# US 12,192,199 B2 · Systems and methods for continuous authentication and monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,199 B2 - Document ID: US12192199B2 - Status: Granted - Kind: B2 - Application number: 18/329,565 - Filed: 2023-06-05 - Published: 2023-10-05 - Granted: 2025-01-07 - Earliest claimed: 2019-03-06 - Assignees: Wells Fargo Bank, N.A. - Applicants: Wells Fargo Bank, N.A. - Inventors: Abhijit Rao; Masoud Vakili - Web page: https://patentgrep.com/patent/US12192199B2 ## CPC - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - G06V 10/22: by selection of a specific region containing or referencing a pattern; Locating or processing of specific regions to guide the detection or recognition - G06V 20/46: {Extracting features or characteristics from the video content, e.g. video fingerprints, representative shots or key frames} - G06V 40/161: {Detection; Localisation; Normalisation} - G06V 40/171: {Local features and components; Facial parts (eye characteristics G06V40/18); Occluding parts, e.g. glasses; Geometrical relationships} - G06V 40/172: {Classification, e.g. identification} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04L 67/306: User profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04N 5/145: {Movement estimation (for video coding H04N19/51)} - H04N 7/188: {Capturing isolated or intermittent images triggered by the occurrence of a predetermined event, e.g. an object reaching a predetermined position (signal generation from motion picture films H04N5/253)} - H04W 12/065: Continuous authentication - H04W 12/68: Gesture-dependent or behaviour-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING - H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems, apparatuses, methods, and computer program products are disclosed for providing continuous session authentication and monitoring. An example method includes authenticating, at a first time, a session for a user of the client device based on an authentication image data structure and a plurality of first video frames captured before the first time. The example method further includes extracting sample data from a monitor region for each of a plurality of second video frames captured after the first time and generating motion data based on the extracted sample data. The example method further includes detecting, at a second time, a re-authentication trigger event based on the motion data. Subsequently, the example method includes re-authenticating the session based on the authentication image data structure and a plurality of third video frames captured after the second time. ## Claims ### Claim 1 A computing system for providing continuous session authentication, the computing system comprising video monitoring circuitry configured to: in response to receipt of a session authentication request data structure, generate a first video data structure, wherein the first video data structure comprises a first video stream captured over a first duration of time that begins after about a first time, and wherein the first video stream comprises a plurality of first video frames; in response to authentication of a session, generate a second video data structure, wherein the second video data structure comprises a second video stream captured over a second duration of time that begins after about a second time after the first time, and wherein the second video stream comprises a plurality of second video frames; determine a plurality of monitor regions associated with the plurality of second video frames; assign a plurality of weighting values to each of the plurality of monitor regions; extract sample data from the plurality of monitor regions for each of the plurality of second video frames; generate motion data based on the sample data, wherein the motion data comprises motion vector data indicative of motion vectors; apply the plurality of weighting values to the motion vector data to generate weighted motion vectors, and detect, at a third time after the second time, a re-authentication trigger event based on the motion data, including determining whether a magnitude of an average weighted motion vector exceeds a threshold motion vector value. ### Claim 2 (depends on 1) The computing system of claim 1, wherein the video monitoring circuitry is further configured to: monitor, during the first duration of time, a face of a user in the first video stream; monitor, during the second duration of time, a region of the face of the user in the second video stream, wherein a monitor region from the plurality of monitor regions comprises the region of the face of the user; and monitor, during a third duration of time that begins after about the third time, the face of the user in a third video stream. ### Claim 3 (depends on 1) The computing system of claim 1, wherein the first video stream comprises a face of a user, and wherein the video monitoring circuitry is further configured to generate the first video data structure based on a continuous monitoring of the face of the user. ### Claim 4 (depends on 1) The computing system of claim 1, wherein a monitor region from the plurality of monitor regions for each of the plurality of second video frames comprises a portion of a face of a user, and wherein the video monitoring circuitry is further configured to generate the second video data structure based on an intermittent monitoring of the portion of the face of the user. ### Claim 5 (depends on 1) The computing system of claim 1, wherein a third video stream, at the third time after the second time, comprises a face of a user, and wherein the video monitoring circuitry is further configured to generate a third video data structure based on a continuous monitoring of the face of the user. ### Claim 6 (depends on 1) The computing system of claim 1, wherein a monitor region from the plurality of monitor regions comprises a region of a face of a user. ### Claim 7 (depends on 1) The computing system of claim 1, further comprising session authentication circuitry in communication with a client device and a user profile server device, wherein the session authentication circuitry is configured to: receive, from the client device at the first time, a session authentication request data structure indicative of a request to authenticate a session for a user of the client device; retrieve, from the user profile server device, an authentication image data structure associated with the user, wherein the authentication image data structure was captured before the first time; and