Device type verification via motion-based attestation of users screen touch
Methods of verifying a genuine presence and identity of a user of a mobile device include analyzing a stream of data from sensors of the mobile device over a period spanning a user press of a button displayed on a touch screen of the device. Results of the analysis are used to distinguish a genuine user button press from a simulated event generated by device emulation software or other simulation tool. The presence and identity verification are determined in part by the results of the sensor stream analysis, optionally in conjunction with an analysis of biometric data captured by the mobile device when the press of a button on the device touch screen has been elicited. The biometric data may include capture of imagery of a user face or body part by a camera of the mobile device.
1. A method of verifying a device type associated with a purported touch-screen event, the method comprising:
receiving signals associated with the purported touch-screen event;
processing the signals to extract features of the signals that are informative as to the device type associated with the purported touch-screen event;
providing the extracted features of the signals to a machine learning classifier wherein the classifier has been trained on:
a set of touch events generated by human users touching a mobile device equipped with a built-in touch screen; and
a set of simulated touch events;
based at least in part on output from the classifier, determining whether the received signals were generated by a human user touching a given mobile device equipped with a built-in touch screen; and
when the received signals are determined to have been generated by a human user touching the given mobile device, issuing a verification that the device type associated with the purported user touch-screen event is a mobile device.
2. The method of claim 1 , wherein the signals associated with the purported user touch-screen event include sensor signals from a purported mobile device equipped with a built-in touch screen.
3. The method of claim 2 , wherein the sensor signals from the purported mobile device include signals from a purported accelerometer.
4. The method of claim 2 , wherein the sensor signals from the purported mobile device include signals from a purported gyroscope.
5. The method of claim 2 , wherein the sensor signals from the purported mobile device include signals from a purported magnetometer.
6. The method of claim 2 , wherein the sensor signals from the purported mobile device signals include signals from the built-in touch screen of the purported mobile device indicating a touch location.
7. The method of claim 2 , wherein the sensor signals from the purported mobile device signals include signals from the built-in touch screen of the purported mobile device indicating a touch radius.
8. The method of claim 2 , wherein the sensor signals from the purported mobile device signals include signals from the built-in touch screen of the purported mobile device indicating a touch tangential pressure.
9. The method of claim 2 , wherein the sensor signals from the purported mobile device signals include signals from the built-in touch screen of the purported mobile device indicating a touch rotation angle.
10. The method of claim 2 , wherein the sensor signals from the purported mobile device signals include signals from the built-in touch screen of the purported mobile device indicating a touch pressure change.
11. The method of claim 1 , wherein:
the set of touch events generated by human users touching a mobile device equipped with a built-in touch screen were generated by human users using software executing within a browser running on the mobile device; and
the received signals associated with the purported touch-screen event were output by a browser running on the given mobile device.
12. The method of claim 1 , wherein:
the set of touch events generated by human users touching a mobile device equipped with a built-in touch screen were generated by human users using an application executing natively on the mobile device; and
the received signals associated with the purported touch-screen event were output by an application executing natively on the given mobile device.
13. The method of claim 1 , wherein the received signals were captured over a period of time sufficient to capture user activity associated with the purported touch-screen event.
14. The method of claim 1 , wherein the machine learning classifier is a computational neural network.
15. The method of claim 1 , wherein the machine learning classifier is based on a set of heuristics.
16. The method of claim 1 , wherein the set of simulated touch events was generated at least in part by device emulation software.
17. The method of claim 1 , wherein the set of simulated touch screen events was generated at least in part by automation software executing in combination with device emulation software.
