Entrusted authentication systems and technologies

Abstract

Systems and methods can be used to authenticate a user using a first device (e.g., a collaborating device) and a second device (e.g., a device adjacent to the collaborating device). For example, the first device can compare an authentication image of the user (captured by the second device) with an image captured by the first device (e.g., at a lower resolution or with a partial view). In response to identifying the user from the authentication image (e.g., by matching the authentication image with a reference image of the user) and determining a correlation between the authentication image and the captured image, the user can be authenticated by the first device.

Description

Background Art

[0001] Conference room equipment, such as collaboration devices (e.g., computers, tablets, or other devices with computing power and screens or cameras), can be used to attempt to perform facial recognition or other biometric authentication. However, these devices may not capture enough information to successfully authenticate the user (e.g., blurry or incomplete images, too few pixels in the authentication portion of the image, etc.). One problem that arises is that the distance between the conference room equipment and the user makes these biometric captures difficult and less accurate. Another problem is that it may be awkward for the user to stand close enough to the conference room equipment to accurately capture an authenticatable image. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] In the accompanying drawings, which are not necessarily drawn to scale, like numbers may describe similar parts in different views. Like numbers with different letter suffixes may represent different instances of similar components. The accompanying drawings generally illustrate the various embodiments discussed in this document by way of example and not limitation.

[0003] Figure 1 Illustrated is a collaboration space including a device for authenticating users in accordance with some embodiments.

[0004] Figure 2 Illustrated are an authentication image and a limited or captured image according to some embodiments.

[0005] Figure 3 An authentication user interface is illustrated in accordance with some embodiments.

[0006] Figure 4 A flow diagram illustrating a technique for authenticating a user according to some embodiments is illustrated.

[0007] Figure 5 An example of a block diagram of a machine on which any one or more of the techniques discussed herein may be performed is illustrated generally, in accordance with some embodiments. DETAILED DESCRIPTION

[0008] Systems and methods for authenticating users are described herein. In an example, a user device (such as a phone, tablet, laptop or desktop computer, smartwatch, etc.) captures a biometric image (e.g., of the face) and sends it to a collaboration device for verification. The collaboration device can be a conference room device, such as the Surface Hub from Microsoft of Redmond, Washington. The collaboration device can perform facial recognition or other biometric authentication to authenticate the user. However, due to the location of the collaboration device (e.g., if the collaboration device is installed or positioned across a table, table, or room), the distance between the user and the collaboration device, the inconvenience of use (e.g., it may be awkward for the user to stand in front of the collaboration device in front of other people), etc., it may be difficult to authenticate the user using only the collaboration device. These problems may make biometric capture difficult or less accurate. The user device can be used to capture a biometric image, which can then be sent to the collaboration device for verification. In an example, to verify that the device is not using a pre-stored picture or exploiting some other security vulnerability, the collaborating device may compare an image captured by the collaborating device with an image captured by the user device to determine whether the image from the user device is a recent picture (e.g., captured within a time frame, or a substantially similar image, etc.).

[0009] The systems and methods described herein can be used to authenticate users against collaborative devices. For example, a collaborative device and a neighboring device (e.g., a mobile device such as a phone or tablet, a computer, or other non-collaborative device) can be used to establish an authentication session. The authentication session can include an authenticated call session, receiving access to resources such as files or applications, access to a secure server or device, access to a secure video or audio call, and the like. The authentication session can be initiated at a collaborative device or a neighboring device. An authentication image can be taken by a neighboring device, which can then be compared to an image captured by the collaborative device. The comparison can be performed at a collaborative device, a neighboring device, or another device such as a remote server. The user can be authenticated in response to determining a correlation between the authentication image and an image captured by the collaborative device.

