TECHNOLOGICAL FIELD

Example embodiments of the present disclosure relate generally to session authentication and, more particularly, to systems and methods for continuous session authentication.

BACKGROUND

Traditional security systems authenticate a user only once and thereafter re-authenticate the user only if the session has been abandoned or otherwise discontinued. For example, a user may use a client device to log into a server, after which the server will create a session ID for the user and store the session ID in the memory of the client device (e.g., as a cookie). While the session is active, the client device electronically transmits the session ID to the server with each request. The server receives the session ID from the client device and compares the received session ID with the session ID stored in the memory of the server to authenticate the user's identity. If the session has been inactive for a certain amount of time (e.g., 30 minutes), the server may terminate the session and require the user to use the client device to log in to the server again, after which the server will create a new session ID for the user and store the new session ID in the memory of the client device. Applicant has identified many deficiencies and problems associated with these existing security systems. Through applied effort, ingenuity, and innovation, many of these identified deficiencies and problems have been solved by developing solutions that are in accordance with the embodiments of the present disclosure, many examples of which are described in detail herein.

BRIEF SUMMARY

Computing systems, computing apparatuses, computer-implemented methods, and computer program products are disclosed herein for providing continuous session authentication and monitoring. The continuous session authentication system provided herein solves the above problems by: initiating an authentication state in response to receiving a request to authenticate a session for a user of a client device; authenticating the session; switching to a monitoring state in response to authenticating the session; detecting a re-authentication trigger event based on motion data generated during the monitoring state; switching back to the authentication state in response to detecting the re-authentication trigger event; and re-authenticating the session.

In one example embodiment, a computing system is provided for continuous session authentication and monitoring. The computing system may comprise session authentication circuitry configured to authenticate, at a first time, a session for a user of a client device based on an authentication image data structure and a plurality of first video frames captured before the first time. The computing system may further comprise video monitoring circuitry in communication with the session authentication circuitry. The video monitoring circuitry may be configured to extract sample data from a monitor region for each of a plurality of second video frames captured after the first time. The video monitoring circuitry may be further configured to generate motion data based on the extracted sample data. The video monitoring circuitry may be further configured to detect, at a second time, a re-authentication trigger event based on the motion data. The session authentication circuitry may be further configured to re-authenticate the session based on the authentication image data structure and a plurality of third video frames captured after the second time.

In another example embodiment, a computing system is provided for continuous session authentication and monitoring. The computing system may comprise session authentication circuitry in communication with a client device and a user profile server device. The session authentication circuitry may be configured to receive, from the client device at a first time, a session authentication request data structure indicative of a request to authenticate a session for a user of the client device. The session authentication circuitry may be further configured to retrieve, from the user profile server device, an authentication image data structure associated with the user. The authentication image data structure may have been captured before the first time. The session authentication circuitry may be further configured to authenticate, at a second time after the first time, the session based on the authentication image data structure and a first video data structure. The computing system may further comprise video monitoring circuitry in communication with the session authentication circuitry. The video monitoring circuitry may be configured to generate the first video data structure in response to receipt of the session authentication request data structure by the session authentication circuitry. The first video data structure may comprise a first video stream captured over a first duration of time that begins after about the first time, and the first video stream may comprise a plurality of first video frames. The video monitoring circuitry may be further configured to generate a second video data structure in response to authentication of the session by the session authentication circuitry. The second video data structure may comprise a second video stream captured over a second duration of time that begins after about the second time, and the second video stream may comprise a plurality of second video frames. The video monitoring circuitry may be further configured to determine a monitor region for each of the plurality of second video frames. The video monitoring circuitry may be further configured to extract sample data from the monitor region for each of the plurality of second video frames. The video monitoring circuitry may be further configured to generate motion data based on the sample data. The video monitoring circuitry may be further configured to detect, at a third time after the second time, a re-authentication trigger event based on the motion data. The video monitoring circuitry may be further configured to generate a third video data structure in response to detection of the re-authentication trigger event. The third video data structure may comprise a third video stream captured over a third duration of time that begins after about the third time, and the third video stream may comprise a plurality of third video frames. The session authentication circuitry may be further configured to re-authenticate, at a fourth time after the third time, the session based on the authentication image data structure and the third video data structure.

