# US 11,310,228 B1 · Systems and methods for continuous authentication and monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,228 B1 - Document ID: US11310228B1 - Status: Granted - Kind: B1 - Application number: 16/294,572 - Filed: 2019-03-06 - Granted: 2022-04-19 - Earliest claimed: 2019-03-06 - Assignees: Wells Fargo Bank, N.A. - Applicants: Wells Fargo Bank, N.A. - Inventors: Abhijit Rao; Masoud Vakili - Web page: https://patentgrep.com/patent/US11310228B1 ## CPC - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - G06V 10/22: by selection of a specific region containing or referencing a pattern; Locating or processing of specific regions to guide the detection or recognition - G06V 20/46: {Extracting features or characteristics from the video content, e.g. video fingerprints, representative shots or key frames} - G06V 40/161: {Detection; Localisation; Normalisation} - G06V 40/171: {Local features and components; Facial parts (eye characteristics G06V40/18); Occluding parts, e.g. glasses; Geometrical relationships} - G06V 40/172: {Classification, e.g. identification} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04L 67/306: User profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04N 5/145: {Movement estimation (for video coding H04N19/51)} - H04N 7/188: {Capturing isolated or intermittent images triggered by the occurrence of a predetermined event, e.g. an object reaching a predetermined position (signal generation from motion picture films H04N5/253)} - H04W 12/065: Continuous authentication - H04W 12/68: Gesture-dependent or behaviour-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING - H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems, apparatuses, methods, and computer program products are disclosed for providing continuous session authentication and monitoring. An example method includes authenticating, at a first time, a session for a user of the client device based on an authentication image data structure and a plurality of first video frames captured before the first time. The example method further includes extracting sample data from a monitor region for each of a plurality of second video frames captured after the first time and generating motion data based on the extracted sample data. The example method further includes detecting, at a second time, a re-authentication trigger event based on the motion data. Subsequently, the example method includes re-authenticating the session based on the authentication image data structure and a plurality of third video frames captured after the second time. ## Claims ### Claim 1 A computing system for providing continuous session authentication, the system comprising: session authentication circuitry in communication with a client device and a user profile server device, wherein the session authentication circuitry is configured to: receive, from the client device at a first time, a session authentication request data structure indicative of a request to authenticate a session for a user of the client device, retrieve, from the user profile server device, an authentication image data structure associated with the user, wherein the authentication image data structure was captured before the first time, and authenticate, at a second time after the first time, the session based on the authentication image data structure and a first video data structure; and video monitoring circuitry in communication with the session authentication circuitry, wherein the video monitoring circuitry is configured to: in response to receipt of the session authentication request data structure by the session authentication circuitry, generate the first video data structure, wherein the first video data structure comprises a first video stream captured over a first duration of time that begins after about the first time, and wherein the first video stream comprises a plurality of first video frames, in response to authentication of the session by the session authentication circuitry, generate a second video data structure, wherein the second video data structure comprises a second video stream captured over a second duration of time that begins after about the second time, and wherein the second video stream comprises a plurality of second video frames, determine a monitor region for each of the plurality of second video frames, extract sample data from the monitor region for each of the plurality of second video frames, generate motion data based on the sample data, wherein the motion data comprises motion vector data indicative of motion vectors, detect, at a third time after the second time, a re-authentication trigger event based on the motion data, including determining whether a magnitude of an average motion vector exceeds a threshold motion vector value, and in response to detection of the re-authentication trigger event, generate a third video data structure, wherein the third video data structure comprises a third video stream captured over a third duration of time that begins after about the third time, and wherein the third video stream comprises a plurality of third video frames, wherein the session authentication circuitry is further configured to: in response to determination that the magnitude of the average motion vector exceeds the threshold motion vector value, re-authenticate, at a fourth time after the third time, the session based on the authentication image data structure and the third video data structure. ### Claim 2 (depends on 1) The computing system of claim 1, wherein the video monitoring circuitry is further configured to: monitor, during the first duration of time, a face of the user in the first video stream; monitor, during the second duration of time, a region of the face of the user in the second video stream, wherein the monitor region comprises the region of the face of the user; and monitor, during the third duration of time, the face of the user in the third video stream. ### Claim 3 (depends on 1) The computing system of claim 1, wherein the first video stream comprises a face of the user, and wherein the video monitoring circuitry is further configured to generate the first video data structure based on a continuous monitoring of the face of