Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
  • G06F21/31—User authentication
  • G06F21/316—User authentication by observing the pattern of computer usage, e.g. typical user behaviour
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
  • G06F21/31—User authentication
  • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
  • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/08—Access security
  • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
  • H04L2463/121—Timestamp
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
  • H04L63/104—Grouping of entities
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
  • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/60—Context-dependent security
  • H04W12/61—Time-dependent
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
  • H04W88/02—Terminal devices

Definitions

• the present invention is directed to an authentication system that dynamically optimizes system authentication processing based on biometric information in an IT system through drawing upon distribution of user usage of terminals, thereby achieving a performance improvement of the authentication processing.
• Prior art authentication in IT systems based on biometric information typically involves replacing password- based authentication of the identity of a user such as a user ID with authentication based on some characteristic inherent to the user, such as fingerprints or retina patterns or other characteristics as is known to the art. These inherent characteristics are commonly called “biometrics”.
• biometrics the authentication processing takes the form of so-called “1 :1 authentication”, in which biometric data of the user is compared at the time of an authentication process with registered data of the same, single user.
• biometric authentication require also system CPU power cost for operation and sometimes results in long authentication time. Because the biometric authentication requires comparison of input and the data between difference data, so the calculation load for such process is high and the authentication time is long.
• a single terminal might be used by many users in a shared manner.
• cash registers at a supermarket or check-in terminals at an airport might be used by more than one cashier or airline clerk.
• the identification of users in such a shared environment could be done by having each user sign out when they leave the terminal, and requiring each new user to sign in before they can use the terminal. If each user has to input their ID prior to the biometric authentication, this type of authentication is termed“1 :1 type authentication”. In this case, authentication would be done by matching between data specified, and result in a constant load transaction.
• Acceleration based on authentication logic Acceleration by parallel authentication processing to carry out multiple authentication processes, multi-stage authentication by creation of representative data, etc.
• the authentication acceleration in parallel processing is not intended for reducing the entire system load associated with authentication. Acceleration through representative data does not consider the uneven distribution of the user authentication processes and tasks. Whether or not the representative data can be created depends on variations found in the user biometric authentication.
• Techniques related to biometric authentication data Features associated with increasing accuracy of biometric authentication data and providing additional information for the primary purpose of improvement in the biometric authentication accuracy among multiple entities.
• the primary purpose is to improve the authentication accuracy at the time of performing 1 :N authentication rather than authentication acceleration as such.
• Scores are calculated on the basis of the similarity in the obtained biometric information to achieve discontinuation and acceleration of authentication.
• Use of the similarity is a scheme of acceleration that depends on the biometric information held by the users, which is versatile but does not involve any effects significant in the context of this case.
• This method is directed to a scheme of acceleration by discrimination and switching between processes of 1 : 1 authentication and 1 :N authentication.
• the existing acceleration scheme through switching between 1 :1 and 1 :N authentications is implemented under the determination condition to determine presence or absence of any input of an ID to be subjected to the authentication which is input by the user as the condition for using 1 :1 authentication.
• Acceleration through grouping is a scheme that realizes acceleration by performing grouping for numerous pieces of data subjected to the authentication and manages the priority in the order of authentication and the like. This approach can be characterized as follows:
• the target environment is an environment where further acceleration is required between or among grouped users.
• acceleration by sorting at the time of authentication registration is not satisfactory as acceleration in the target environment.
