After this a "cognitive profile" is built up by monitoring preferences such as where windows are placed on the screen, how quickly the user actually uses the computer or mobile device, and what their typing or touch gesture patterns are.
Finally, the user's response patterns to a variety of "challenges" are measured.
"The system may introduce a bias which changes where the device thinks your finger is placed on the screen," explains Dr Allan. "It's very subtle and not enough for you to see, but enough for you to correct for it," he says.
Since different people correct for it in different ways, information about their responses to these hidden "challenges" can be added to their overall profile.
What's different about this type of authentication approach is that is uses "active" or "continuous" authentication. Rather than making authentication a single event, the system continues to monitor a user's characteristics and behaviour for as long as they are logged on.
"The benefit of this is that you get increased confidence that the user is who they say they are over time, and you also can also keep checking that the person using the system is the same person who logged on originally," explains Dr Allan.
A much simpler approach that could be suitable in some circumstances is to tie a user to a particular computer or mobile device, Dr Allan suggests.