LLM-Powered User Authentication System

Abstract

This invention relates to a user authentication system (1) supported by an LLM – Big Language Model, used in the field of security and access control on user devices (2). The invention presents an LLM / ML – Big Language Model / Machine Learning based "continuous validation" system (1) to replace existing static methods. The system (1) performs real-time analysis by integrating multiple data sources such as speech, writing style, gait, touch patterns, handprint, usage patterns, language, and keyboard attributes.

Description

1 TARIFF LLM-Powered User Authentication System Technical Area This invention is suitable for mobile devices, tablets, computers, and other customizable electronics. LLM – Large Language Model 5, used in the field of security and access control in devices. It relates to a supported user authentication system. State of the Art Today, static authentication methods such as fingerprint, facial recognition, and PIN are used for device security. These methods are common. For example, standard login and SMS OTP are two-step methods. Authentication methods include biometric authentication such as Apple Face ID or Samsung / Google fingerprint scanners. 10 In the field of behavioral biometric measurements, the concept of "continuous verification" has some implications. This has been addressed in studies and products: for example, Google's "Advanced Protection". The program, or Samsung's "Knox" platform, uses touch, walking, and other similar functions. It partially tracks patterns. ML-based systems, for example, track keyboard patterns with LSTM networks. The analysis has been used in academic literature and commercial products. The aforementioned 15 academics... The literature includes IEEE articles, while commercial products such as BehavioSec or BioCatch offer behavioral studies. Security software can be given as an example. LLMs, on the other hand, are integrated for speech analysis. This has been done. An example of speech analysis is Google Assistant's voice recognition feature. It can be shown. Patent application number US20200356695A1, which is included in the prior art, 20 The document describes ML-based continuous analysis using touchscreen patterns and gait data. Verification is explained. However, in the invention described in the relevant application document, LLM Integration and use of multiple data sources, such as speech and writing styles, are limited. Patent application number US11113375B2, which is included in the prior art. The document lists behavioral validation through keyboard and usage patterns as 25. This is mentioned. However, the invention described in the relevant application document includes items such as walking / handprints. Physical data is not integrated, and actions are limited to lockdown only. Patent application number US20220083639A1, which is included in the prior art. in the document, the concept of continuous validation for LLM-based speech analysis is used. However, in the invention described in the relevant application document, the device-based 30 2 continuous monitoring and customizable location reporting, documentation, and other action-taking capabilities. It lacks certain features. BehavioSec uses behavioral biometrics for banking applications and mobile apps like Zighra. Applications that perform ML-based continuous verification exist on devices. However, these It generally focuses on financial transactions and LLM integration for general device usage 5 They do not include. As mentioned above, current systems are generally limited to touch or walk-through. They rely on unique data sources and include static validation per session. They also consume high energy for continuous analysis. These structures utilize advanced models like LLM (Learning Locomotive) systems. Because of this, accuracy rates are insufficient in tasks such as speech / language analysis. 10 Actions are limited; for example, they only perform locking, and customization of these actions is not possible. This deficiency negatively impacts the user experience. However, in the scenario of detecting unauthorized use, rapid detection is crucial. Static methods Therefore, delayed detections are not providing sufficient benefit, and only ML-based, limited... Methods fed with numerous sources have high false positive / negative rates. 15 Current methods use multiple data points, such as a combination of gait and speech. The lack of integration reduces reliability, increasing risks such as theft and robbery. This increases the mortality rates in cases. In addition, current methods for children Under its control, there is manual oversight in controlling social media access. However, eliminating manual controls would allow for 20 automated actions. Providing these skills reduces the burden on parents. In conclusion, solutions that address the needs described above are relevant to the subject. Due to its shortcomings, it has become necessary to make improvements in the relevant technical field. Brief Description of the Invention The invention was created by drawing inspiration from existing situations and addressing the aforementioned drawbacks. 25 It aims to solve the problem. The purpose of this invention is to create IoT devices such as mobile devices, tablets, computers, and smartwatches. in the field of security and access control in other customizable electronic devices such as The emergence of a user authentication system supported by the LLM – Big Language Model. It is the placement. 