• the present invention provides a computer implemented method for authentication of users at multiple terminals, the method comprising the steps of: a) a computer receiving user input to starting authentication on a target terminal comprising biometric input from the user; b) the computer determining whether the biometric input received from the user indicates a same user is starting authentication on the target terminal as last authenticated by the computer for the target terminal; c) if the user is the same user that was last authenticated by the computer for the target terminal, the computer executing 1 :1 type authentication of the user; d) if the user is not the same user that was last authenticated by the computer for the target terminal, the computer: i) retrieving entries from an authentication priority table for the target terminal at a current time slot; ii) reading an authentication status on terminals other than the target terminal based on an authentication results table; iii) creating a temporal authentication priority table comprising: priority information for users for each terminal, time, terminal information, and masking of users at terminals
• the present invention provides a computer system for authentication of users at multiple terminals comprising a computer comprising at least one processor, one or more memories, one or more computer readable storage media having program instructions executable by the computer to a) receiving, by the computer, user input to starting authentication on a target terminal comprising biometric input from the user; b) determining, by the computer, whether the biometric input received from the user indicates a same user is starting authentication on the target terminal as last authenticated by the computer for the target terminal; c) if the user is the same user that was last authenticated by the computer for the target terminal, executing, by the computer, 1 :1 type authentication of the user; d) if the user is not the same user that was last authenticated by the computer for the target terminal, the computer: i) retrieving entries from an authentication priority table for the target terminal at a current time slot; ii) reading an authentication status on terminals other than the target terminal based on an authentication results table; iii) creating
• the present invention provides a computer program product for authentication of users at multiple terminals, the computer program product comprising a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method for performing the steps of the invention.
• the present invention provides a computer program stored on a computer readable medium and loadable into the internal memory of a digital computer, comprising software code portions, when said program is run on a computer, for performing the steps of the invention.
• a method of authentication of users at multiple terminals comprising the steps of: a) a computer receiving user input to starting authentication on a target terminal comprising biometric input from the user; b) the computer determining whether the biometric input received from the user indicates a same user is starting authentication on the target terminal as last authenticated by the computer for the target terminal; c) if the user is the same user that was last authenticated by the computer for the target terminal, the computer executing 1 :1 type authentication of the user; and d) if the user is not the same user that was last authenticated by the computer for the target terminal.
• the computer i) retrieving entries from an authentication priority table for the target terminal at a current time slot; ii) reading an authentication status on terminals other than the target terminal based on an authentication results table; iii) creating a temporal authentication priority table comprising: priority information for users for each terminal, time, terminal information, and masking of users at terminals based on the authentication results table, wherein the masking is of each user who is already logged in at terminals and is not the user currently the user starting the authentication at the target terminal; iv) executing 1 :N type authentication of the user using the temporal authentication table; v) determining whether the 1 :N type authentication is accepted; and vi) if the 1 :N type authentication is accepted, the computer granting the user access to the target terminal and storing the authentication result in the authentication results table.
• a computer program product for authentication of users at multiple terminals is disclosed.
• the computer program product using a computer comprising at least one processor, one or more memories, one or more computer readable storage media.
• the computer program product comprising a computer readable storage medium having program instructions embodied therewith.
• the program instructions executable by the computer to perform a method comprising: a) receiving, by the computer, user input to starting authentication on a target terminal comprising biometric input from the user; b) determining, by the computer, whether the biometric input received from the user indicates a same user is starting authentication on the target terminal as last authenticated by the computer for the target terminal; c) if the user is the same user that was last authenticated by the computer for the target terminal, executing, by the computer, 1 :1 type authentication of the user; d) if the user is not the same user that was last authenticated by the computer for the target terminal.
• the computer i) retrieving entries from an authentication priority table for the target terminal at a current time slot; ii) reading an authentication status on terminals other than the target terminal based on an authentication results table; iii) creating a temporal authentication priority table comprising: priority information for users for each terminal, time, terminal information, and masking of users at terminals based on the authentication results table, wherein the masking is of each user who is already logged in at terminals and is not the user currently the user starting the authentication at the target terminal; iv) executing 1 :N type authentication of the user using the temporal authentication table; v) determining whether the 1 :N type authentication is accepted; and vi) if the 1 :N type authentication is accepted, the computer granting the user access to the target terminal and storing the authentication result in the authentication results table.
