# US 2023/0057574 A1 · Apparatus and methods for continuous real-time authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0057574 A1
- Document ID: US20230057574A1
- Status: Published application
- Kind: A1
- Application number: 17/407,256
- Filed: 2021-08-20
- Published: 2023-02-23
- Earliest claimed: 2021-08-20
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: Patrick Burgess; Trish Gillis; Taylor Farris; Napangsiri Wanpen
- Web page: https://patentgrep.com/patent/US20230057574A1

## CPC

- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06N 20/00: Machine learning
- H04L 63/102: {Entity profiles}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Apparatus and methods for continuous real-time authentication are provided. The apparatus and methods may include using a biometric sensor on an Internet-of-things (“IoT”) device to measure a biometric attribute of a user. The measured biometric attribute may be transmitted to a server to compare to a stored biometric attribute and authenticate the user. The IoT device may continue to measure the biometric attribute of the user at a pre-determined interval. Each measurement may be used to authenticate the user. This continuous authentication process may take place without the user's conscious interaction with the IoT device. The apparatus and methods may include using the continuous authentication to process and approve a transaction the user requests.

## Claims

### Claim 1

An apparatus for continuous real-time authentication using Internet-of-things (“IoT”) devices, the apparatus comprising:
one or more IoT devices, each IoT device comprising:
a communication link;
a processor;
one or more biometric sensors;
a non-transitory memory configured to store at least:
an IoT operating system; and
a monitoring engine that runs on the processor and is configured to:
measure, at pre-determined time intervals, one or more biometric attributes of a first user with the one or more biometric sensors;
transmit a first measured biometric attribute of the first user to a server;
receive authentication confirmation from the server;
wait for a transaction instruction from the first user;
transmit the transaction instruction to the server along with the authentication confirmation;
receive confirmation that the transaction was completed;
inform the first user that the transaction was completed;
determine, when the first measured biometric attribute changes to a second measured biometric attribute, that the second measured biometric attribute belongs to a second user;
receive a transaction instruction from the second user; and
ignore the transaction instruction from the second user until the second user is authenticated by the server;
the server, the server comprising:
a communication link;
a processor;
a non-transitory memory configured to store at least:
a server operating system;
authentication data of the first user; and
an authentication engine that runs on the processor and is configured to:
receive the first measured biometric attribute from the IoT devices;
store the first measured biometric attribute;
compare the first measured biometric attribute to the authentication data of the first user;
authenticate the first user;
send the authentication confirmation to the IoT devices; and
process the transaction instruction from the first user; and
wherein:
the monitoring engine determines the second measured biometric attribute belongs to the second user by comparing it with the first measured biometric attribute.

### Claim 2 (depends on 1)

The apparatus of claim 1 wherein the monitoring engine determines the second measured biometric attribute belongs to the second user by comparing it with the first measured biometric attribute through an artificial intelligence/machine learning (“AI/ML”) algorithm.

### Claim 3 (depends on 1)

The apparatus of claim 1 wherein one of the one or more biometric sensors is a camera for facial recognition.

### Claim 4 (depends on 1)

The apparatus of claim 1 wherein one of the one or more biometric sensors is a microphone for voice recognition.

### Claim 5 (depends on 1)

The apparatus of claim 1 wherein one of the one or more biometric sensors is a camera for gait recognition.

### Claim 6 (depends on 1)

The apparatus of claim 1 wherein one of the one or more biometric sensors is a camera configured to scan one or more physical characteristics of each user.

### Claim 7 (depends on 1)

The apparatus of claim 1 wherein the server is centralized.

### Claim 8 (depends on 1)

The apparatus of claim 1 wherein the server is distributed.

### Claim 9 (depends on 1)

The apparatus of claim 1 wherein the pre-determined time interval is variable.

### Claim 10 (depends on 1)

The apparatus of claim 1 wherein the pre-determined time interval is one second.

### Claim 11

An apparatus for continuous real-time authentication using Internet-of-things (“IoT”) devices, the apparatus comprising:
one or more IoT devices, each IoT device comprising:
a communication link;
a processor;
one or more biometric sensors;
a non-transitory memory configured to store at least:
a device operating system; and
a monitoring engine that runs on the processor and is configured to:
measure one or more biometric attributes of a first user with the one or more biometric sensors at a pre-determined time interval;
transmit the measured biometric attributes of the first user to a server;
wait for a transaction instruction from the first user;
transmit the transaction instruction to the server;
receive confirmation that the transaction was completed;
inform the first user that the transaction was completed;
the server, the server comprising:
a communication link;
a processor;
a non-transitory memory configured to store at least:
a server operating system;
authentication data of the first user; and
an authentication engine that runs on the processor and is configured to:
receive the measured biometric attributes from the IoT devices;
store the measured biometric attributes;
compare the measured biometric attributes to the authentication data of the first user;
authenticate the first user;
receive the transaction instructions;
process the transaction instructions;
transmit a confirmation of a completed transaction to the IoT devices;
determine when the measured biometric attributes indicate that the first user is a second user; and
when the measured biometric attributes indicate that the first user is the second user:
attempt to authenticate the second user; and
ignore any transaction instruction from the second user until the second user is authenticated;
wherein:
the authentication engine determines the first user is the second user by comparing the measured biometric attributes with the authentication data of the first user.

### Claim 12 (depends on 11)

The apparatus of claim 11 wherein the authentication engine determines the first user is the second user by comparing the measured biometric attributes with the authentication data of the first user with an artificial intelligence/machine learning (“AI/ML”) algorithm.

### Claim 13 (depends on 11)

The apparatus of claim 11 wherein the pre-determined time interval is one minute.

### Claim 14 (depends on 11)

The apparatus of claim 11 wherein the pre-determined time interval is variable.

### Claim 15 (depends on 14)

The apparatus of claim 14 wherein the authentication engine varies the pre-determined time interval through an artificial intelligence/machine learning (“AI/ML”) algorithm.

### Claim 16

A method for continuous real-time authentication using Internet-of-things (“IoT”) devices, the method comprising:
storing, at a centralized database at a server, one or more encrypted biometric attributes of a user;
receiving, at an authentication engine at the server, a request to authenticate the user from an IoT device;
performing an authentication process, the authentication process comprising:
capturing, by one or more biometric sensors on the IoT device, one or more biometric attributes of the user;
transmitting the captured one or more biometric attributes of the user to the authentication engine;
receiving, at the authentication engine, the captured one or more biometric attributes of the user;
comparing, at the authentication engine, the captured one or more biometric attributes of the user to the one or more encrypted biometric attributes of the user;
authenticating the user;
repeating the authentication process at a pre-determined time interval; and
when the authentication engine is unable to authenticate the user, invalidating authentication of the user.

### Claim 17 (depends on 16)

The method of claim 16 wherein the pre-determined time interval is between one millisecond and 120 seconds.

### Claim 18 (depends on 16)

The method of claim 16 wherein the pre-determined time interval is variable.

### Claim 19 (depends on 18)

The method of claim 18 wherein the pre-determined time interval is variable by an artificial intelligence/machine learning (“AI/ML”) algorithm.

### Claim 20 (depends on 16)

The method claim 16 further comprising:
monitoring, at the IoT device, the user;
receiving, at the IoT device, one or more transaction instructions from the user;
transmitting, from the IoT device, the transaction instructions to the server;
processing the transaction instructions as long as the authentication process has been completed successfully during the pre-determined time interval; and
informing the IoT device when the transaction instructions are processed.