30 3 The invention replaces existing static methods with LLM / ML – Large Language Model / Machine Learning. It offers a "continuous verification" system based on speech, writing style, gait, Multiple data types such as touch patterns, handprints, usage patterns, language, and keyboard attributes. It performs real-time analysis by integrating its resources. On my site, the models For speech / language analysis, a customized LLM is used, while for pattern recognition, an ML is used. 5 Examples of ML include CNN - Convolutional Neural Network and RNN - Recurrent Neural Network. The combination can be used. If the system detects unauthorized access, it will issue a warning. It triggers customizable actions such as locking and sending location. The structural and characteristic features and all the advantages of the invention are given in the figure below. Thanks to the detailed explanation written with references to the diagram, it is clearer than ever. 10 This will be understood, and therefore the evaluation should also take this detailed explanation into account. It must be done by taking it. A Shape That Will Help Understand the Invention Figure 1 is a schematic representation of the system that is the subject of the invention. Description of Part References 15 1. System 2. User device 3. Biometric sensor submodule 4. Behavioral pattern submodule 5. Data collection module 20 6. Artificial intelligence analysis and verification module 7. LLM integration submodule 8. ML model submodule 9. Action Module 10. Management interface module 25 11. Database 4 Detailed Description of the Invention In this detailed description, the preferred configurations of the system (1) that is the subject of the invention are only This is explained to facilitate a better understanding of the subject. This invention is used in mobile devices, tablets, computers, smartwatches, and IoT – the Internet of Things. Used in the field of security and access control in user devices (2), LLM 5 – It relates to a user authentication system (1) supported by the Big Language model. The system (1) measures the user's speech style, writing style, walking pattern, pressure level, speed, Fingerprint-like or handprint-like touch patterns on the touchscreen, app opening General usage patterns such as order, navigation habits, language preferences, and keystrokes. Multiple biometric and 10 keyboard usage attributes such as speed, errors, and intervals. By continuously analyzing behavioral data, it verifies the person using the device. It has a method. Gemini and similar LLM - Large Language Models or LSTM - Long Short-Term Memory or with Transformer-based ML - Machine Learning algorithm integration This supported "continuous verification" system (1) instantly alerts 15 when unauthorized use is detected. It takes actions such as issuing warnings, locking the device, sending location, and specific actions. notifying individuals, reporting, documenting with photos / videos or logging It is in this form. The system (1) can run as a mobile application, OS native - local like Android / iOS. It can be integrated with operating system software support or as a browser plugin. It is adaptable. Actions are managed by the user in the settings tab. It can be customized via the interface. System (1), theft, burglary prevention, unauthorized access detection, social media / internet such as parental / child control in the form of restrictions and corporate device security. It can be used in various scenarios. 25 The system (1) operates in the background and focuses on privacy with low energy consumption. Another In other words, data is processed locally or through secure cloud integration. The system (1) in similar scenarios, including but not limited to the following example scenarios. Available: Theft / Stealing: If the walking pattern does not match when the device (1) is stolen, the location It sends notifications to the parent in the form of sending messages and taking photos. Unauthorized Access: If the keyboard patterns detected on the office device change, the system (1) computer The locks log and / or report this situation. Child / Parental Control: Speech / language control while the child uses the social media app 5 If the analysis does not match the image analysis and sound analysis from the camera, the system (1) application It restricts usage and sends a notification to the parent. This notification is a push notification - instant message. Notifications are delivered via SMS – Short Message Service and similar methods. Corporate Security: If the font style on the computer changes, the system (1) will display a warning dialog, It sends the location and reports to the IT – Information Technology department. 10 Privacy: If differences in touch patterns are detected on the tablet computer, the system (1) It logs this situation and sends a silent alert to the user. This alert could be, for example, a low-level alert. It is in the form of action. The system, schematically shown in Figure 1 (1);  GPS, camera, microphone, speaker, touchscreen, speed / accelerometer (15 features) equipped with hardware, voice calling, messaging, mobile operating system and User device with third party applications (2),  Collects speech, gait, touch, and handprint data and uses this data to machine biometric sensor submodule (3) which pre-processes and filters with learning algorithm,  Tracks writing style, language, and keyboard usage attributes, analyzing data usage patterns. logging, analyzing data with machine learning and determining the data validation score Computational behavioral pattern submodule (4),  Speech / walking data via biometric sensor submodule (3) and Collecting writing / keyboard patterns via the behavioral pattern submodule (4), 25 by continuously monitoring the user device (2) hardware, creating a sensor data source data collection module (5),  Data is processed thanks to the LLM – Large Language Model and ML – Machine Learning infrastructure. AI-based analysis of the data received from the collection module (5) capable of performing, possessing agent-based artificial intelligence, sufficient processing power If found, the most advanced artificial intelligence logic will be used on the user device (2) 30 AI analysis and verification module (6) 6  edge user device on artificial intelligence analysis and verification module (6) (2) LLM – Big Language Model, which works locally or remotely depending on the source. It has an algorithm that is used for speech / language analysis and understands context. LLM integration submodule (7),  AI analysis and verification module (5) on the edge device source 5 Depending on whether they operate locally or remotely, RNN – Recurrent Neural Network and VMM – It has an ML – Machine Learning algorithm that includes Convolutional Neural Network methodology. ML model