Generating Evaluation Masks for Multi-Factor Authentication

Abstract

In a technique for improving multi-factor authentication, the method generates a reputation mask over one or more modifications on a modified image created by a generative adversarial network (GAN). The method further creates a scoring grid by comparing an original image with the modified image, identifies difference pixels between the original image and the modified image, and overlays the reputation mask over the identified difference pixels on the modified image. The method displays the modified image to a user as a multi-factor authentication prompt, prompting the user to provide a response identifying one or more modifications on the modified image. Additionally, the method calculates a reputation score based on a comparison of the user's response with the reputation mask, verifies the user's response, and authenticates and grants the user access to data or other resources if the reputation score meets or exceeds a predetermined threshold.

Description

[Technical field]

[0001] The present invention relates generally to the field of multi-factor authentication, and more particularly to creating a media file as a means of multi-factor authentication. [Background technology]

[0002] A generative adversarial network (GAN) is a machine learning (ML) model in which two neural networks compete against each other to see who can be more accurate in their predictions. GANs are usually run unsupervised and train using a collaborative zero-sum game framework. The two neural networks that make up a GAN are called the generator and the discriminator. The generator is a convolutional neural network, and the discriminator is a deconvolutional neural network. The goal of the generator is to artificially create outputs that can easily be mistaken for real data. The goal of the discriminator is to identify which outputs it receives that are artificially created. In essence, GANs create their own training data. As the feedback loop between the adversarial networks continues, the generator starts to produce higher quality outputs and the discriminator gets better at flagging artificially created data.

[0003] The first step in establishing a GAN is to identify the desired end output and to assemble an initial training dataset based on these parameters. This data is then randomized and fed as input to the generator until the generator achieves basic accuracy in generating the output. The generated images are then given to a classifier, along with the actual data points from the original concept. The classifier filters the information and returns a probability between 0 and 1 to represent the authenticity of each image (1 corresponds to true and 0 corresponds to false). These values ​​are then manually checked for normality and iterated until the desired result is reached. The core idea of ​​GANs is based on "indirect" training through a classifier, which is itself dynamically updated. Essentially, this means that the generator is not trained to minimize the distance to a particular image, but rather to fool the classifier. This allows the model to learn in an unsupervised manner. GANs are becoming a popular ML model for online retail sales due to their ability to understand and accurately recreate visual content. Summary of the Invention

[0004] An embodiment of the present invention discloses a method, computer program product, and system for multi-factor authentication, the computer-implemented method including generating an assessment mask over one or more modifications on a modified image, where the modified image is created by a generative adversarial network (GAN); creating a scoring grid by comparing an original image to the modified image to identify difference pixels between the original image and the modified image; overlaying the assessment mask over the identified difference pixels on the modified image; displaying the modified image as a multi-factor authentication prompt to a user, where the user is prompted to provide a response identifying the one or more modifications on the modified image; calculating an assessment score based on a comparison of the response from the user to the assessment mask to verify the response from the user; and authenticating the user and granting the user access to data or other resources in response to the assessment score meeting or exceeding a predetermined threshold. [Brief description of the drawings]

[0005] [Figure 1] 1 is a functional block diagram illustrating a distributed data processing environment in accordance with an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram of operational steps of an authentication mechanism 122 on a server computer in the distributed data processing environment of FIG. 1 for multi-factor authentication, in accordance with an embodiment of the present invention. [Diagram 3] FIG. 2 is a block diagram of components of a server computer that executes an authentication mechanism within the distributed data processing environment of FIG. 1 in accordance with an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0006] Embodiments of the present invention improve upon the art of online account security by performing second factor authentication. More specifically, embodiments of the present invention improve upon current techniques by generating evaluation masks (i.e., masks) for modified items on a media file created by a GAN to act as multi-factor authentication. Embodiments of the present invention can be based on media files known to the user (e.g., personal media files) and can challenge the user's prior knowledge of the original media file. The personal media file can be a family photo, an image of the user's first car or home, or any personal image or footage known in the art or combinations thereof. Although embodiments of the present invention improve upon current techniques of user authentication, they do not require personal data from the user such as date of birth, age, or home address; instead, embodiments of the present invention use knowledge about the media file as a metric to authenticate the user. Embodiments of the present invention compare the original media file to the modified media file to identify differences based on pixel changes. By comparing pixel-to-pixel differences, embodiments of the present invention can overlay a mask and identify such differences as "target areas" to act as verification points on the media file. Embodiments of the present invention generate an assessment mask over the GAN-created modifications on a media file as a means of multi-factor authentication. Embodiments of the present invention improve upon the technology by creating authentication puzzles using GANs as a new form of multi-factor authentication for screen-based devices (e.g., computing devices) applicable to digital experiences.