[0010] In an example, the systems and techniques described herein can be used to improve the level of authentication for a user by using a trusted device (e.g., a collaborating device) to perform authentication to verify biometric or image data obtained via an untrusted device (e.g., a different device located near the collaborating device). To verify that the neighboring device is not using a pre-stored picture or attempting to exploit some other security vulnerability, the collaborating device can compare its captured image with the authentication image of the neighboring device to determine whether the image captured by the neighboring device is a recent picture (e.g., within a timeout window). Neighboring devices are used for easier access by users for authentication, or when the camera of the collaborating device does not successfully obtain the angle or perspective required for the authentication image. In other examples, the collaborating device may have a partial view or lower resolution data than the neighboring device.

[0011] Figure 1 An environment 100 including devices for authenticating a user 108 is illustrated in accordance with some embodiments. The environment 100 includes a collaboration device 102 that includes a display screen 104 for presenting a user interface. The environment 100 may include a user 108 and a proximal device 106 (illustrated here as a mobile phone, but in other examples may include a tablet computer, a smart device (such as a watch), a laptop or desktop computer, a smart remote control, a thermostat, a video camera, a smart speaker / hub, etc.). The proximal device 106 may be used to capture an authentication image of the user 108. The authentication image may be sent to the collaboration device 102, which may also capture an image. The authentication image may be compared to an image captured by the collaboration device 102 to determine whether to authenticate the user 108.

[0012] In an example, the authentication determination can be initiated by the user 108 at a user interface displayed on the display screen 104 of the collaboration device 102. In another example, the authentication determination can be initiated at the proximity device 106. In yet another example, the authentication determination can be initiated automatically, for example, when the user 108 or the proximity device 106 is within range of the collaboration device 102, when a connection is made on the collaboration device 102, when a wireless connection is made between the collaboration device 102 and the proximity device 106 (e.g., via Wi-Fi, Bluetooth, near field communication (NFC), etc.), etc.

[0013] When an authentication session is initiated, whether at the proximity device 106, at the collaboration device 102, or elsewhere, an image captured by the proximity device 106 is compared to an image captured by the collaboration device 102. In an example, this comparison can occur on the collaboration device 102, the proximity device 106, or a remote device. When the comparison results in a correlation between the two images, the user 108 can be authenticated. In an example, authenticating the user 108 can result in access to resources such as files or applications on the collaboration device 102 or the proximity device 106, access to a secure server or device, access to a secure video or audio call, and the like.

[0014] Comparing the two images may include determining whether a threshold number of facial features between the two images match. When authenticating user 108, a high threshold may be used when comparing the image captured by proximity device 106 (authentication image) to the stored image to actually authenticate user 108. When checking the authentication (e.g., checking proximity device 106), the threshold may be lower to compare the authentication image to the image captured by collaboration device 102.

[0015] In some examples, additional actions may be taken in addition to or in lieu of comparing the authentication image to the captured image. For example, multiple images may be used, such as comparing the authentication image to two sets of two images of each of the captured images, or multiple images may be used to generate a composite image to use as the captured image to compare with the authentication image. In examples, other captured information may be used, such as video, audio (e.g., user 108's spoken words or background audio), biometrics (e.g., fingerprints), etc.

[0016] In an example, the collaboration device 102 and the proximity device 106 can communicate using an initial connection (such as Bluetooth or Wi-Fi), and can then communicate via other protocols after initialization, such as via 4G / 5G or other wireless network protocols, the Internet, or a wired connection. In other examples, no initial connection is required. In another example, the collaboration device 102 and the proximity device 106 can communicate via Bluetooth or Wi-Fi for the duration of the authentication process. In another example, near field communication (NFC) can be used. In this example, NFC communication can ensure that the proximity device 106 is within a certain proximity to the collaboration device 102, resulting in a usable captured image of the collaboration device 102.

[0017] Figure 2204 and a limited or captured image 202 of a user according to some embodiments. Authentication image 204 may be captured by a mobile device such as a mobile phone, tablet, laptop, wearable device, or a desktop computer. Limited or captured image 202 may be captured by a cooperating device, or the like. Limited or captured image 202 depicts the environment (e.g., around the user). Thus, limited or captured image 202 may have a larger capture area or more pixels or data, but may only capture the user in a small portion of the image, making the image more difficult (than authentication image 204) or impossible to authenticate the user.