sub-base updated with federated learning for pattern recognition. module (8),  The analysis and verification logic of the artificial intelligence analysis and verification module (6) 10 triggers customizable actions for the user based on the results it produces. action module (9),  Action module (9) works on, manages user settings, and organizes actions Management interface module that customizes and provides reporting for users (10) and 15  receiving and storing data located on the user device (2), and providing this data when requested data collection module (5), artificial intelligence analysis and validation module (6) and action sharing log data generated by action module (9) with module (9) and data that holds the system (1) settings created by the management interface module (10) base (11) 20 It includes. In the system (1) the data collection module (5), biometric sensor submodule (3) speech / walking data and behavioral pattern submodule (4) It collects writing / keyboard patterns. The data collection module (5) uses artificial intelligence to collect the data it gathers. sends to the analysis and verification module (6). 25 Artificial intelligence analysis and validation module (6), LLM with local or cloud application context, audio, text, visual, video information to the integration submodule (7). It conducts a query in order to make sense of things. This query, for example, examines the person from the attributes of speech. recognition, person recognition from photos, person recognition from videos, correspondence and other patterns This is done so that everyone can get to know the person. 30 Artificial intelligence analysis and validation module (6) via LLM integration submodule (7); 7  the meanings of words, sentences, documents or texts Converted into long sequences of numbers so that they can be understood,  Large language models are accurate and up-to-date by obtaining information from external data sources. generating responses,  Using models trained with massive amounts of text data, original language similar to human language is created. Creating content, answers, summaries, or codes It is configured to perform its operations. The AI ​​analysis and validation module (6) uses agent-based methods to recognize specific patterns. Using its artificial intelligence capabilities, it refers to the ML model submodule (8) and the pattern Calculates the match. 10 If a pattern match is found, the AI ​​analysis and validation module (6) analyzes and The validation logic triggers actions based on the results it derives. It calls module (9). Action module (9) customizes actions on the hardware and software of the user device (2). It triggers through the Action Module (9), all software operation of the user device (2) 15 system features, all hardware such as camera, microphone, speaker, screen, calling It uses sensors and interfaces. These actions include, for example, locking, sound... recording, taking a screenshot, camera recording, audible alert These functions could include obtaining location from GPS, sending alarms, or simply generating logs. In addition, the action module (9) can also decide not to take any action if it deems it necessary. It is carrying out. One of the actions of the action module (9) is to log to the database (11). Action module (9), logging operation and reading or writing from database (11) For all situations requiring it, it connects to the database (11). Management interface module (10), all sensor and actionable interface and 25 It has the following hardware. Management interface module (10), user settings database (11) Updates via or reads from the database (11). Data collection module (5), artificial intelligence Analysis and verification module (6) and action module (9) are set as default. or according to the settings entered into the database (11) via the management interface module (10) They perform their functions. 30 8 Data collection module (5), AI analysis and validation module (6) and action module (9) has the authority to read from (11) the database and to write to (11) the database. has. The data collection module (5) performs all read and write operations with the database (11). It performs integration. Data collection module (5) reads 5 from the database (11) The system retrieves data, threshold values, and information about what to read from this database. (11) receives. Data collection module (5) has a read-only database in front of it for speed. (11) It can hold a cache. Artificial intelligence analysis and verification module (6), all configurations, model its parameters, data reduced from the whole and broken down into meaningful parts, data 10 in this flow It reads from (11) the base or writes to (11) the database. In another configuration of the invention, an MCP – Model between the AI ​​analysis and validation module (6) and the database (11) A content protocol server is available. The system (1) runs in the background. For example, the combination of walking data and speech is more It provides a high degree of accuracy. In addition, it also includes camera or audio data, 15 This increases accuracy to much higher levels. The invention works natively with mobile operating systems of the user device (2) such as Android / iOS, It can be installed as an application on mobile operating systems that do not support it, cloud servers, It can integrate with external systems such as email / SMS. The invention replaces existing static methods with LLM / ML – Big Language Model / Machine Learning 20 It offers a "continuous validation" system (1) based on speech, writing style, multiple attributes such as gait, touch patterns, handprint, usage patterns, language, and keyboard attributes It performs real-time analysis by integrating data sources. On my site (1), The models are customized for speech / language analysis (LLM) and pattern recognition (ML). It is used. For example, in ML, CNN - Convolutional Neural Network and RNN - 25 A combination of Recurrent / Recurrent Neural Networks can be used. The system (1) prevents unauthorized access. If it detects a problem, it can take customizable actions such as alerting, locking, or sharing its location. It triggers.