• a computer system for authentication of users at multiple terminals comprising a computer comprising at least one processor, one or more memories, one or more computer readable storage media having program instructions executable by the computer to perform the program instructions.
• the program instructions comprising: a) receiving, by the computer, user input to starting authentication on a target terminal comprising biometric input from the user; b) determining, by the computer, whether the biometric input received from the user indicates a same user is starting authentication on the target terminal as last authenticated by the computer for the target terminal; c) if the user is the same user that was last authenticated by the computer for the target terminal, executing, by the computer, 1 : 1 type authentication of the user; d) if the user is not the same user that was last authenticated by the computer for the target terminal.
• the computer i) retrieving entries from an authentication priority table for the target terminal at a current time slot; ii) reading an authentication status on terminals other than the target terminal based on an authentication results table; iii) creating a temporal authentication priority table comprising: priority information for users for each terminal, time, terminal information, and masking of users at terminals based on the authentication results table, wherein the masking is of each user who is already logged in at terminals and is not the user currently the user starting the authentication at the target terminal; iv) executing 1 :N type authentication of the user using the temporal authentication table; v) determining whether the 1 :N type authentication is accepted; and vi) if the 1 :N type authentication is accepted, the computer granting the user access to the target terminal and storing the authentication result in the authentication results table.
• Fig. 1 depicts an exemplary diagram of a possible system configuration of a data processing environment, in which preferred embodiments of the present invention may be implemented.
• Fig. 2 shows a flowchart of authentication execution, according to a preferred embodiment of the present invention
• Fig. 3 shows a flowchart of analysis of authentication results, according to a preferred embodiment of the present invention
• Figs. 4A and 4B show an example of relevance between terminals, according to a preferred embodiment of the present invention
• Fig. 5 shows a flowchart of maintenance of authentication results, according to a preferred embodiment of the present invention
• Fig. 6 shows a flowchart of execution of 1 :N type authentication, according to a preferred embodiment of the present invention
• Fig. 7 illustrates internal and external components of a client computer and a server computer in which illustrative embodiments may be implemented.
• the present system proposes new means to improve authentication performance of an authentication system which needs to perform a large quantity of authentications such as biometric authentications using a common account to login to the terminal.
• This system relates to an improvement in 1 : N authentication where one piece of source data that has been input to be subjected to the authentication has to be compared with multiple or numerous pieces of registered authentication data.
• the system achieves performance improvement of authentication by selecting appropriate types of authentication, and also by optimizing authentication sequence.
• the system selects authentication type and authentication order based on distribution data of users and terminals. [0037] Furthermore, this system improves the accuracy to obtain the authentication data using "mutual use correlation between terminals" dynamically, as to make dynamic groupings, not from just single terminal data.
• this system proposes modification scheme by focusing on the authentication situation in which operators use multiple terminal simultaneously, while switching sequentially.
• These features include, authentication priority list based on dynamic and virtual grouping of terminals used for authentication, resulting in an efficiency improvement of authentication priority sequence in 1 :N type authentication, hybrid authentication by switching authentication logic between 1:1 and 1 :N authentication, which improves selectivity of authentication logic and masking of pre-logged-in user for authentication priority list in 1 :N authentication for efficiency improvement of authentication priority sequence in 1 :N type authentication.
• Features also include obtaining authentication data, in which at the execution of authentication of the user, the authentication data of the user's biometric information is stored, as well as storage of authentication data (for example, biometric data), authentication list, user information, terminal information, terminal grouping data etc.
• this system uses this maldistribution to improve the authentication performance.
• the authentication result on actual environment is recorded, and then the data is analyzed to determine an authentication priority per terminal and usage period, and lastly, store such priority table.