[0018] As in Figure 2 As illustrated in , authentication image 204 includes a clear view of the user, where the user occupies a majority of the image. In contrast, limited or captured image 202 includes a less clear or smaller view of the user, where the user occupies less of the image. Although the user is still visible in limited or captured image 202, authenticating the user by comparing facial features with a reference image of the user using limited or captured image 202 may be more difficult (or impossible) than using authentication image 204.

[0019] Authenticating the user can include a two-step process. In one step, an authentication image 204 can be used to authenticate the user by comparing the authentication image 204 with a reference image of the user (not shown). In another step, the authentication image 204 can be compared with a limited or captured image 202, and when a correlation between the authentication image 204 and the limited or captured image 202 is determined, the user can be authenticated. In an example, the authentication image 204 is captured by an untrusted device, while the limited or captured image 202 is captured by a trusted device. Thus, the image captured by the untrusted device is used to authenticate the user, and the trusted device is used to verify that the untrusted device is trusted. These actions in the two-step process can be performed individually (e.g., on separate devices) or together on a single device, and can be performed in any order.

[0020] In an example, facial features of the user in authentication image 204 are compared to both the reference image and the limited or captured image 202. In an example, a higher threshold is used for authentication when comparing to the reference image than when comparing to the limited or captured image 202. For example, authentication against the reference image may require all or substantially all of the test facial features, while authentication against the limited or captured image 202 may require only a majority (e.g., 75%) of the test facial features. Other thresholds may be used as desired. In another example, other techniques may be used to correlate the two images.

[0021] Figure 3 An authentication user interface 300 according to some embodiments is illustrated. The authentication user interface 300 can be displayed on a collaborative device, a device near the collaborative device, or a device remote from the collaborative device. The authentication user interface 300 includes a user-selectable icon 302. The icon 302 may include an image of a user. When a user hovers over or selects the icon 302 (e.g., using a mouse, touch, etc.), additional information may be displayed, including an option for initiating an authentication session. The icon 302 may be operated by the user depicted or referenced in the details of the icon 302 or the additional information displayed, or by a second user. Regardless of which user operates the icon 302, the authentication session may be initiated by contacting the device of the user depicted or referenced by the icon 302 or the additional information.

[0022] When icon 302 is an image or information related to a user, the user's adjacent device can be used to authenticate the user. When icon 302 is another user's, the other user can receive a request to start an authentication session at the collaboration device. The authentication session can include sharing files, sharing real-time video or audio, or granting access to resources (e.g., applications).

[0023] Figure 4 Illustrated is a flow diagram of a technique 400 for authenticating a user, according to some embodiments.

[0024] Technique 400 includes an operation 402 of initiating an authentication session. The authentication session can be initiated at a collaborating device (e.g., a video conferencing device or hub, a smart board, etc.), a neighboring device (e.g., a phone, tablet, laptop, etc.), or a remote device (e.g., a phone, tablet, computer, etc. that is not in proximity (e.g., in the same room or within wireless protocol distance) to the collaborating device). The authentication session can be initiated in response to a camera detecting movement or presence of a face (e.g., at the collaborating device) or by a user instruction. The user instruction can include a voice command, a selection on a user interface, a preselected automatic action (e.g., initiate when the phone is near the collaborating device), etc. The user interface for authentication can be displayed on the collaborating device, the neighboring device, the remote device, or some combination of the three (e.g., first on the collaborating device and then switched to the neighboring device after user selection).

[0025] In an example, the authentication session is initiated by a user selection of a user's face (e.g., their own face or the face of another user with whom they are collaborating) on ​​a user interface of a collaborating device or a neighboring device. In another example, the authentication session is initiated in response to receiving a touch input indication on an icon of the user on a display screen of the collaborating device. The neighboring device may be associated with the user. The neighboring device may be identified based on the touch input indication on the icon. For example, the neighboring device may be registered with the user in a system that is connected to the collaborating device, and the neighboring device may be identified (and instructions may be sent in response) when an icon associated with the user is selected on the user interface of the collaborating device.

