Automated Speech Recognition (ASR) is the process of transcribing digitized acoustic information into digitized phonemes and words. These technologies have lunged forward in recent years. The confluence of better algorithms and less costly implementations have resulted in high accuracy and convenience never before experienced. The use of these technologies in user authentication has been limited.
ASR technologies digitize what was said, but don’t determine who said it. By itself, ASR can’t identify a a remote online user. For instance, a user logging in from a browser might be prompted to say “Palo Alto, California”. Just about any English speaking individual can answer the prompt correctly and have the sounds transcribed correctly.
To apply ASR to authentication OOB communications can be added as a second factor. For instance, an SMS can be sent containing the prompt instructing the user to say “Palo Alto, California”. Conscientious users that keep track of their cellular devices can use this sort of system to secure account access.
The combination of ASR and OOB communications doesn’t deter the malicious insider. When they receive the SMS, they can simply pass the information to a coconspirator.
In combination with Voice Recognition, ASR can help identify the user is responding to a specific prompt. Sovay uses randomly selected words and then applies both ASR and Voice Recognition to determine what was said and who said it. Sovay uses OOB communications for the prompt to further frustrate the hacker. Sovay also requests the user answer a prompt whose answer is only known to the authenticating user and applies ASR and Voice recognition to the total response.
The Veritrix Multichannel, Multifactor Authentication includes Audio/Visual (A/V) speech recognition, voice recognition, face recognition, OOB communications and a random phrase unique to the login attempt. The use of face recognition insures the malicious insider knows they are identified as they speak. The use of speech recognition insures no copies are accepted.
These and other implementation details insure it’s the user and only the user.