[0007] An embodiment of the present invention creates a scoring grid by comparing an original image with a GAN-modified version of that image (i.e., the modified image), identifies difference pixels between the original image and the modified image, and overlays a mask on the identified difference areas. An embodiment of the present invention labels the identified difference areas as "Difference Areas". Once the modified image is presented to the user, an embodiment of the present invention receives a user response via touch, drawing, or clicking through a user interface, and the received user response (i.e., entered information) is compared to the mask to calculate / validate the user's input (pixel area vs. pixel area). An embodiment of the present invention validates the user's response by verifying the user's prior knowledge of the original media file and comparing the original media file with the modified media file to the identified different areas in the user's response, and if the user's response is within a predetermined tolerance limit, the user's response is validated. For example, if the user's response selects / identifies 98% of the areas that are different in the modified image, an embodiment of the present invention validates the user.

[0008] Implementations of embodiments of the present invention may take a variety of forms, and details of example implementations are discussed below with reference to the drawings (ie, FIGS. 1-3).

[0009] FIG. 1 is a functional block diagram illustrating a distributed data processing environment, generally designated 100, according to an embodiment of the present invention. As used herein, the term "distributed" describes a computer system that includes multiple physically separate devices that operate together as a single computer system. FIG. 1 is merely provided as an example of one implementation and does not imply any limitation with respect to the environments in which different embodiments may be implemented. Many modifications may be made to the depicted environment by one of ordinary skill in the art without departing from the scope of the present invention as set forth in the claims. The distributed data processing environment 100 includes a computing device 110 and a server computer 120 interconnected by a network 130.

[0010] Network 130 may be, for example, a storage area network (SAN), a telecommunications network, a local area network (LAN), a wide area network (WAN) such as the Internet, wireless technologies for communicating data over short distances (using short wavelength ultra-high frequency (UHF) radio waves in the 2.4-2.485 GHz Industrial, Scientific, and Medical (ISM) band from fixed and mobile devices and personal area network (PAN) configurations or a combination of the three), and may include wired, wireless, or fiber optic connections. Network 130 may include one or more wired and / or wireless networks capable of transmitting and receiving data, voice, or video signals (including multimedia signals including voice, data, text, or video data or a combination thereof) or a combination thereof. In general, network 130 may be any combination of connections and protocols supporting communication between computing device 110 and server computer 120, and with any other computing or storage devices (not shown in FIG. 1) or combinations thereof in distributed data processing environment 100.

[0011] In some embodiments of the present invention, computing device 110 may be, but is not limited to, a standalone device, a client, a server, a laptop computer, a tablet computer, a netbook computer, a personal computer (PC), a smartphone, a desktop computer, a smart television, a smart watch, a radio, a stereo system, a cloud-based service (e.g., a cognitive cloud-based service), an AR pair of glasses, a virtual reality headset, any HUD known in the art, or any programmable electronic computing device or combination thereof capable of communicating with various components and devices over network 130 or any combination therein within distributed data processing environment 100. In general, computing device 110 may represent any programmable computing device or combination of programmable computing devices capable of executing machine-readable program instructions and communicating with users of other computing devices over network 130, or capable of executing machine-readable program instructions and communicating with server computer 120, or any combination thereof. In some embodiments, computing device 110 may represent multiple computing devices.

[0012] In some embodiments of the invention, computing device 110 may represent any programmable electronic computing device or combination of programmable electronic computing devices capable of executing machine-readable program instructions, manipulating executable machine-readable instructions, and communicating with other computing devices (not shown) in distributed data processing environment 100 via a network, such as server computer 120 and network 130. Computing device 110 may include an instance of a user interface (interface) 106, and local storage 104. In various embodiments not depicted in FIG. 1, computing device 110 may have multiple interfaces 106. In other embodiments not depicted in FIG. 1, distributed data processing environment 100 may include multiple computing devices, multiple server computers, or multiple networks, or combinations thereof. Computing device 110 may include internal and external hardware components, as shown and described in further detail with respect to FIG. 3.

