Biometric authentication

• US 20040015243A1
• Filed: 04/04/2003
• Published: 01/22/2004
• Est. Priority Date: 09/28/2001
• Status: Abandoned Application

• Current Assignee: Imprivata Incorporated
• Original Assignee: Imprivata Incorporated
• Inventors: Mercredi, Dwyane, Jensen, Gregory C., Frey, Rod
• Application Number:
  US10/398,360
• Publication Number:
  US 20040015243A1
• Time in Patent Office: Days
• US Class Current: 700/17
• CPC Class Codes: G05B 2219/24162 Biometric sensor, fingerprint as user access password
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition

Abstract

An apparatus, method and program product locally stores biometric data in response to a user accessing a network (38). Local storage of the biometric data allows the user to biometrically access a local computer (20) in the absence of a network connection (18) and/or submitted ID.

Claims

6. The method according to clam 5, further comprising granting the privileged user access to the computer in response to determining a match between the capture BIR data and the stored-copy of the enrollment BIR data.

34. A method of biometrically controlling a user'"'"'s access to information retrievable via a computer, wherein the user normally has to provide at the computer both an ID and capture BIR data to gain access to the information, further comprising:

after storing a copy of enrollment BIR data, on a subsequent attempt by the accessing user to gain access to the information, causing the user to provide the capture BIR data to the computer without providing the ID; and

evaluating the capture BIR data against the stored enrollment BIR data to determine whether the user is to be given access to the information.

35. The method according to claim 34, further comprising granting the user access to the information in response to determining a match between the capture BIR data and the stored copy of the enrollment BIR data.

36. The method according to claim 34, further comprising associating the enrollment BIR data with the ID.

37. The method according to claim 34, further comprising retrieving the ID in response to receiving the capture BIR data.

38. The method according to claim 34, further comprising associating the enrollment BIR data with the password.

39. The method according to claim 34, further comprising retrieving the ID in response to receiving the capture BIR data.

40. The method according to claim 34, further comprising verifying the computer is configured to allow access to the user absent the ID.

41. The method according to claim 34, further comprising determining a preferred biometric login device.

42. The method according to claim 41, wherein the preferred biometric enrollment device is determined according to a machine setting.

43. The method according to claim 34, further comprising determining whether the preferred biometric enrollment device is available on the computer.

44. The method according to claim 34, further comprising determining if the computer is configured to allow access using the preferred biometric enrollment device absent the ID.

45. The method according to claim 34, further comprising causing the user to provide the ID in response to the preferred biometric enrollment device being unavailable.

46. The method according to claim 34, further comprising determining a second preferred biometric enrollment device.

47. The method according to claim 34, further comprising encrypting the ID.

48. The method according to claim 34, further comprising storing the ID of the accessing user for later recall.

49. An apparatus, comprising:

a memory;

a database resident within the memory, the database storing enrollment BIR data retrieved from a network and correlated with a privileged user;

a program configured to prompt an accessing user to provide capture BIR data to the computer and the computer to communicate with the network; and

initiates an evaluation of the capture BIR data with the enrollment BIR data to determine whether an accessing user is to be given access to the network as the privileged user via the computer, and if so, configured to thereafter store a copy of the enrollment BIR data in the database for later use.

1. A method of biometrically controlling a user'"'"'s access to a computer adapted to communicate with a network having at least one server associated therewith, comprising:

storing at the server, enrollment BIER data correlated with a privileged user;

causing an accessing user to provide capture BIR data to the computer and causing the computer to communicate with the server via the network; and

evaluating the capture BIR data with the enrollment BIR data to determine whether the accessing user is to be given access to the network as the privileged user via the computer, and if so, thereafter storing a copy of the enrollment BIR data in the computer for later use.

2. The method according to claim 1, further comprising retrieving the enrollment BIR from the server.

3. The method according to claim 1, further comprising encrypting the enrollment BIR data at the computer.

4. The method according to claim 1, further comprising encrypting the enrollment BIR data at the server.

5. The method of claim 1, further comprising:

after storing the copy of the enrollment BIR data at the computer, and thereafter, while the computer is not communicating with the network, causing the accessing user to provide the captured BIR data to the computer; and

evaluating the capture BIR data and the stored copy of the enrollment BIR data to determine whether the accessing user is to be given access to the computer as the privileged user.

7. The method according to claim 5, further comprising storing at the computer an ID of at least one previous user of the computer.

8. The method according to claim 7, further comprising storing the enrollment BIR data in such a manner as to be associated with the ID stored on the computer.

9. The method according to claim 5, further comprising storing at the computer a password of at least one previous user of the computer.