[0026] Technique 400 may include sending a request from a cooperating device for an authentication image to be taken at a nearby device. In an example, the request may be sent using Bluetooth or Wi-Fi protocols. In another example, the request may be sent using near field communication (NFC). Other communication protocols may be used, such as cellular or wired connections. In an example, only the initial or first few messages (e.g., establishing a connection or sending an initial request) may be performed using Bluetooth or Wi-Fi, while the remaining communications may use a more convenient protocol for communication.

[0027] Technique 400 includes operation 404, in which an authentication image is captured at a device (e.g., a neighboring device) (e.g., in real time or within a timeout threshold limit). Operation 404 can be performed in response to the collaborating device sending a request for the authentication image to the neighboring device. The authentication image can be sent to the collaborating device or a remote device (e.g., a server) for additional actions described below. In another example, the additional actions described below can be performed by the neighboring device (e.g., after receiving an image captured by the collaborating device). The authentication image can be captured using a camera of the neighboring device. The authentication image can have higher quality, higher pixel density, clearer, sharper, better focused, higher resolution, or a more comprehensive view of the user (e.g., the user's face) than the image captured by the collaborating device. In another example, the authentication image or captured image may not be an image, but rather information captured from an image captured using a camera of the device.

[0028] Technique 400 includes operation 406, in which the authentication image is compared with an image captured by a collaborating device. In an example, the comparison can be performed on a collaborating device or a remote device after receiving the authentication image from a neighboring device. The comparison can include comparing a set of facial features in the authentication image with a set of facial features in the captured image. Operation 406 can include using a moving average subset of pixels of the captured image. In an example, the initially captured image may be large, for example, only a subset of pixels or image portion actually captures the relevant authentication portion of space (e.g., the user's face). In this example, the subset of pixels can be scanned until the relevant portion of the image is found. One technique for finding the relevant portion includes using a moving average. In another technique, the initially captured image can be divided into sub-portions, and the sub-portion with the most facial features can be selected and compared. In yet another technique, multiple sub-images can be compared to the authentication image. In an example, the captured image can include only a partial view or lower resolution data compared to the authentication image.

[0029] In an example, the collaborating device may attempt to authenticate the user using a captured image, but may determine that the captured image only includes a partial view of the user, low-resolution data, or other flaws that render the captured image unusable for authenticating the user. If the collaborating device determines that the captured image is a partial view or low-resolution, the collaborating device may initiate a request to a neighboring device to cause the capture of an authentication image. Additional authentication may be performed based on a comparison of the captured image with the image from the device, and access may be selectively granted depending on the authentication result.

[0030] Technique 400 includes operation 408, in which the user is authenticated in response to determining a correlation between the authentication image and the captured image. The user can be authenticated first by identifying the user from the authentication image, such as by matching the authentication image with a reference image of the user (e.g., by matching portions of the user's face in the authentication image with portions of the user's face in the reference image). Then, as a second layer of security, the user can be authenticated by determining the correlation. This allows untrusted devices (e.g., neighboring devices) to be used in the authentication process (while establishing a measure of trust with the neighboring devices by using the correlation).

[0031] In an example, when a threshold number of facial features match between the two images, a correlation between the two images can be determined. In an example, authenticating the user includes determining whether a timeout corresponding to the authentication session has expired before determining the correlation. For example, a timeout can be set when initiating the authentication session, and the comparison and authentication may need to be completed before the timeout expires.