[0013] The user interface (interface) 106 provides an interface to the automated feedback and authentication mechanism 122. The computing device 110 allows the user and / or client to interact with the authentication mechanism 122 and / or the server computer 120 in various ways, such as sending program instructions, receiving program instructions, sending and receiving messages, updating data, sending data, inputting data, editing data, collecting data, receiving data, or combinations thereof, through the user interface 106. In one embodiment, the interface 106 may be a graphical user interface (GUI) or a web user interface (WUI) that may display at least text, documents, web browser windows, user options, application interfaces, and instructions for operation. The interface 106 may include data (graphics, text, and sound) presented to the user and control sequences utilized by the user to control operation. In another embodiment, the interface 106 may be mobile application software that provides an interface between the user of the computing device 110 and the server computer 120. Mobile application software, or "apps," can be designed to run on smartphones, tablet computers, and other computing devices. In an embodiment, interface 106 at least enables a user of computing device 110 to submit data, enter data, edit data (annotations), collect data, and / or receive data.

[0014] The server computer 120 may be a standalone computing device, an administrative server, a web server, a mobile computing device, one or more client servers, or any other electronic device or computing system capable of receiving, transmitting, and processing data. In other embodiments, the server computer 120 may represent a server computing system utilizing multiple computers, such as, but not limited to, a server system, such as in a cloud computing environment. In another embodiment, the server computer 120 may represent a computing system utilizing clustered computers and components (e.g., database server computers, application server computers, etc.) that act as a single pool of seamless resources when accessed within the distributed data processing environment 100. The server computer 120 may include internal and external hardware components, as shown and described in further detail with respect to FIG. 3. In some embodiments, the server computer 120 may represent multiple server computers.

[0015] Each of the shared storage 124 and the local storage 104 may be a data / knowledge repository or database or both that may be written to and / or read by one or a combination of the authentication mechanism 122, the server computer 120, and the computing device 110. In the depicted embodiment, the shared storage 124 resides on the server computer 120 and the local storage 104 resides on the computing device 110. In another embodiment, the shared storage 124 and / or the local storage 104 may reside in another location within the distributed data processing environment 100, provided that each is accessible to and accessible by the computing device 110 and the server computer 120. The shared storage 124 and / or the local storage 104 may be implemented with any type of storage device capable of storing data and configuration files that may be accessed and used by the server computer 120, such as, but not limited to, a database server, a hard disk drive, or flash memory.

[0016] In the depicted embodiment, authentication mechanism 122 executes on server computer 120. In other embodiments, authentication mechanism 122 may execute on computing device 110. Although not depicted in FIGURE 1, in various embodiments of the invention, authentication mechanism 122 may execute on multiple server computers 120 and / or multiple computing devices 110. In some embodiments, authentication mechanism 122 may be located and / or executed elsewhere in distributed data processing environment 100, so long as authentication mechanism 122 is connected and / or in communication with computing devices 110 and / or server computers 120 via network 130.

[0017] In various embodiments of the invention, the authentication mechanism 122 is a multi-factor authentication mechanism. The authentication mechanism 122 may include and execute a GAN model. In the depicted embodiment, the authentication mechanism 122 includes an ingestor component 125, a security image assessment mask module (assessment module) 126, and a presentation component 128. In other embodiments, the ingestor component 125, the assessment module 126, or the presentation component 128, or a combination thereof, may each execute on the computing device 110. Although not depicted in FIG. 1, in various embodiments of the invention, the ingestor component 125, the assessment module 126, or the presentation component 128, or a combination thereof, may each execute on multiple server computers 120, or multiple computing devices 110, or both. In some embodiments, the ingester component 125, the evaluation module 126, and / or the presentation component 128 may be located and / or executed elsewhere within the distributed data processing environment 100, so long as the ingester component 125, the evaluation module 126, and / or the presentation component 128, respectively, is connected and / or in communication with the authentication mechanism 122, the computing device 110, and / or the server computer 120 via a network 130.

[0018] The authentication mechanism 122 may receive uploaded media files (e.g., digital photos (i.e., pictures) / images) and metadata from a user or a database (i.e., local storage 104 or shared storage 124 or both) via the ingester component 125. In some embodiments of the present invention, the received media files (e.g., user photos) may be photos that are personal or associated with the user, or both. The media files and metadata may be obtained from one or more social media sites and / or open source websites on the Internet, and the authentication mechanism 122 may generate a modified media file using the obtained media files via the GAN model. In other embodiments, the authentication component generates a modified media file using other available images of the given location via the GAN model. The metadata may include the location of the photo, the name of the location, the time, the timestamp of the photo, the file size, the number of pixels, or any descriptive, structural, and administrative metadata or combinations thereof known in the art. The media files may be photos, videos, or any other type of media file or combinations thereof known in the art. In various embodiments of the present invention, the received and / or retrieved metadata is associated with a particular media file. In some embodiments of the present invention, authentication mechanism 122 is linked to or synchronized with one or more of the user's social media profiles.