• the system reads out the priority table according to the terminal and usage period. Authentication is preferred with minimum number of authentications using the priority table based on uneven distribution.
• the present system achieves an optimization of authentication sequence which considers not only usage data from a 6single terminal but also that of terminals that have dependency relationship with each other by calculating a dynamic relation between terminals and virtual grouping of the terminals.
• this system proposes using the movement of users between the terminals to calculate a dependency relationship between the terminals.
• this system proposes using the movement of users between the terminals to calculate a dependency relationship between the terminals.
• this system uses usage data from all terminals with dynamic dependency and calculates the result with correlation factor as weight factors to obtain a proper authentication sequence.
• Figure 1 depicts an exemplary diagram of a possible system configuration of a data processing environment in which illustrative embodiments may be implemented.
• Figure 1 is an exemplary diagram of a possible data processing environment provided in which illustrative embodiments may be implemented. It should be appreciated that Figure 1 is only exemplary and is not intended to assert or imply any limitation with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environments may be made.
• network data processing system 100 is a network of computers in which illustrative embodiments may be implemented.
• Network data processing system 100 contains network 101, which is the medium used to provide communication links between various devices and computers connected together within network data processing system 100.
• Network 101 may include connections, such as wire, wireless communication links, or fiber optic cables.
• a terminal device computer 102 In the depicted example, a terminal device computer 102, an authentication server computer 105, a business system 120 including a business server 121 connected through a network 124 to a database server 125 and a repository 127.
• network data processing system 51 may include additional client or device computers, storage devices or repositories, server computers, and other devices not shown.
• the terminal device computer 102 may contain a web browser 103 which may include an interface, which may accept commands and data entry from a user.
• the terminal device computer 102 may also include a processor and associated sensors 104 to read and receive authentication data from a user. The commands may be regarding log in information.
• the interface can be, for example, a command line interface, a graphical user interface (GUI), a natural user interface (NUI) or a touch user interface (TUI).
• GUI graphical user interface
• NUI natural user interface
• TTI touch user interface
• the terminal device computer 102 includes a set of internal components 800a and a set of external components 900a, further illustrated in Figure 7.
• Authentication server computer 105 includes a set of internal components 800b and a set of external components 900b illustrated in Figure 7.
• server computer 105 provides information, such as boot files, operating system images, and applications to the terminal device computer 102.
• Authentication server computer 105 can compute the information locally or extract the information from other computers on network 101.
• the authentication server computer 105 also preferably contains an authentication program 66.
• the authentication server computer 106 has at least one processor 107 and associated memory 106 connected to a repository 108.
• the processor 107 executes control features 114.
• the repository 108 preferably contains authentication data, for example in a biometric data database 109, an authentication result database 110, a terminal usage database 111 , a terminal relation database 112 and an authentication priority database 113.
• the control features 114 include, but are not limited to features to obtain authentication data 115, features to execute hybrid authentication 116, feature to calculate terminal relation 117, features to create an authentication priority list 118, and biometric authentication data database 119.
• the business system 120 comprises a business server 121 , for example a web server 122 with a web application 123.
• the business server 125 is connected through an internal network 124 to a database server 125 which includes a database system 126 and an associated repository 127.
• the web server 122 and the database server 125 includes a set of internal components 800b, and a second of external components 900b illustrated in Figure 7.
• the web server 122 and the database server 125 can compute the information locally and extract the information from other computers on network 124 and network 101.
• Program code and programs such as authentication program 66 may be stored on at least one of one or more computer-readable tangible storage devices 830 shown in Figure 7, on at least one of one or more portable computer-readable tangible storage devices 936 as shown in Figure 7, or in repository 108, or may be downloaded to a terminal device computer 102, authentication server computer 105, or business server computer 121 , for use.
• program code and programs such as authentication program 66 may be stored on at least one of one or more storage devices 830 on authentication server computer 105 and downloaded to terminal device computer 102 over network 101 for use.
