Continuous User Authentication With Tiered Inference Models

The patent segments the user certification process into two distinct phases: a fast initial authentication phase using traditional methods (password, fingerprint, or simple facial recognition), and a subsequent continuous monitoring phase using lightweight algorithms. This segmentation allows the system to achieve high initial authentication accuracy while maintaining low resource consumption during ongoing monitoring, resolving the contradiction between accuracy and resource usage.

The patent implements dynamic algorithm selection based on operational context. The system switches between different authentication methods and depths of verification depending on the situation - using simple methods during normal operation and more rigorous verification only when suspicious behavior is detected or during initial login. This dynamic approach optimizes the balance between certification accuracy and resource consumption.

The patent merges multiple detection capabilities into a unified continuous monitoring system. It combines facial recognition with analysis of user behavior patterns, typing characteristics, application usage patterns, and temporal activity profiles. This combination maintains ease of operation (users simply continue working normally) while dramatically improving situation detection accuracy by analyzing multiple dimensions of user activity simultaneously.

The continuous monitoring system serves multiple functions simultaneously: it performs user identification, monitors for unauthorized access attempts, detects suspicious behavior patterns, and maintains security logs. This multi-functionality allows the system to handle various complex situations (password sharing, unauthorized users, abnormal usage patterns) with a single integrated solution, maintaining simplicity while improving detection capability.

The patent implements dynamic security responses based on the specific situation detected. Rather than a single lock-screen action, the system adapts its response according to the type of anomaly detected: it may lock the screen for unauthorized access attempts, send notifications for suspicious behavior patterns, alert administrators for potential data leakage scenarios, or simply log the event for later review. This dynamic response strategy maintains high security while providing flexible adaptation to different threat scenarios.

The system continuously monitors user activity and provides feedback through multiple channels: real-time alerts to users about detected anomalies, notifications to administrators for serious security concerns, and detailed logging for audit purposes. This feedback mechanism allows the system to respond appropriately to different situations while maintaining security, rather than relying solely on screen locking which may be overly restrictive or insufficient depending on the context.