[0019] The authentication mechanism 122 has user-enabled access to retrieve data or other resources, in one example, photos and metadata from one or more linked user social media profiles. For example, the authentication mechanism 122 retrieves the user's current social media profile picture to create a modified image to present to the user for authentication, and the user is prompted to identify / select differences in the modified image. In various embodiments of the invention, the authentication mechanism 122 performs an internet search via one or more search engines to locate media files (e.g., photos) and metadata. In various embodiments of the invention, the authentication 122 receives media files directly from the user.

[0020] The authentication mechanism 122, via the evaluation module 126, may generate an altered / modified media file based on an original or uploaded image / photo. In various embodiments of the present invention, the evaluation module 126 performs two steps: (i) modifying the original image (e.g., uploaded user media file) using the GAN model, and (ii) creating a mask to place over the modified media file to evaluate the user's answer (i.e., response). In this case, the mask holds information about where the changes were made in the original media file, and the mask is invisible to the user being authenticated. In various embodiments of the present invention, the authentication mechanism 122, via the evaluation module 126, alters the person, fashion, age, color, and pixels in the user uploaded image, generates a modified second image based on the uploaded image, compares the two images, and creates a mask to place over the areas in the modified second image that were modified from the uploaded image.

[0021] For example, a user uploads a photo of a local park, which includes a pedestrian walking a dog, trees, roller skaters, a bird flying in the sky, and a pond. In this example, the authentication mechanism 122, via the ingestor component 125 and the GAN model, generates a modified image of the uploaded park photo. In this case, the modified image removes the dog walking, adds birds to the trees, changes the color of the leaves from green to yellow, adds ducks to the pond, changes the color of the vest of one of the pedestrians, removes the bird flying in the sky, and pixelates the area where the bird was removed. In this example, the authentication mechanism 122, via the evaluation module 126, creates a mask to place over the modified image to evaluate the user's response. In this example, the user is presented with the modified image and asked to identify changes in the modified image with respect to the uploaded park photo. When the user selects a portion of the modified image, via the evaluation module 126, the mask registers the user's response and a score is calculated using the received user response.

[0022] In various embodiments of the invention, the mask is invisible to the user and its purpose is to serve as an interactive component that the user can click on via the interface 106 to allow the evaluation module 126 to determine whether the user has correctly selected one or more modifications to the original image to prove / verify the user's prior knowledge of the image. In various embodiments of the invention, the authentication mechanism 122 prompts the user to select / identify a predetermined number / amount of changes in the modified media file. For example, the user is prompted to select at least three changes in the image.

[0023] In various embodiments of the present invention, the presentation component 128 displays the modified image and one or more open questions via the interface 106. For example, the presentation component 128 presents the modified image and a single open question, such as "identify the difference" or "select the change in the image" to the user via the interface 106. In this example, the presentation component 128 prompts the user to click "ok" to proceed. The difference in the modified image can be one or more differences from the original image. The presentation component 128 may record and send the user's interaction with the displayed one or more open questions to the given instance or evaluation module 126, where the evaluation module 126 performs step 2 (i.e., security image evaluation). The evaluation module 126 may then compare the user's response to the evaluation mask and calculate an evaluation score. In various embodiments of the present invention, multiple media files (original and / or manipulated) may be required in some cases to more accurately evaluate the user's response.

[0024] The presentation component 128 can determine how correct the user's response was to the challenge (i.e., the prompted question), and the correctness / accuracy of the user's response is based on a predefined threshold. In various embodiments of the present invention, the predefined threshold can be defined by the user during setup or whenever the user desires through user settings. When determining the correctness of the user's response, the presentation component 128 can take into account the order of the selected objects and the length of time it took to respond.

[0025] In various embodiments of the present invention, the authentication mechanism 122 broadcasts a predefined threshold of identification in a binary format to the website or mobile application. The user's status is either authenticated or not authenticated based on the calculated score of the user's one or more responses, and the user's status is transmitted to the website or mobile application with which the user is interacting, and the website processes the binary result to allow or deny access.