• the authentication server computer 105 can be a web server, and the program code, and programs such as authentication program 66 may be stored on at least one of the one or more storage devices 830 on authentication server computer 105 and accessed by terminal device computer 102.
• the business server is preferably a web server 122.
• the program code, and programs such as authentication program 66 may be stored on at least one of one or more computer-readable storage devices 830 on terminal device computer 102 or distributed between two or more servers.
• network data processing system 100 is the Internet with network 101 representing a worldwide collection of networks and gateways that use the Transmission Control Protocol/Internet Protocol (TCP/IP) suite of protocols to communicate with one another.
• TCP/IP Transmission Control Protocol/Internet Protocol
• At the heart of the Internet is a backbone of high speed data communication lines between major nodes or host computers, consisting of thousands of commercial, governmental, educational and other computer systems that route data and messages.
• network data processing system 100 also may be implemented as a number of different types of networks, such as, for example, an intranet, local area network (LAN), or a wide area network (WAN).
• Figure 1 is intended as an example, and not as an architectural limitation, for the different illustrative embodiments.
• Figure 7 illustrates internal and external components of a terminal device computer 102, authentication server 105, business server computer 121 , and database server computer 125 in which illustrative embodiments may be implemented.
• a terminal device computer 102, authentication server 105, business server computer 121 , and database server computer 125 include respective sets of internal components 800a, 800b and external components 900a, 900b.
• Each of the sets of internal components 800a, 800b includes one or more processors 820, one or more computer-readable RAMs 822 and one or more computer-readable ROMs 824 on one or more buses 826, and one or more operating systems 828 and one or more computer-readable tangible storage devices 830.
• each of the computer-readable tangible storage devices 830 is a magnetic disk storage device of an internal hard drive.
• each of the computer-readable tangible storage devices 830 is a semiconductor storage device such as ROM 824, EPROM, flash memory or any other computer-readable tangible storage device that can store a computer program and digital information.
• Each set of internal components 800a, 800b also includes a R/W drive or interface 832 to read from and write to one or more portable computer-readable tangible storage devices 936 such as a CD-ROM, DVD, memory stick, magnetic tape, magnetic disk, optical disk or semiconductor storage device.
• Authentication program 66 can be stored on one or more of the portable computer-readable tangible storage devices 936, read via R/W drive or interface 832 and loaded into hard drive 830.
• Each set of internal components 800a, 800b also includes a network adapter or interface 836 such as a TCP/IP adapter card.
• Authentication program 66 can be downloaded to the terminal device computer 102 and the authentication server computer 105 from an external computer via a network (for example, the Internet, a local area network or other, wide area network) and network adapter or interface 836. From the network adapter or interface 836, authentication program 66 is loaded into hard drive 830.
• Authentication program 66 can be downloaded to the authentication server computer 105 from an external computer via a network (for example, the Internet, a local area network or other, wide area network) and network adapter or interface 836. From the network adapter or interface 836, authentication program 66 is loaded into hard drive 830.
• the network may comprise copper wires, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers.
• Each of the sets of external components 900a, 900b includes a computer display monitor 920, a keyboard 930, and a computer mouse 934.
• Each of the sets of internal components 800a, 800b also includes device drivers 840 to interface to computer display monitor 920, keyboard 930 and computer mouse 934.
• the device drivers 840, R/W drive or interface 832 and network adapter or interface 836 comprise hardware and software (stored in storage device 830 and/or ROM 824).
• Authentication program 66 can be written in various programming languages including low-level, high-level, object-oriented or non-object-oriented languages. Alternatively, the functions of an authentication program 66 can be implemented in whole or in part by computer circuits and other hardware (not shown).
• the system starts with the common terminal logged in to the common account.
• a user starts an operation which requires authentication - for example, a cashier wishes to scan purchases, or a manager wishes to authorize a price reduction on an item at a register at which a cashier is ringing up a basket of food, etc.
• the new user inputs his or her biometric data, as is known to the prior art, for example by placing their thumb on a fingerprint scanner.
• the terminal device computer 102 receives a user input to start authentication on a terminal (step 202), and the terminal device computer 102 receives biometric input from a user (step 204) and the method ends.
• the system of the present invention increases the authentication performance by focusing maldistribution of authentication as a reproducibility of authentication for the same person on the same terminal.
• a method of determining execution of 1 :1 authentication is to determine the time (timeout value) since the previous authentication by the same user, or by the input of the different identification information to determine a different user is logging on.