In another example embodiment, a computing apparatus is provided for continuous session authentication and monitoring. The computing apparatus may comprise session authentication circuitry configured to authenticate, at a first time, a session for a user of a client device based on an authentication image data structure and a plurality of first video frames captured before the first time. The computing apparatus may further comprise video monitoring circuitry in communication with the session authentication circuitry. The video monitoring circuitry may be configured to extract sample data from a monitor region for each of a plurality of second video frames captured after the first time. The video monitoring circuitry may be further configured to generate motion data based on the extracted sample data. The video monitoring circuitry may be further configured to detect, at a second time, a re-authentication trigger event based on the motion data. The session authentication circuitry may be further configured to re-authenticate the session based on the authentication image data structure and a plurality of third video frames captured after the second time.

In another example embodiment, a computing apparatus is provided for continuous session authentication and monitoring. The computing apparatus may comprise session authentication circuitry in communication with a client device and a user profile server device. The session authentication circuitry may be configured to receive, from the client device at a first time, a session authentication request data structure indicative of a request to authenticate a session for a user of the client device. The session authentication circuitry may be further configured to retrieve, from the user profile server device, an authentication image data structure associated with the user. The authentication image data structure may have been captured before the first time. The session authentication circuitry may be further configured to authenticate, at a second time after the first time, the session based on the authentication image data structure and a first video data structure. The computing apparatus may further comprise video monitoring circuitry in communication with the session authentication circuitry. The video monitoring circuitry may be configured to generate the first video data structure in response to receipt of the session authentication request data structure by the session authentication circuitry. The first video data structure may comprise a first video stream captured over a first duration of time that begins after about the first time, and the first video stream may comprise a plurality of first video frames. The video monitoring circuitry may be further configured to generate a second video data structure in response to authentication of the session by the session authentication circuitry. The second video data structure may comprise a second video stream captured over a second duration of time that begins after about the second time, and the second video stream may comprise a plurality of second video frames. The video monitoring circuitry may be further configured to determine a monitor region for each of the plurality of second video frames. The video monitoring circuitry may be further configured to extract sample data from the monitor region for each of the plurality of second video frames. The video monitoring circuitry may be further configured to generate motion data based on the sample data. The video monitoring circuitry may be further configured to detect, at a third time after the second time, a re-authentication trigger event based on the motion data. The video monitoring circuitry may be further configured to generate a third video data structure in response to detection of the re-authentication trigger event. The third video data structure may comprise a third video stream captured over a third duration of time that begins after about the third time, and the third video stream may comprise a plurality of third video frames. The session authentication circuitry may be further configured to re-authenticate, at a fourth time after the third time, the session based on the authentication image data structure and the third video data structure.

In another example embodiment, a computer-implemented method is provided for continuous session authentication and monitoring. The computer-implemented method may comprise authenticating, by session authentication circuitry at a first time, a session for a user of a client device based on an authentication image data structure and a plurality of first video frames captured before the first time. The computer-implemented method may further comprise extracting, by video monitoring circuitry, sample data from a monitor region for each of a plurality of second video frames captured after the first time. The computer-implemented method may further comprise generating, by the video monitoring circuitry, motion data based on the extracted sample data. The computer-implemented method may further comprise detecting, by the video monitoring circuitry at a second time, a re-authentication trigger event based on the motion data. The computer-implemented method may further comprise re-authenticating, by the session authentication circuitry, the session based on the authentication image data structure and a plurality of third video frames captured after the second time.

In another example embodiment, a computer-implemented method is provided for continuous session authentication and monitoring. The computer-implemented method may comprise receiving, by session authentication circuitry from a client device at a first time, a session authentication request data structure indicative of a request to authenticate a session for a user of the client device. The computer-implemented method may further comprise retrieving, by the session authentication circuitry from a user profile server device, an authentication image data structure associated with the user. The authentication image data structure may have been captured before the first time. The computer-implemented method may further comprise generating, by video monitoring circuitry, a first video data structure in response to receiving the session authentication request data structure by the session authentication circuitry. The first video data structure may comprise a first video stream captured over a first duration of time that begins after about the first time, and the first video stream may comprise a plurality of first video frames. The computer-implemented method may further comprise authenticating, by the session authentication circuitry at a second time after the first time, the session based on the authentication image data structure and the first video data structure. The computer-implemented method may further comprise generating, by the video monitoring circuitry, a second video data structure in response to authenticating the session by the session authentication circuitry. The second video data structure may comprise a second video stream captured over a second duration of time that begins after about the second time, and the second video stream may comprise a plurality of second video frames. The computer-implemented method may further comprise determining, by the video monitoring circuitry, a monitor region for each of the plurality of second video frames. The computer-implemented method may further comprise extracting, by the video monitoring circuitry, sample data from the monitor region for each of the plurality of second video frames. The computer-implemented method may further comprise generating, by the video monitoring circuitry, motion data based on the sample data. The computer-implemented method may further comprise detecting, by the video monitoring circuitry at a third time after the second time, a re-authentication trigger event based on the motion data. The computer-implemented method may further comprise generating, by the video monitoring circuitry, a third video data structure in response to detecting the re-authentication trigger event. The third video data structure may comprise a third video stream captured over a third duration of time that begins after about the third time, and the third video stream may comprise a plurality of third video frames. The computer-implemented method may further comprise re-authenticating, by the session authentication circuitry at a fourth time after the third time, the session based on the authentication image data structure and the third video data structure.