[0026] In various embodiments of the invention, the authentication mechanism 122 compares the image with the identified differences to create a puzzle to prevent fraud, where the puzzle may be a modified media file used to authenticate the user. In various embodiments of the invention, the authentication mechanism 122 adjusts the media file according to a user set of preferences and access rights settings, for example, changing the colors of the image for a color-blind user. The presentation of the image may be timed, thereby adjusting the time allotted to the user to identify the differences in the modified data file, allowing for the allotted time to be longer or shorter. In some embodiments, the time allotted to the user to identify the differences in the manipulated media file is predetermined.

[0027] In various embodiments of the present invention, the authentication mechanism 122, via a camera component not depicted in Figure 1, performs eye tracking to identify what the user is looking at in order to correlate the user's visual patterns with the user's selections. The authentication mechanism 122 identifies and analyzes the items / areas of the media file that the user spent time viewing and the items / areas that the user selected to determine a score.

[0028] Figure 2 is a diagram of operational steps of an authentication mechanism 122, generally designated 200, in communication with a computing device 110 in the distributed data processing environment 100 of Figure 1 for multi-factor authentication, according to an embodiment of the present invention. Figure 2 provides an illustration of one implementation and is not intended to imply any limitation with respect to the environments in which different embodiments may be implemented. Many modifications may be made to the depicted environment by one of ordinary skill in the art without departing from the scope of the present invention as set forth in the claims.

[0029] In step 202, the authentication mechanism 122 receives the user's media files. In various embodiments of the present invention, the authentication mechanism 122 receives one or more media files from the user or retrieves one or more media files from the local storage 104 or the shared storage 124 or both. For example, a new user on a social media site may register an account where the user is prompted to upload a security image and include metadata such as time of year, location, city and country (e.g., Flinders Street Station, summer). In this example, the user uploads an image of a custom birthday cake that the user recently received. In various embodiments of the present invention, the authentication mechanism 122 issues a display prompt after a predetermined time (e.g., weeks, months, etc.) instructing the user to submit new / fresh media.

[0030] In step 204, the authentication mechanism 122 generates a GAN-modified media file. In various embodiments of the present invention, the authentication mechanism 122 generates one or more GAN-modified media files based on the received one or more user media files. Continuing with the above example, the user's account is subject to a security threat (e.g., an attempt is made to hack). In this example, the authentication mechanism 122 is alerted to the security threat and triggered to perform multi-factor authentication. In this example, the authentication mechanism 122 searches the local storage 104 and / or shared storage 124 for the image (e.g., custom birthday cake) and metadata originally uploaded by the user, and identifies similar images from the internet of the same location, different angles, objects, people, and lighting. In various embodiments of the present invention, the authentication mechanism 122 edits the original image using a GAN-based image alteration model, including but not limited to changing objects, people, colors, lighting, age of people, changing walls, changing clothing and fashion in the original image. For example, changing the color of the frosting, changing the name on the cake, replacing the books on the shelves in the background with plants, reducing the number of candles, adding a photo to the wall behind the cake, and changing the candles and lighting in the room.

[0031] In step 206, the authentication mechanism 122 generates an evaluation mask. In various embodiments of the invention, the authentication mechanism 122 performs a pixel-by-pixel comparison between the original media file and the GAN-modified media file (e.g., the modified media file). The authentication mechanism 122 may identify areas that differ between the original media file and the modified media file based on the pixel comparison and label the identified areas of difference as "differences." Based on the identified "differences," the authentication mechanism 122 overlays one or more masks from the differences, where the one or more masks are evaluation points. In various embodiments of the invention, the authentication mechanism 122 creates one or more scoring grids by comparing the original image to a GAN-modified version of the image, identifies difference pixels between the original image and the modified image, and overlays masks over the identified "differences."

[0032] At step 208, authentication mechanism 122 displays the modified media files to the user. In various embodiments of the invention, authentication mechanism 122 displays one or more modified media files with a mask overlay to the user via interface 106. Continuing with the example above, authentication mechanism 122 displays the modified image with an evaluation mask (i.e., mask) overlay to the hacker.