• the terminals used for the system are a front-end, customer facing terminal, it is difficult to set simple time out value to determine the terminal usage termination because the counter service cannot be specified simply as a task of using the terminal.
• identification input for discriminating users is also difficult with multiple users using the front-end terminal in the usage environment. Therefore, existing 1 :1 and 1 :N authentication switching methods cannot be applied for this environment.
• the system of the present invention performs preliminary authentication for making an approximate determination as to whether the user logging onto the terminal is the same user which executed the previous authentication on the terminal.
• Authentication speed depends on granularity of authentication implementation. At first, as preliminary authentication, it is determined whether or not it is the same user as which was previously authenticated. After this determination is made, it is determined whether authentication switching should take place. Use of this rough granularity authentication is not a security risk.
• 1 :1 authentication is performed by using the cache of the data to authenticate the previous user.
• a sequence for executing normal 1 :N authentication is performed. By doing this, this system improves the speed of repetitive authentication by the same user, which is the majority of use cases.
• the authentication execution logic itself can utilize the existing authentication logic like biometric authentication method.
• Figure 3 shows a flowchart showing the selection of 1 :1 or 1 :N authentication.
• the authentication program 66 determines whether the biometrics indicate that the same user as last authenticated by the system is the user logging into the system on the terminal (step 220).
• the authentication program 66 executes 1 :N type authentication (step 222) and the method continues to Figure 6 discussed further below.
• the authentication program 66 executes 1 :1 type authentication (step 224).
• step 226 If the authentication information is not accepted for the user (step 226), the method continues to step 222 of executing 1 :N type authentication and the method continues to Figure 6 discussed further below.
• the authentication result is stored in an authentication results table (step 228) and the authentication program 66 grants access to the terminal for the user (step 230) and the method ends.
• B.1.1 1:N authentication execution function with authentication priority list mask function to eliminate authentication for login user at other terminal
• system With receiving an authentication request, system performs preliminary authentication which can be executed at high speed with rough granularity by using the entered of the biometric authentication information and the previous authentication information.
• This authentication is not the final authentication but the determination of possibility of being the same user as in the previous time.
• authentication is sequentially executed based on the entered biometric authentication and the authentication priority list.
• the authentication priority list is a list based on the past authentication status. For this reason, there is a possibility that unnecessary authentication processing may be performed because the user currently logged in at the other terminal is ranked as higher priority in the authentication priority list.
• the read authentication priority list is written out as an authentication priority temporary table.
• the authentication execution is rewritten as to be a meaningful table.
• the system of the present invention improves the authentication performance by excluding the user who is logging in at the other terminal from the authentication priority list based on this premise.
• the system of the present invention copies the authentication priority list as a temporary table to allow temporal change to this table, and then executes authentication using this temporal authentication priority list to make authentication according to the usage condition.
• the functions of this element include, authentication data acquisition function, terminal relation calculation function and terminal relation data storage function.
• terminal relation DB terminal relation table
• the relevance index (%) for the terminal (Y) of the terminal (X) Number of times of logging in to the terminal Y after logging in the terminal X within the targeting period/the number of logins to terminal X within the specific period.
• FIGs 4A and 4B show terminals 1 and 2, in which the circled “A” elements represent authentication of user “A”, and the circled “B” elements represent authentication of user“B”.
• Figure 4A shows a case where the relevance between the terminal 1 and the terminal 2 is zero regardless of the physical location of the terminal.
• Figure 4B shows a case with the relevance between the terminal 1 and the terminal 2 is quite high regardless of the physical location.
• Figure 5 shows a flowchart of a method of relation analysis and priority list creation. The process of Figure 5 can be performed daily or weekly, and does not need to be performed after each authorization, although if processor resources permit, it could be performed after each authorization.
• the authentication program 66 calculates a terminal usage ratio per time slot based on the authentication result table and stores the terminal usage ratio per time slot to the terminal usage ration table (step 280).