authenticate, at the second time, the session based on the authentication image data structure and the first video data structure. ### Claim 8 (depends on 7) The computing system of claim 7, wherein the session authentication circuitry is further configured to authenticate the session for the user based on a region-by-region comparison of an authentication image data structure and one of the plurality of first video frames. ### Claim 9 (depends on 7) The computing system of claim 7, wherein the session authentication circuitry is further configured to re-authenticate the session for the user based on a region-by-region comparison of the authentication image data structure and one of a plurality of third video frames. ### Claim 10 (depends on 1) The computing system of claim 1, wherein a monitor region from the plurality of monitor regions comprises a block of samples associated with a face of a user. ### Claim 11 (depends on 10) The computing system of claim 10, wherein the sample data comprises samples extracted from the block of samples. ### Claim 12 (depends on 11) The computing system of claim 11, wherein the block of samples comprises a set of luma samples. ### Claim 13 (depends on 12) The computing system of claim 12, wherein the block of samples further comprises a first set of chroma samples and a second set of chroma samples. ### Claim 14 (depends on 1) The computing system of claim 1, wherein the motion data comprises motion vector data indicative of motion vectors. ### Claim 15 (depends on 14) The computing system of claim 14, wherein the video monitoring circuitry is further configured to generate smoothed motion vector data by applying a smoothing filter to the motion vector data. ### Claim 16 (depends on 15) The computing system of claim 15, wherein the video monitoring circuitry is further configured to generate an average motion vector based on the smoothed motion vector data. ### Claim 17 (depends on 16) The computing system of claim 16, wherein the video monitoring circuitry is further configured to: determine whether a magnitude of the average motion vector exceeds a threshold motion vector value; and in response to determination that the magnitude of the average motion vector exceeds the threshold motion vector value, detect the re-authentication trigger event. ### Claim 18 (depends on 16) The computing system of claim 16, wherein the threshold motion vector value is a first threshold motion vector value, and wherein the video monitoring circuitry is further configured to: determine whether the magnitude of the average motion vector exceeds a second threshold motion vector value greater than the first threshold motion vector value; and in response to determination that the magnitude of the average motion vector exceeds the second threshold motion vector value, generate a session termination control signal indicative of an electronic instruction to terminate the session. ### Claim 19 A computer-implemented method for providing continuous session authentication, the computer-implemented method comprising: in response to receipt of a session authentication request data structure, generating, by video monitoring circuitry, a first video data structure, wherein the first video data structure comprises a first video stream captured over a first duration of time that begins after about a first time, and wherein the first video stream comprises a plurality of first video frames; in response to authentication of a session, generating, by video monitoring circuitry, a second video data structure, wherein the second video data structure comprises a second video stream captured over a second duration of time that begins after about a second time after the first time, and wherein the second video stream comprises a plurality of second video frames; determining, by the video monitoring circuitry, a plurality of monitor regions associated with a plurality of second video frames captured after the first time; assigning, by the video monitoring circuitry, a plurality of weighting values to each of the plurality of monitor regions; extracting, by the video monitoring circuitry, sample data from the plurality of monitor regions for each of the plurality of second video frames; generating, by the video monitoring circuitry, motion data based on the sample data, wherein the motion data comprises motion vector data indicative of motion vectors; applying, by the video monitoring circuitry, the plurality of weighting values to the motion vector data to generate weighted motion vectors; and detecting, by the video monitoring circuitry at a second time, a re-authentication trigger event based on the motion data, including determining whether a magnitude of an average weighted motion vector exceeds a threshold motion vector value. ### Claim 20 A computer program product for providing continuous session authentication, the computer program product comprising at least one non-transitory computer-readable storage medium storing computer-executable program code instructions that, when executed by a computing apparatus, cause the computing apparatus to: in response to receipt of a session authentication request data structure, generate a first video data structure, wherein the first video data structure comprises a first video stream captured over a first duration of time that begins after about a first time, and wherein the first video stream comprises a plurality of first video frames; in response to authentication of a session, generate a second video data structure, wherein the second video data structure comprises a second video stream captured over a second duration of time that begins after about a second time after the first time, and wherein the second video stream comprises a plurality of second video frames; determine a plurality of monitor regions associated with a plurality of second video frames captured after the first time; assign a plurality of weighting values to each of the plurality of monitor regions; extract sample data from the plurality of monitor regions for each of the plurality of second video frames; generate motion data based on the sample data, wherein the motion data comprises motion vector data indicative of motion vectors; apply the plurality of weighting values to the motion vector data to generate weighted motion vectors; and detect, at a second time, a re-authentication trigger event based on the motion data, including determining whether a magnitude of an average weighted motion vector exceeds a threshold motion vector value.