[0032] In an example, authenticating the user may include comparing a voice sample, a video sample, or other biometric sample (e.g., a fingerprint, a retinal scan, a facial representation) in addition to or in lieu of two images. For example, video, audio, or biometrics may be captured at both the neighboring device and the collaborating device and compared. The techniques described herein may be used with audio, video, or biometrics in addition to or in lieu of images, as the problems addressed by these techniques also exist in those examples. An image taken by a collaborating device may not have sufficient resolution or contain enough data to accurately authenticate a user (or it may be awkward for the user to place their face close enough to the camera of the collaborating device). Similarly, it may be difficult to accurately obtain video, audio, or biometrics at the collaborating device.

[0033] Technique 400 includes optional operation 410, wherein, in response to the user being authenticated, the user can be authorized to access resources. For example, authenticating the user can result in the user being authorized to access resources such as files or applications on a collaborating device or a neighboring device, access a secure server or device, access a secure video or audio call, access a specific user profile, etc.

[0034] In an example, means for processing, comparing, authenticating, identifying, determining, or providing a resource may be provided by instructions executed via, for example, a processor and memory of a computing device (e.g., a cooperating device or a neighboring device). In an example, means for receiving may include communication circuitry (e.g., as described below with respect to Figure 5 .) Means for providing a user with access to system resources in response to authenticating the user may be provided by a processor authorizing access to a memory location within a memory of a device or server, allowing access to a communication circuit to access a port or connect another device (e.g., over a secure connection), and the like.

[0035] Figure 5The overall diagram illustrates an example of a block diagram of a machine 500 according to some embodiments, on which any one or more of the techniques (or methods) discussed herein can be performed. In alternative embodiments, the machine 500 can operate as a standalone device or can be connected (e.g., networked) to other machines. In a networked deployment, the machine 500 can operate in the capacity of a server machine, a client machine, or both in a server-client network environment. In an example, the machine 500 can act as a peer machine in a peer-to-peer (P2P) (or other distributed) network environment. The machine 500 can be a personal computer (PC), a tablet PC, a telephone calling device, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a network appliance, a network router, a switch or bridge, or any machine capable of executing instructions (sequentially or otherwise) specifying the actions to be taken by the machine. In addition, although only one machine is illustrated, the term "machine" should also be construed to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methods discussed herein, such as cloud computing, software as a service (SaaS), or other computer cluster configurations.

[0036] As described herein, examples may include logic or multiple components, modules or mechanisms, or may be operated on. A module is a tangible entity (e.g., hardware) that is capable of performing specified operations at runtime. A module includes hardware. In an example, the hardware may be specifically configured to perform specific operations (e.g., hardwired). In an example, the hardware may include a configurable execution unit (e.g., a transistor, a circuit, etc.) and a computer-readable medium containing instructions, wherein the instructions configure the execution unit to perform specific operations at the time of operation. The configuration may occur under the guidance of the execution unit or a loading mechanism. Thus, the execution unit is communicatively coupled to the computer-readable medium while the device is running. In this example, the execution unit may be a member of more than one module. For example, in operation, the execution unit may be configured by a first set of instructions to implement a first module at a point in time, and reconfigured by a second set of instructions to implement a second module.

[0037] The machine (e.g., a computer system) 500 may include a hardware processor 502 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), a main memory 504, and a static memory 506, some or all of which may communicate with each other via an interconnect (e.g., a bus) 508. The machine 500 may also include a display unit 510, an alphanumeric input device 512 (e.g., a keyboard), and a user interface (UI) navigation device 514 (e.g., a mouse). In an example, the display unit 510, the alphanumeric input device 512, and the UI navigation device 514 may be a touch screen display. The machine 500 may additionally include a storage device (e.g., a drive unit) 516, a signal generating device 518 (e.g., a speaker), a network interface device 520, and one or more sensors 521, such as a global positioning system (GPS) sensor, a compass, an accelerometer, or other sensors. The machine 500 may include an output controller 528, such as a serial (e.g., universal serial bus (USB)), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection to communicate with or control one or more peripheral devices (e.g., printer, card reader, etc.).