• the authentication program 66 calculates a terminal relation and stores the terminal relation to the terminal relation table (step 282). [00123] The authentication program 66 then calculates the authentication priority based on the terminal relation, terminal usage ration table and authentication result and stores the authentication priority to the authentication priority table (step 284) and the method ends.
• An authentication priority list is created for each corresponding terminal.
• the authentication priority list of the time slot X of the terminal (W) is calculated by the following procedure:
• the priority of the corresponding terminal (W) in the time slot (X) is created as priority list by sorting in in descending order toward to the user (Y) assumed authentication use ratio in the time slot (X) of the corresponding terminal (W).
• Table E.1 User Information Database - User Information Table
• Each Common Account ID might be used by a number of different users, therefore, there are multiple users which can be associated with one Common Account ID, each User having his or her own authentication (biometric) data.
• the User Information Table lists the various users associated with each User ID, and the biometric data which is used to identify that User.
• one Common Account ID may only log into a single terminal at a time, while one User can be logged into a number of terminals simultaneously - for example, in the instance where a master cashier might need to move from one register to another during the course of a shift.
• the identification of individual terminals is given by a simple number 1-x, each at an IP address, but it will be understood that the terminal may be alternatively identified by the IP address itself, an alphanumeric identifier ("Shoe Department”) or a host name or ID (“Ithaca Store Register 1”).
• Table E.3 Terminal Usage Status DB: Terminal Usage Ratio Per Time Slot
• This information can be used to set up the Authentication Priority Table - those Users who are most likely to be using a terminal will be allocated a higher priority for the terminal within a given time slot than those who are less likely (or unlikely) to be using that terminal during that time slot. See table E.5, below, for the Authentication Priority Table.
• the Relation Ratio of Terminal 1 to Terminal 2 is 20%. This ratio means 20% of the user logged on to the terminal at Terminal 1 then logged on to Terminal 2 the next time they logged on.
• the terminal relations from this table can be combined with the data from the terminal usage table E.3 to determine the overall priority, which will be stored in table E.5, below.
• This table provides information about those terminals which are used by among some specific groups in which users change terminals frequently during a given time period. Priority usage calculates not only single terminal usage, but also using multiple terminals usage. And in this situation, terminal relation data from table E.4 will be used.
• Table E.5 Authentication Priority Database - Authentication Priority Table
• Figure 6 shows a flowchart of the method of 1 :N authentication.
• Common Account ID 001 represents all of the users in a single group - say, the employees of the shoe department in a department store.
• the shoe department might have a number of cash register terminals, denominated as Terminal 1 to Terminal x, and when the store is opened, all of the terminals in the departments are opened by Common Account ID 001.
• Each of the twenty-six employees in the department is denominated by a letter, for example User A ... User Z, and each of the twenty-six employees will have his or her own biometric data for authentication purposes. All of the twenty-six employees are not likely to be in the store at any given time slot, as each has his or her own schedule, but when they are there they may need to authenticate (log in) at any of the terminals 1-x.
• a user (User M) is attempting to authenticate at a target terminal, for the purposes of this example, Terminal 1.
• the user may have previously logged on to one or more other terminals.
• the user enters his authentication data (for example, puts his thumb on a reader or enters his code at the register keypad).
• the system would then have to perform the authentication process for each of the users (Users A-Z) in the group (Common Account ID 1 , the shoe department), until it found a match for the biometrics for the new user.
• the system would have to go through each of the users from User A through User L before finding a match for User M. Thus the system would have to go through the authentication process twelve times. Clearly, in larger groups this could potentially take a significant amount of time.
• This situation can be improved by prioritizing the users who might be expected to log in at a specific terminal at a specific time slot.
• This can be stored in an Authentication Priority Table.
• the Authentication Priority Table has the following information:
• step 222 of Figure 3 when User M attempts to log in at Terminal 1 for Common Account ID 001, the authentication program 66 retrieves entries from the authentication priority table for the target terminal at the current time slot (step 302).
• the authentication program 66 reads the authentication status on the other terminals from the authentication results table (step 308).
• the authentication program notes that User A is currently logged in on Terminal 3, Users B, D and N are currently logged in at Terminal 11 , User C is currently logged in at Terminal 12, and User G is logged in at Terminal 8, as noted above. Other users are logged in at other terminals.