[0033] In step 210, the authentication mechanism 122 issues a responsive display prompt to the user. In various embodiments of the present invention, the authentication mechanism 122 issues one or more responsive display prompts to the user, where the responsive display prompts are displayed to the user via the interface 106. Continuing with the above example, upon displaying the modified image with the mask overlay to the hacker (i.e., user), the authentication mechanism 122 issues a responsive prompt instructing the hacker to identify items in the modified image by either tapping, drawing, or clicking on the items, or a combination thereof, depending on the type of computing device the hacker is using. In various embodiments of the present invention, the authentication mechanism 122 leverages HoloGAN (i.e., GAN) to enable conversion of 2D images to 3D images by adding depth to the original media file, allowing the user to rotate the angle of the media file (e.g., the modified image) to select items positioned (e.g., items that are behind other objects). User selection (i.e., selection) may also be made by first selecting a depth plane based on the responsive prompt and then tapping on a given object in the selected plane of the media file.

[0034] In step 212, authentication mechanism 122 compares the received user response information (i.e., the user selection) to the assessment mask. In various embodiments of the invention, authentication mechanism 122 compares the user selection to the assessment mask in order to calculate an assessment score. For example, continuing with the above example, when authentication mechanism 122 receives the hacker's selection, authentication mechanism 122 compares the received selection to the generated mask to identify whether the hacker identified the correct area on the modified image. In various embodiments of the invention, multiple media files (original and / or manipulated) may be required in some cases to more accurately assess the user.

[0035] In step 214, the authentication mechanism 122 calculates a reputation score based on the user's response. In various embodiments of the present invention, the authentication mechanism 122 calculates a reputation score based on a comparison of the received user response to a reputation mask. In some embodiments of the present invention, the authentication mechanism 122 calculates a reputation score based on a comparison of the response from the user to the reputation mask to verify the response from the user. In various embodiments of the present invention, the authentication mechanism 122 calculates a score from multiple attempts to consider a successful identity, where the multiple attempts include multiple media files, where the multiple media files are different media files or the same media file with different modifications, or both. In various embodiments of the present invention, the authentication mechanism 122 calculates a reputation score based on multiple response attempts from the user to verify the user's identity, where the multiple response attempts are based on multiple security prompts, where each response attempt uses a different modified image selected from a multiple modified images.

[0036] In step 216, authentication mechanism 122 determines whether the user is authenticated. In various embodiments of the invention, authentication mechanism 122 determines whether the user is authenticated based on the calculated reputation score. In various embodiments of the invention, authentication mechanism 122 broadcasts a binary authenticated or not authenticated decision to the platform to allow or deny the user access to data or other resources. If the user score is within or above a predefined threshold ("yes" step), authentication mechanism 122 validates and authenticates the user and proceeds to step 220. If the user score is below the predefined threshold ("no" step), authentication mechanism 122 may not validate the user and proceed to step 218.

[0037] In step 218, authentication mechanism 122 prompts the user to retry authentication. In various embodiments of the invention, authentication mechanism 122 denies the user access to data or other resources and prompts the user to retry authentication, where the prompt is a responsive prompt displayed via interface 106. In the depicted embodiment, authentication mechanism 122 may repeat steps 204-218 until the user is validated or until a predetermined number of attempts have been reached and the account is locked.

[0038] In step 220, authentication mechanism 122 grants the user access. In various embodiments of the invention, authentication mechanism 122 grants the user access to data or other resources based on the reputation score and authentication, where the reputation score meets or exceeds a predetermined threshold. In various embodiments of the invention, authentication mechanism 122 issues a survey prompt to assess the difficulty and accuracy of the modified media file and authentication process.

[0039] Figure 3 is a block diagram of components of a server computer 120 in the distributed data processing environment 100 of Figure 1 in accordance with an embodiment of the present invention. It should be understood that Figure 3 is merely provided as an example of one implementation and is not intended to imply any limitation with respect to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

[0040] FIG. 3 depicts a computer system 300, where the server computing 120 represents an example of a computer system 300 including an authentication mechanism 122. The computer system includes a processor 301, a cache 303, a memory 302, a persistent storage 305, a communication unit 307, an input / output (I / O) interface 306, a display 309, an external device 308, and a communication fabric 304. The communication fabric 304 provides communication between the cache 303, the memory 302, the persistent storage 305, the communication unit 307, and the input / output (I / O) interface 306. The communication fabric 304 can be implemented with any architecture designed to pass data and / or control information between the processor (such as a microprocessor, communication, and network processor), the system memory, the peripheral devices, and any other hardware components in the system. For example, the communication fabric 304 can be implemented using one or more buses or crossbar switches.