[0038] The storage device 516 may include a non-transitory machine-readable medium 522 on which is stored one or more sets of data structures or instructions 524 embodying or utilized by any one or more of the techniques or functionality described herein. The instructions 524 may also reside, completely or at least partially, within the main memory 504, within the static memory 506, or within the hardware processor 502 during execution by the machine 500. In an example, one or any combination of the hardware processor 502, the main memory 504, the static memory 506, or the storage device 516 may constitute a machine-readable medium.

[0039] Although machine-readable medium 522 is illustrated as a single medium, the term “machine-readable medium” may include a single medium or multiple media (eg, a centralized or distributed database, or associated caches and servers) configured to store one or more instructions 524 .

[0040] The term "machine-readable medium" may include any medium that can store, encode, or carry instructions for execution by the machine 500 and cause the machine 500 to perform any one or more of the techniques of the present disclosure, or any medium that can store, encode, or carry data structures used by or associated with such instructions. Non-limiting examples of machine-readable media may include solid-state memory and optical and magnetic media. Specific examples of machine-readable media may include: non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.

[0041] The instructions 524 may also be transmitted or received over the communication network 526 using a transmission medium via the network interface device 520 using any of a variety of transmission protocols (e.g., frame relay, Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), etc.). Exemplary communication networks may include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), a mobile telephone network (e.g., a cellular data network), a plain old telephone (POTS) network, and a wireless data network (e.g., the Institute of Electrical and Electronics Engineers (IEEE) 802.11 series of standards, known as 4G (e.g., Long Term Evolution (LTE)) or 5G networks), IEEE 802.15.4 family of standards, point-to-point (P2P) networks, etc. In an example, the network interface device 520 may include one or more physical jacks (e.g., Ethernet, coaxial, or telephone jacks) or one or more antennas to connect to the communication network 526. In an example, the network interface device 520 may include multiple antennas to communicate wirelessly using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) technology. The term "transmission medium" should be understood to include any intangible medium capable of storing, encoding, or carrying instructions for execution by the machine 500, and including digital or analog communication signals or other intangible media to facilitate communication of such software.

[0042] Each of these non-limiting examples can stand on its own or can be combined with one or more of the other examples in various permutations or combinations.

[0043] Example 1 is a method for authenticating a user, comprising: processing a request for an authentication session at a processor of a first device; receiving an authentication image of a user from a second device, the authentication image being captured at the second device; causing an authentication operation by: comparing the authentication image with an image of the user captured by the first device; authenticating the user in response to: identifying the user by matching the authentication image with a reference image of the user; and determining a correlation between the authentication image and the captured image; and providing the user with access to system resources in response to authenticating the user.

[0044] In Example 2, the subject matter of Example 1 includes wherein the authentication session is initiated in response to receiving a touch input indication on a display screen of the first device on an icon of the user.

[0045] In Example 3, the subject matter of Example 2 includes wherein the second device is associated with the user and is identified based on the touch input indication on the icon.

[0046] In Example 4, the subject matter of Examples 1-3 includes wherein the authentication session is initiated in response to receiving an indication from the second device.

[0047] In Example 5, the subject matter of Examples 1-4 includes wherein sending the request to the second device comprises sending the request wirelessly using a Bluetooth or Wi-Fi protocol.

[0048] In Example 6, the subject matter of Examples 1-5 includes: wherein comparing the authentication image to the captured image comprises comparing a set of facial features in the authentication image to a set of facial features in the captured image.

[0049] In Example 7, the subject matter of Example 6 includes: wherein determining the correlation comprises determining that a threshold number of facial features match between the set of facial features in the authentication image and the set of facial features in the captured image.

[0050] In Example 8, the subject matter of Examples 1-7 includes wherein comparing the authentication image to the captured image comprises using a moving average subset of pixels of the captured image.

[0051] In Example 9, the subject matter of Examples 1-8 includes, wherein authenticating the user comprises comparing a voice sample captured by the second device to a voice sample captured by the first device.

[0052] In Example 10, the subject matter of Examples 1-9 includes: wherein authenticating the user comprises comparing a video captured by the second device to a video captured by the first device.