18. A method of verifying a presence of a user of a mobile device, the method comprising:
on the mobile device:
capturing imagery of the user using a camera built into the mobile device;
capturing signals from one or more motion sensors built into the mobile device, wherein the signals are captured during a temporal interval spanning a touch-screen event; and
sending the captured signals and the captured imagery to a remote server over a wide area network, wherein the remote server is configured to:
receive the captured signals and captured imagery;
process the captured signals to extract features of the signals that are informative as to a device type associated with the touch-screen event;
provide the extracted features of the signals to a machine learning classifier wherein the classifier has been trained to distinguish touch events generated by human users touching a mobile device equipped with a built-in touch screen from simulated touch screen events;
output from the classifier a determination with an associated confidence level that the touch-screen event was generated by a human user touching a mobile device equipped with a built-in touch screen;
analyze the captured imagery;
based at least in part on the confidence level output by the classifier and results of the analysis of the captured imagery, determine whether the touch-screen event was generated by a human user touching a mobile device equipped with a built-in touch screen; and
if a determination is made that touch-screen event was generated by a human user touching a mobile device equipped with a built-in touch screen, issue a verification that the touch-screen event was generated by a human user touching a mobile device equipped with a built-in touch screen and sending the verification to the mobile device;
if the verification is received from the remote server, enabling the user to proceed to a subsequent step of a transaction being performed on the mobile device; and
if the verification is not received from the remote server, barring the user from proceeding to the subsequent step of the transaction being performed on the mobile device.
19. A method of verifying a presence of a user of a mobile device, the method comprising:
on the mobile device:
capturing imagery of the user using a camera built into the mobile device;
capturing signals from one or more motion sensors built into the mobile device, wherein the signals are captured during a temporal interval spanning a touch-screen event;
processing the captured imagery to determine whether a human face is present; and
sending the captured signals to a remote server over a wide area network, wherein the remote server is configured to:
receive the captured signals;
process the captured signals to extract features of the signals that are informative as to a device type associated with the touch-screen event;
provide the extracted features of the signals to a machine learning classifier wherein the classifier has been trained to distinguish touch events generated by human users touching a mobile device equipped with a built-in touch screen from simulated touch screen events;
output from the classifier a determination with an associated confidence level that the touch-screen event was generated by a human user touching a mobile device equipped with a built-in touch screen;
based at least in part on the confidence level output by the classifier, determine whether the touch-screen event was generated by a human user touching a mobile device equipped with a built-in touch screen; and
if a determination is made that touch-screen event was generated by a human user touching a mobile device equipped with a built-in touch screen, issue a verification that the touch-screen event was generated by a human user touching a mobile device equipped with a built-in touch screen and sending the verification to the mobile device;
if the verification is received from the remote server and the processing of the captured imagery determined that the human face is present, enabling the user to proceed to a subsequent step of a transaction being performed on the mobile device; and
if the verification is not received from the remote server, barring the user from proceeding to the subsequent step of the transaction being performed on the mobile device.
20. A computer program product comprising:
a non-transitory computer-readable medium with computer-readable instructions encoded thereon, wherein the computer-readable instructions, when processed by a processing device instruct the processing device to perform a method of verifying a device type associated with a purported touch-screen event, the method comprising:
receiving signals associated with the purported touch-screen event;
processing the signals to extract features of the signals that are informative as to the device type associated with the purposed touch-screen event;
providing the extracted features of the signals to a machine learning classifier wherein the classifier has been trained on:
a set of touch events generated by human users touching a mobile device equipped with a built-in touch screen; and
a set of simulated touch events;
based at least in part on output from the classifier, determining whether the received signals were generated by a human user touching a mobile device equipped with a built-in touch screen; and
when the received signals are determined to have been generated by a human user touching a mobile device, issuing a verification that the device type associated with the purported user touch-screen event is a mobile device.
21. A system comprising:
a memory for storing computer-readable instructions; and
a processor connected to the memory, wherein the processor, when executing the computer-readable instructions, causes the system to perform a method of verifying a device type associated with a purported touch-screen event, the method comprising:
receiving signals associated with the purported touch-screen event;
processing the signals to extract features of the signals that are informative as to the device type associated with the purposed touch-screen event;
providing the extracted features of the signals to a machine learning classifier wherein the classifier has been trained on:
a set of touch events generated by human users touching a mobile device equipped with a built-in touch screen; and
a set of simulated touch screen events;
based at least in part on output from the classifier, determining whether the received signals were generated by a human user touching a mobile device equipped with a built-in touch screen; and
when the received signals are determined to have been generated by a human user touching a mobile device, issuing a verification that the device type associated with the purported user touch-screen event is a mobile device.