluation by profiling module (103) upon successfully logged-in.

2. The method as claimed in claim 1, further comprising the steps of:

providing the user (100) with options to reject the selected authentication method

(105) by the user terminal (101); and

upon the user (100) rejects the selected authentication method (105),

repeating the steps of claim 1 with current selected authentication method being excluded to select a new authentication method by the evaluation module (102).

3. The method as claimed in claim 1, wherein the steps for evaluating the user’s profile by factoring in environmental parameters of the user terminal (101) to select an authentication method further comprising the steps of: retrieving a list of available authentication methods for the user (100) by the evaluation module (102); and

calculating, by a computing device, a historical distribution of individual methods in previous successful login sessions which have the user’s profile identical to those in the current login session.

4. The method as claimed in claim 3, further comprising the steps of selecting the authentication method (105) with a highest distribution for the user (100) in the current login session by the evaluation module (102).

5. The method as claimed in claim 3, further comprising the steps of selecting, by the evaluation module (102), the authentication method (105) with the most recent login timestamp for the user (100) in the current login session, if no single authentication method can be determined by the calculation of historical distribution.

6. The method as claimed in claim 1, wherein the user terminal (101) is a web browser or a native application running on a computing device.

7. The method as claimed in claim 1, wherein the environmental parameters includes previously used authentication method and login timestamps.

8. A computer- implemented system for automatic selection of authentication method in a multi-modal authentication system comprises:

a user terminal (101) linked to an authentication server (202) via a communication network;

wherein the authentication server (202) comprising a profiling module (103) and evaluation module (102);

characterized in that the user terminal (101) determines a user (100) at a log-in interface and retrieves a user’s behavioural data (104), the profiling module (103) processes the behavioural data (104) to generate a user profile and update the user profile with data relating to a new successful login session for future evaluation upon successfully logged-in, the user profile is further evaluated by the evaluation module (102) by factoring in environmental parameters of the user terminal (101) to select an authentication method and the user is notified by the authentication server (202) to complete the authentication process with the selected authentication method (105).

9. The system as claimed in claim 8, wherein the user terminal (101) is a web browser or a native application running on a computing device.

10. The system as claimed in claim 8, wherein the behavioural data (104) includes the user’s login sessions, geolocation, and type of operating systems used.