[0053] In Example 11, the subject matter of Examples 1-10 includes wherein authenticating the user comprises determining whether a timeout corresponding to the authentication session has expired before determining the correlation.

[0054] In Example 12, the subject matter of Examples 1-11 includes wherein the captured image includes only a partial view or lower resolution data compared to the authentication image.

[0055] In Example 13, the subject matter of Examples 1-12 includes, wherein the first device is a trusted device and the second device is an untrusted device.

[0056] Example 14 is a system for authenticating a user, comprising: a first device including a processor for: causing a limited image of the user to be captured, the limited image having a partial view of the user or a lower resolution view than the authentication image; comparing an authentication image of the user captured by a second device with the limited image; authenticating the user in response to the following operations: identifying the user by matching the authentication image with a reference image of the user; and determining a correlation between the authentication image and the limited image; and providing the user with access to system resources in response to authenticating the user.

[0057] In Example 15, the subject matter of Example 14 includes: wherein, to compare the authentication image with the captured image, the first device is further configured to compare a set of facial features in the authentication image with a set of facial features in the captured image.

[0058] In Example 16, the subject matter of Examples 14-15 includes wherein, to authenticate the user, the first device further determines whether a timeout corresponding to an authentication session has expired before determining the correlation.

[0059] Example 17 is a first device for authenticating a user, comprising: a processor and a memory, comprising instructions that, when executed by the processor, cause the processor to perform the following operations: process a request for an authentication session; receive an authentication image of a user from a second device, the authentication image being taken at the second device; compare the authentication image with an image of the user captured by the first device; authenticate the user in response to the following operations: identifying the user by matching the authentication image with a reference image of the user; and determining a correlation between the authentication image and the captured image; and provide the user with access to system resources in response to authenticating the user.

[0060] In Example 18, the subject matter of Example 17 includes, wherein the authentication session is initiated in response to receiving a touch input indication on a display screen of the first device on an icon of the user.

[0061] In Example 19, the subject matter of Examples 17-18 includes: wherein the instructions for comparing the authentication image with the captured image include instructions for causing the processor to: compare a set of facial features in the authentication image with a set of facial features in the captured image; and determine whether a threshold number of facial features match between the set of facial features in the authentication image and the set of facial features in the captured image.

[0062] Example 20 is a device for authenticating a user, comprising: a unit for processing a request for an authentication session of a first device; a unit for receiving an authentication image of a user from a second device, the authentication image being taken at the second device; a unit for comparing the authentication image with an image of the user captured by the first device; a unit for authenticating the user in response to the following operations: identifying the user by matching the authentication image with a reference image of the user; and determining a correlation between the authentication image and the captured image; and a unit for providing the user with access to system resources in response to authenticating the user.

[0063] Example 21 is at least one machine-readable medium comprising instructions that, when executed by a processing circuit, cause the processing circuit to perform operations to implement any of Examples 1-20.

[0064] Example 22 is an apparatus comprising means for implementing any of Examples 1-20.

[0065] Example 23 is a system implementing any of Examples 1-20.

[0066] Example 24 is a method of implementing any of Examples 1-20.

[0067] The method examples described herein may be at least partially machine or computer implemented. Some examples may include a computer-readable medium or machine-readable medium encoded with instructions, the instructions being operable to configure an electronic device to perform the method as described in the above examples. The implementation of such a method may include code, such as microcode, assembly language code, high-level language code, etc. Such code may include computer-readable instructions for performing various methods. The code may form part of a computer program product. In addition, in an example, the code may be tangibly stored on one or more volatile, non-transitory or non-volatile tangible computer-readable media, such as during execution or at other times. Examples of these tangible computer-readable media may include, but are not limited to: a hard disk, a removable disk, a removable optical disk (e.g., an optical disk and a digital video disk), a cassette tape, a memory card or memory stick, a random access memory (RAM), a read-only memory (ROM), etc.