[0041] Memory 302 and persistent storage 305 are computer-readable storage media. In this embodiment, memory 302 includes random access memory (RAM). In general, memory 302 may include any suitable volatile or non-volatile computer-readable storage medium. Cache 303 is a high-speed memory that improves the performance of processor 301 by holding recently and very recently accessed data from memory 302.

[0042] Program instructions and data used to practice embodiments of the present invention may be stored in persistent storage 305 and memory 302 for execution via cache 303 by one or more of the individual processors 301. In an embodiment, persistent storage 305 includes a magnetic hard disk drive. As an alternative to, or in addition to, a magnetic hard disk drive, persistent storage 305 could include a solid state hard drive, a semiconductor storage device, a read only memory (ROM), an erasable programmable read only memory (EPROM), a flash memory, or any other computer readable storage medium capable of storing program instructions or digital information.

[0043] The media used by persistent storage 305 may also be removable. For example, a removable hard drive may be used for persistent storage 305. Other examples include optical and magnetic disks, thumb drives, and smart cards that are inserted into a drive for transfer to another computer-readable storage medium that is also part of persistent storage 305.

[0044] Communications unit 307, in these examples, provides for communication with other data processing systems or devices. In these examples, communications unit 307 includes one or more network interface cards. Communications unit 307 may provide communications through the use of either physical communications links, wireless communications links, or both. Program instructions and data used to practice embodiments of the present invention may be downloaded to persistent storage 305 via communications unit 307.

[0045] The I / O interface 306 allows for the input and output of data with other devices that may be connected to each computer system. For example, the I / O interface 306 may provide a connection to an external device 308, such as a keyboard, a keypad, a touch screen, or any other suitable input device or combination thereof. The external device 308 may also include a portable computer-readable storage medium, such as a thumb drive, a portable optical or magnetic disk, and a memory card. Software and data used to practice embodiments of the present invention may be stored on such a portable computer-readable storage medium and loaded into the persistent storage 305 via the I / O interface 306. The I / O interface 306 also connects to a display 309.

[0046] Display 309 provides a mechanism for displaying data to a user and may be, for example, a computer monitor.

[0047] The programs described herein are identified based on the applications for which they are implemented in specific embodiments of the invention, however, it should be understood that any particular program nomenclature herein is used merely as a matter of convenience, and thus the invention should not be limited to the use of any particular application identified and / or implied by such nomenclature.

[0048] The present invention may be a system, a method, or a computer program product, or a combination thereof. The computer program product may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0049] A computer readable storage medium may be any tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer readable storage media includes portable computer diskettes, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROMs or flash memories), static random access memories (SRAMs), portable compact disk read-only memories (CD-ROMs), digital versatile disks (DVDs), memory sticks, floppy disks, mechanically encoded devices such as punch cards or grooved structures having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as a transitory signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over electrical wires.

[0050] The computer readable program instructions described herein may be downloaded from a computer readable storage medium to an individual computing / processing device or to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface of each computing / processing device receives the computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the individual computing / processing device.

[0051] The computer readable program instructions for carrying out the operations of the present invention may be either source or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, or object oriented programming languages ​​such as Smalltalk, C++, and traditional procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partly on the user's computer as a standalone software package, partly on the user's computer and partly on a remote computer, or all on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or wide area network (WAN), or the connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), can execute computer readable program instructions to individualize the electronic circuitry by utilizing state information of the computer readable program instructions to perform aspects of the present invention.

[0052] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0053] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute on the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored on a computer readable storage medium having instructions stored thereon, directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer readable storage medium having the instructions stored thereon comprises an article of manufacture including instructions for implementing aspects of the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0054] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to produce a computer-implemented process and cause the computer, other programmable apparatus, or other device to perform a series of operational steps, such that the instructions, which execute on the computer, other programmable apparatus, or other device, implement the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0055] The flowcharts and block diagrams in the drawings (i.e., Figures) illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block of the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the drawings. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations or executes a combination of special-purpose hardware and computer instructions.