the user. ### Claim 4 (depends on 1) The computing system of claim 1, wherein the monitor region for each of the plurality of second video frames comprises a portion of a face of the user, and wherein the video monitoring circuitry is further configured to generate the second video data structure based on an intermittent monitoring of the portion of the face of the user. ### Claim 5 (depends on 1) The computing system of claim 1, wherein the third video stream comprises a face of the user, and wherein the video monitoring circuitry is further configured to generate the third video data structure based on a continuous monitoring of the face of the user. ### Claim 6 (depends on 1) The computing system of claim 1, wherein the monitor region comprises a region of a face of the user. ### Claim 7 (depends on 1) The computing system of claim 1, wherein the session authentication circuitry is further configured to authenticate the session for the user based on a region-by-region comparison of the authentication image data structure and one of the plurality of first video frames. ### Claim 8 (depends on 1) The computing system of claim 1, wherein the session authentication circuitry is further configured to re-authenticate the session for the user based on a region-by-region comparison of the authentication image data structure and one of the plurality of third video frames. ### Claim 9 (depends on 1) The computing system of claim 1, wherein the monitor region comprises a block of samples associated with a face of the user. ### Claim 10 (depends on 9) The computing system of claim 9, wherein the sample data comprises samples extracted from the block of samples. ### Claim 11 (depends on 10) The computing system of claim 10, wherein the block of samples comprises a set of luma samples. ### Claim 12 (depends on 11) The computing system of claim 11, wherein the block of samples further comprises a first set of chroma samples and a second set of chroma samples. ### Claim 13 (depends on 1) The computing system of claim 1, wherein the motion data comprises motion vector data indicative of motion vectors. ### Claim 14 (depends on 13) The computing system of claim 13, wherein the video monitoring circuitry is further configured to generate smoothed motion vector data by applying a smoothing filter to the motion vector data. ### Claim 15 (depends on 14) The computing system of claim 14, wherein the video monitoring circuitry is further configured to generate an average motion vector based on the smoothed motion vector data. ### Claim 16 (depends on 1) The computing system of claim 1, wherein the video monitoring circuitry is further configured to: measure an experimental average motion vector in an experimental movement condition; determine that a movement condition of the average motion vector corresponds to the experimental movement condition; and generate the threshold motion vector value based on the experimental average motion vector. ### Claim 17 (depends on 1) The computing system of claim 1, wherein the threshold motion vector value is a first threshold motion vector value, and wherein the video monitoring circuitry is further configured to: determine whether the magnitude of the average motion vector exceeds a second threshold motion vector value greater than the first threshold motion vector value; and in response to determination that the magnitude of the average motion vector exceeds the second threshold motion vector value, generate a session termination control signal indicative of an electronic instruction to terminate the session. ### Claim 18 A computer-implemented method for providing continuous session authentication, the computer-implemented method comprising: authenticating, by session authentication circuitry at a first time, a session for a user of a client device based on an authentication image data structure and a plurality of first video frames captured before the first time; extracting, by video monitoring circuitry, sample data from a monitor region for each of a plurality of second video frames captured after the first time; generating, by the video monitoring circuitry, motion data based on the extracted sample data, wherein the motion data comprises motion vector data indicative of motion vectors; detecting, by the video monitoring circuitry at a second time, a re-authentication trigger event based on the motion data, including determining whether a magnitude of an average motion vector exceeds a threshold motion vector value; and in response to determination that the magnitude of the average motion vector exceeds the threshold motion vector value, re-authenticating, by the session authentication circuitry, the session based on the authentication image data structure and a plurality of third video frames captured after the second time. ### Claim 19 A computer program product for providing continuous session authentication, the computer program product comprising at least one non-transitory computer-readable storage medium storing computer-executable program code instructions that, when executed by a computing apparatus, cause the computing apparatus to: authenticate, by session authentication circuitry at a first time, a session for a user of a client device based on an authentication image data structure and a plurality of first video frames captured before the first time; extract, by video monitoring circuitry, sample data from a monitor region for each of a plurality of second video frames captured after the first time; generate, by the video monitoring circuitry, motion data based on the extracted sample data, wherein the motion data comprises motion vector data indicative of motion vectors; detect, by the video monitoring circuitry at a second time, a re-authentication trigger event based on the motion data, including determination as to whether a magnitude of an average motion vector exceeds a threshold motion vector value; and in response to determination that the magnitude of the average motion vector exceeds the threshold motion vector value, re-authenticate, by the session authentication circuitry, the session based on the authentication image data structure and a plurality of third video frames captured after the second time.