Claims

9 REQUESTS 1. GPS, camera, microphone, speaker, touchscreen, speed / accelerometer. hardware, voice calling, messaging, mobile operating system and third-party Users who have a device (2) with third-party applications (2) used in the field of security and access control in devices, LLM – Big Language 5 The model is a user authentication system (1) supported by;  Collects speech, gait, touch, and handprint data and uses this data to machine biometric sensor submodule (3) which pre-processes and filters with learning algorithm,  Tracks attributes such as writing style, language, and keyboard usage, and monitors data usage. logging patterns, analyzing data with machine learning and 10 out of the data behavioral pattern submodule that calculates the validation score (4),  Speech / walking data via biometric sensor submodule (3) and typing / keyboard patterns also via the behavioral pattern submodule (4) collecting sensor data by continuously monitoring the user device (2) hardware. Data collection module (5) which forms the source, 15  Data is processed thanks to the LLM – Large Language Model and ML – Machine Learning infrastructure. AI-based analysis of the data received from the collection module (5) capable of performing, possessing agent-based artificial intelligence, sufficient processing power If found, the most advanced artificial intelligence logic is also on the user device (2) AI analysis and validation module (6), 20  edge user device on artificial intelligence analysis and verification module (6) (2) LLM – Big Language Model, which works locally or remotely depending on the source. It has an algorithm that is used for speech / language analysis and context. LLM integration submodule (7),  AI analysis and verification module (5) on the edge device source 25 Depending on whether they operate locally or remotely, RNN – Recurrent Neural Network and VMM – ML – Machine Learning algorithm incorporating Convolutional Neural Network methodology ML, which has been updated with federated learning for pattern recognition. model submodule (8),  The analysis and verification logic of the artificial intelligence analysis and verification module (6) 30 customizable actions for the user based on the results obtained triggering action module (9),  Action module (9) works on, manages user settings, and organizes actions A management interface module that customizes and provides reporting for users. (10) and  receiving and storing data located on the user device (2), and providing this data when requested data collection module (5), artificial intelligence analysis and validation module (6) and 5 log created by action module (9) shared with action module (9) data and system (1) settings created by the management interface module (10) holding database (11) It includes.

2. The system mentioned in accordance with claim 1 is (1), and its feature is; person 10 from speech attributes. recognition, person recognition from photos, person recognition from videos, correspondence and other patterns LLM, whether a local or cloud application, is used so that all of them can recognize the person. context, audio, text, visual, video information to the integration submodule (7). AI analysis and verification module that queries to make sense of things (6) It includes. 15 3. The system mentioned in accordance with claim 1 is (1), and its feature is; LLM integration submodule. (7) over;  the meanings of words, sentences, documents or texts Converted into long sequences of numbers so that they can be understood,  Accurate and up-to-date 20 major language models are created by acquiring information from external data sources. generating responses,  Using models trained with massive amounts of text data, it creates language similar to human language. creating original content, answers, summaries, or code AI analysis and verification structured to perform these operations It includes module (6). 25 4. The system mentioned in accordance with claim 1 is (1), and its feature is to recognize certain patterns, Using agent-based artificial intelligence capability, refer to the ML model submodule (8) It does this and derives the analysis and verification logic that calculates the pattern match. artificial that calls the action module (9) to trigger actions based on results It includes an intelligence analysis and verification module (6). 30 11 5. The system mentioned in accordance with claim 1 is (1), and its feature is; customized actions triggered via the hardware and software of the user device (2), user device (2) all software operating system features, all hardware sensors and These actions, for example, using interfaces such as locking or recording audio, can be performed. taking a screenshot, recording with the camera, audible alert 5 The tasks include obtaining location from GPS, sending alarms, and generating logs. taking action in this manner and, if deemed necessary, preventing any action from being taken. It includes the action module (9) which performs the action.

6. The system mentioned in accordance with claim 1 is (1), and its feature is; logging operation and reading or Action module (9) connected to database (11) for all situations requiring writing 10 It includes.

7. The system mentioned in accordance with claim 1 is (1), and its feature is; user settings database (11) update via or read from the database (11) management interface It includes module (10).

Images