[0056] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the present invention. The terms used in this specification are selected to best explain the principles of the embodiments, practical applications, or technical improvements over the art found in the market, or to allow other skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A computer-implemented method for multi-factor authentication, comprising: generating an evaluation mask over one or more modifications on a modified image, the modified image being created by a generative adversarial network (GAN); creating a scoring grid by comparing an original image to the modified image to identify difference pixels between the original image and the modified image; overlaying the assessment mask onto the identified difference pixels on the modified image; displaying the modified image as a multi-factor authentication prompt to a user, wherein the user is prompted to provide a response identifying one or more modifications on the modified image; calculating an evaluation score based on a comparison of the response from the user to the evaluation mask to validate the response from the user; in response to the reputation score meeting or exceeding a predetermined threshold, authenticating the user and granting the user access to data or other resources; 4. A computer-implemented method comprising:

2. The comparison of the response from the user to the assessment mask comprises: comparing pixels in the original image with pixels in the modified image in relation to the response from the user; The computer-implemented method of claim 1 , comprising:

3. generating the modified image from the original image by the GAN; and generating the modified image further comprises: Editing the original image, the editing including at least one of changing objects, people, colors, lighting, age of people, changing walls, changing clothes and fashion in the original image.

3. The computer-implemented method of claim 1, comprising:

4. Displaying the modified image to the user as a multi-factor authentication prompt includes: issuing a responsive prompt instructing the user to identify the one or more modifications or areas in the modified image by tapping, drawing, or clicking on the one or more modifications or areas in the modified image. The computer-implemented method of any one of claims 1 to 3, further comprising:

5. calculating the assessment score based on a plurality of response attempts from the user to verify the identity of the user, the plurality of response attempts being based on a plurality of security prompts, each of the security prompts using a different modified image selected from a plurality of modified images; The computer-implemented method of any one of claims 1 to 4, further comprising:

6. Calculating the evaluation score based on the comparison includes: comparing the responses from the user with an evaluation mask with respect to one or more modifications to the original image; The computer-implemented method of any one of claims 1 to 5, further comprising:

7. determining, once the user is authenticated, based on the calculated reputation score, if the reputation score is within or above a predetermined threshold, a binary authentication decision is broadcast to a platform to allow the user access to the data or other resources; The computer-implemented method of any one of claims 1 to 6, further comprising:

8. A computer program for causing a computer to execute the computer-implemented method described in any one of claims 1 to 7.

9. A computer-readable storage medium storing the computer-executable program of claim 8.

10. 1. A computer system for multi-factor authentication, the computer system comprising: one or more computer processors; one or more computer readable storage devices; program instructions stored in said one or more computer readable storage devices for execution by at least one of said one or more computer processors; the stored program instructions comprising: program instructions for generating an evaluation mask over one or more modifications on a modified image, the modified image being created by a generative adversarial network (GAN); program instructions for creating a scoring grid by comparing an original image to the modified image to identify difference pixels between the original image and the modified image; program instructions for overlaying the assessment mask onto the identified difference pixels on the modified image; program instructions for displaying the modified image to a user as a multi-factor authentication prompt, wherein the user is prompted to provide a response identifying one or more modifications on the modified image; program instructions for calculating a rating score based on a comparison of the response from the user to the rating mask to validate the response from the user; and program instructions for authenticating the user and granting the user access to data or other resources in response to the reputation score meeting or exceeding a predetermined threshold.

1. A computer system comprising:

11. The comparison of the response from the user to the assessment mask comprises: comparing pixels in the original image with pixels in the modified image in relation to the response from the user; 11. The computer system of claim 10, comprising:

12. program instructions for generating the modified image from the original image by the GAN and wherein the program instructions for generating the modified image further include: program instructions for editing the original image, the editing including at least one of changing objects, people, colors, lighting, age of people, changing walls, changing clothes and fashion in the original image.

12. A computer system according to claim 10 or 11, comprising:

13. Displaying the modified image to the user as a multi-factor authentication prompt includes: issuing a responsive prompt instructing the user to identify the one or more modifications or areas in the modified image by tapping, drawing, or clicking on the one or more modifications or areas in the modified image. The computer system of any one of claims 10 to 12, further comprising:

14. program instructions for calculating the reputation score based on a plurality of response attempts from the user to verify the identity of the user, the plurality of response attempts being based on a plurality of security prompts, each of the security prompts using a different modified image selected from a plurality of modified images; The computer system of any one of claims 10 to 13, further comprising:

15. program instructions for comparing the responses from the user with an evaluation mask with respect to one or more modifications to the original image; program instructions for determining, once the user is authenticated, based on the calculated reputation score, where the reputation score is within or above a predetermined threshold and a binary authentication decision is broadcast to a platform to allow the user access to the data or other resources; The computer system of any one of claims 10 to 14, further comprising:

Images