In another example embodiment, a computer program product is provided for continuous session authentication and monitoring. The computer program product may comprise at least one non-transitory computer-readable storage medium storing computer-executable program code instructions. The computer-executable program code instructions may, when executed by a computing apparatus, cause the computing apparatus to authenticate, by session authentication circuitry at a first time, a session for a user of a client device based on an authentication image data structure and a plurality of first video frames captured before the first time. The computer-executable program code instructions, when executed, may further cause the computing apparatus to extract, by video monitoring circuitry, sample data from a monitor region for each of a plurality of second video frames captured after the first time. The computer-executable program code instructions, when executed, may further cause the computing apparatus to generate, by the video monitoring circuitry, motion data based on the extracted sample data. The computer-executable program code instructions, when executed, may further cause the computing apparatus to detect, by the video monitoring circuitry at a second time, a re-authentication trigger event based on the motion data. The computer-executable program code instructions, when executed, may further cause the computing apparatus to re-authenticate, by the session authentication circuitry, the session based on the authentication image data structure and a plurality of third video frames captured after the second time.

In another example embodiment, a computer program product is provided for continuous session authentication and monitoring. The computer program product may comprise at least one non-transitory computer-readable storage medium storing computer-executable program code instructions. The computer-executable program code instructions may, when executed by a computing apparatus, cause the computing apparatus to receive, by session authentication circuitry from a client device at a first time, a session authentication request data structure indicative of a request to authenticate a session for a user of the client device. The computer-executable program code instructions, when executed, may further cause the computing apparatus to retrieve, by the session authentication circuitry from a user profile server device, an authentication image data structure associated with the user. The authentication image data structure may have been captured before the first time. The computer-executable program code instructions, when executed, may further cause the computing apparatus to generate, by video monitoring circuitry, a first video data structure in response to receipt of the session authentication request data structure by the session authentication circuitry. The first video data structure may comprise a first video stream captured over a first duration of time that begins after about the first time, and the first video stream may comprise a plurality of first video frames. The computer-executable program code instructions, when executed, may further cause the computing apparatus to authenticate, by the session authentication circuitry at a second time after the first time, the session based on the authentication image data structure and the first video data structure. The computer-executable program code instructions, when executed, may further cause the computing apparatus to generate, by the video monitoring circuitry, a second video data structure in response to authentication of the session by the session authentication circuitry. The second video data structure may comprise a second video stream captured over a second duration of time that begins after about the second time, and the second video stream may comprise a plurality of second video frames. The computer-executable program code instructions, when executed, may further cause the computing apparatus to determine, by the video monitoring circuitry, a monitor region for each of the plurality of second video frames. The computer-executable program code instructions, when executed, may further cause the computing apparatus to extract, by the video monitoring circuitry, sample data from the monitor region for each of the plurality of second video frames. The computer-executable program code instructions, when executed, may further cause the computing apparatus to generate, by the video monitoring circuitry, motion data based on the sample data. The computer-executable program code instructions, when executed, may further cause the computing apparatus to detect, by the video monitoring circuitry at a third time after the second time, a re-authentication trigger event based on the motion data. The computer-executable program code instructions, when executed, may further cause the computing apparatus t, generate, by the video monitoring circuitry, a third video data structure in response to detection of the re-authentication trigger event. The third video data structure may comprise a third video stream captured over a third duration of time that begins after about the third time, and the third video stream may comprise a plurality of third video frames. The computer-executable program code instructions, when executed, may further cause the computing apparatus to re-authenticate, by the session authentication circuitry at a fourth time after the third time, the session based on the authentication image data structure and the third video data structure.

The foregoing brief summary is provided merely for purposes of summarizing some example embodiments illustrating some aspects of the present disclosure. Accordingly, it will be appreciated that the above-described embodiments are merely examples and should not be construed to narrow the scope of the present disclosure in any way. It will be appreciated that the scope of the present disclosure encompasses many potential embodiments in addition to those summarized herein, some of which will be described in further detail below.