Claims

1. A method for authenticating a user, comprising: processing, at a processor of the first device, a request for an authentication session; capturing an image of the user using the first device; determining, using the first device, that the captured image is a limited image that is not usable for authentication with a stored reference image of the user; In response to determining that the captured image is not usable for authentication with the stored reference image of the user, initiating a request to a second device to cause an authentication image to be captured; receiving the authentication image of the user from the second device of the user, the authentication image being taken at the second device; Performing an authentication operation to provide the user with access to system resources, the authentication operation comprising: determining whether a first threshold condition is satisfied based on a first set of facial features in the authentication image of the user from the second device and the stored reference image of the user, wherein the stored reference image of the user is different from the authentication image of the user and can be used for authentication; and determining whether a second threshold condition is satisfied based on a second set of facial features in the authentication image of the user from the second device and a captured image of the user from the first device, the second set of facial features being different than the first set of facial features; and The user is provided access to the system resource in response to determining that the first threshold condition and the second threshold condition are satisfied.

2. The method according to claim 1, wherein: The authentication session is initiated in response to receiving a touch input indication on a display screen of the first device on an icon of the user.

3. The method according to claim 2, wherein: The second device is associated with the user and is identified based on the touch input indication on the icon.

4. The method according to claim 1, wherein: The authentication session is initiated in response to receiving an indication from the second device.

5. The method according to claim 1, further comprising: sending the request for the authentication image of the user to the second device, Wherein, sending the request to the second device includes sending the request wirelessly using Bluetooth or Wi-Fi protocol.

6. The method according to claim 1, further comprising: A correlation between the authentication image and the captured image is determined by comparing the second set of facial features in the authentication image to a corresponding set of facial features in the captured image.

7. The method according to claim 6, wherein: Determining the correlation includes determining that a threshold number of facial features match between the second set of facial features in the authentication image and a corresponding set of facial features in the captured image.

8. The method according to claim 1, further comprising: A correlation between the authentication image and the captured image is determined by using a moving average subset of pixels of the captured image.

9. The method according to claim 1, wherein: Performing the authentication includes comparing a voice sample captured by the second device with a voice sample captured by the first device, or comparing a video captured by the second device with a video captured by the first device.

10. The method according to claim 1, wherein: Performing the authentication includes determining whether a timeout corresponding to the authentication session has expired before determining the correlation.

11. The method according to claim 1, wherein: Determining that the captured image is a limited image includes: determining that the captured image contains only a partial view of the user's face, and Among them, the captured image, the authentication image and the stored reference image are all images.

12. The method according to claim 1, wherein: The first device is a trusted device and the second device is an untrusted device.

13. At least one machine-readable medium comprising instructions for operation of a computing system, the instructions, when executed by a machine, causing the machine to perform the operations of the method according to any one of claims 1-12.

14. An apparatus comprising means for performing the method according to any one of claims 1-12.

15. A first device for authenticating a user, comprising: A processor and a memory comprising instructions which, when executed by the processor, cause the processor to: capturing an image of the user using the first device; Processes requests for authentication sessions; determining, using the first device, that the captured image is a limited image that is not usable for authentication with a stored reference image of the user; In response to determining that the captured image is not usable for authentication with the stored reference image of the user, initiating a request to a second device to cause an authentication image to be captured; receiving the authentication image of the user from the second device of the user, the authentication image being taken at the second device; Performing an authentication operation to provide the user with access to system resources, the authentication operation comprising: determining whether a first threshold condition is satisfied based on a first set of facial features in the authentication image of the user from the second device and the stored reference image of the user, wherein the stored reference image of the user is different from the authentication image of the user and can be used for authentication; and determining whether a second threshold condition is satisfied based on a second set of facial features in the authentication image of the user from the second device and a captured image of the user from the first device, the second set of facial features being different than the first set of facial features; and The user is provided access to the system resource in response to determining that the first threshold condition and the second threshold condition are satisfied.

Images