• the authentication status read in step 308 is then used to create a Temporal Authentication Priority Table by adding priority information and mask status as noted below (step 310). For each priority, additional data is added to indicate mask status. Because the mask status has two conditions, the example defines the status states as "true” meaning “masked” and “false” meaning “unmasked”. It will be understood that any other code could be used for this function, such as a simple 0 or 1 binary number, etc.
• the first two priority entries are masked ("true”) because these users are authenticated elsewhere.
• the other users prioritized as priority 3 through (n-1) are also logged in, and are thus also masked out.
• the "Authentication Priority Table” differs from the “Temporal Authentication Priority Table” in the following ways:
• the Authentication Priority Table has a static status among measurement interval for authentication operation statistics, hourly, daily or weekly.
• Temporal Authentication Priority Table can change its data and masked status dynamically according to the authenticate operation.
• the Temporal Authentication Priority Table is created by loading the Authentication Priority Table from storage into memory, modified as noted above.
• the authentication program 66 then executes 1 :N type authentication using the temporal authentication priority table (step 312).
• the system could be set up to automatically log off a user after a period of inactivity, so that the unmasking would happen automatically, allowing a user to move from terminal to terminal freely as long as they allow a determined time between logins.
• step 314 If the authentication is accepted by the terminal (step 314), the access to the terminal is granted (step 316), the authentication result is stored to the authentication table (step 318) and the method ends.
• step 314 If the authentication is not accepted by the terminal (step 314), the authentication result is stored to the authentication table (step 318), a message is sent to the terminal indicating that the authentication was not accepted (step 320), and the method ends.
• Element 1 Hybrid authentication processing execution mechanism
• authentication is performed by authenticating the entered biometric information of the target user with stored authentication reference biometric data and stored
• This system implements 1 :1 type authentication and also 1 :N authentication.
• [00181] 1 :N type authentication process is performed according to the relevant authentication priority by terminals.
• Element 2 Terminal relevance calculation feature
• the present invention may be a system, a method, and/or a computer program product at any possible technical detail level of integration
• the computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention
• the computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device.
• the computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing.
• a non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing.
• RAM random access memory
• ROM read-only memory
• EPROM or Flash memory erasable programmable read-only memory
• SRAM static random access memory
• CD-ROM compact disc read-only memory
• DVD digital versatile disk
• memory stick a floppy disk
• a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon
• a computer readable storage medium is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted through a wire.
• computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network.
• the network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers.
• a network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.
• Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, configuration data for integrated circuitry, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++, or the like, and procedural programming languages, such as the "C" programming language or similar programming languages.
• the computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server.
• the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
• electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention.
• These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
• These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.
• the computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.
• each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s).
• the functions noted in the blocks may occur out of the order noted in the Figures.
• two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Hardware Design (AREA)
• General Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Signal Processing (AREA)
• Computer Networks & Wireless Communication (AREA)
• Physics & Mathematics (AREA)
• Health & Medical Sciences (AREA)
• General Health & Medical Sciences (AREA)
• General Physics & Mathematics (AREA)
• Software Systems (AREA)
• Computing Systems (AREA)
• Biomedical Technology (AREA)
• Social Psychology (AREA)
• Collating Specific Patterns (AREA)
• Storage Device Security (AREA)

Priority Applications (3)

Applications Claiming Priority (2)

Publications (1)

Family

ID=64176650

Family Applications (1)

Country Status (5)

Cited By (3)

Families Citing this family (3)

Citations (4)

Family Cites Families (35)

• 2017
  • 2017-11-22 US US15/821,036 patent/US10136320B1/en active Active
• 2018
  • 2018-11-21 JP JP2020528114A patent/JP7104152B2/ja active Active
  • 2018-11-21 WO PCT/IB2018/059157 patent/WO2019102362A1/en not_active Ceased
  • 2018-11-21 DE DE112018005018.1T patent/DE112018005018B4/de active Active
  • 2018-11-21 GB GB2008862.1A patent/GB2581458B/en active Active

Patent Citations (4)

Also Published As

Similar Documents

Legal Events