10. The method according to claim 9, further comprising storing the enrollment BIR data in such a manner as to be associated with the password stored on the computer.

11. The method according to claim 7, further comprising displaying the ID to the accessing user.

12. The method of according to claim 11, further comprising enabling the accessing user to select the displayed ID.

13. The method of according to claim 12, further comprising retrieving the enrollment BIR data associated with the accessing user in response to the selected ID.

14. The method according to claim 12, further comprising associating a preferred BIR device with the selected ID.

15. The method according to claim 14, further comprising associating the preferred BIR device with the accessing user.

16. The method according to claim 14, further comprising verifying the availability of the preferred BIR device on the computer.

17. The method according to claim 14, further comprising prompting the user to enter the password in response to the preferred BIR device being unavailable.

18. The method according to claim 14, further comprising selecting the preferred BIR device according to a setting selected from a group consisting of:

user, computer, global, and some combination thereof.

19. The method of claim 1, wherein the accessing user normally has to provide at the computer an ID and the capture BIR data to access the network, further comprising:

after storing the copy of the enrollment BIR data, on a subsequent attempt by the accessing user to gain access via the network, causing the accessing user to provide the capture BIR data to the computer without providing the ID; and

evaluating the capture BIR data against the stored enrollment BIR data to determine whether the accessing user is to be given access to the computer as the privileged user.

20. The method according to claim 19, further comprising granting the privileged user access to the computer in response to determining a match between the capture BIR data and the stored copy of the enrollment BIR data.

21. The method according to claim 19, further comprising associating the enrollment BIR data with the ID.

22. The method according to claim 21, further comprising retrieving the ID in response to receiving the capture BIR data.

23. The method according to claim 19, further comprising associating the enrollment BIR data with the password.

24. The method according to claim 23, further comprising retrieving the ID in response to receiving the capture BIR data.

25. The method according to claim 19, further comprising verifying the computer is configured to allow access to the privileged user absent the ID.

26. The method according to claim 19, further comprising determining the preferred biometric login device.

27. The method according to claim 26, wherein the preferred biometric enrollment device is determined according to the machine setting.

28. The method according to claim 26, further comprising determining whether the preferred biometric enrollment device is available on the computer.

29. The method according to claim 26, further comprising determining if the computer is configured to allow access using the preferred biometric enrollment device absent the ID.

30. The method according to claim 29, further comprising causing the user to provide the ID in response to the preferred biometric enrollment device being unavailable.

31. The method according to claim 29, further comprising determining a second preferred biometric enrollment device.

32. The method according to claim 19, further comprising scrambling the ID.

33. The method according to claim 19, further comprising storing the ID of the accessing user for later recall.

50. The apparatus according to claim 49, wherein the database maintains an ID associated with the enrollment BIR data.

51. The apparatus according to claim 49, wherein the database maintains a password associated with the enrollment BIR data.

52. The apparatus according to claim 49, wherein the program initiates retrieving the enrollment BIR from the network.

53. The apparatus according to claim 49, wherein the program initiates encrypting the enrollment BIR data at the computer.

54. The apparatus according to claim 49, wherein the program initiates encrypting the enrollment BR data at the server.

55. The apparatus according to claim 54, wherein the program grants the privileged user access to the computer in response to determining a match between the capture BIR data and the stored copy of the enrollment BIR data.

56. The apparatus according to claim 54, wherein the program initiates storage at the computer of an ID of at least one previous user of the computer.

57. The apparatus according to claim 54, wherein the program initiates storage of the enrollment BIR data in such a manner as to be associated with the ID stored on the computer.

58. The apparatus according to claim 51, wherein the program initiates storage at the computer of the password of at least one previous user of the computer.

59. The apparatus according to claim 51, wherein the program initiates storing the enrollment BIR data in such a manner as to be associated with the password stored on the computer.

60. The apparatus according to claim 56, wherein the program initiates displaying the ID to the accessing user.

61. The apparatus according to claim 60, wherein the program enables the accessing user to select the displayed ID.

62. The apparatus according to claim 60, wherein the program initiates retrieval of the enrollment BIR data associated with the accessing user in response to the selected ID.

63. The apparatus according to claim 60, wherein the program initiates associating a preferred BIR device with the selected ID.

64. The apparatus according to claim 63, wherein the program initiates associating the preferred BIR device with the accessing user.

65. The apparatus according to claim 63, wherein the program initiates verifying the availability of the preferred BIR device on the computer.

66. The apparatus according to claim 63, wherein the program initiates prompting the user to enter the password in response to the preferred BIR device being unavailable.

67. The apparatus according to claim 63, wherein the program initiates selecting the preferred BIR device according to a setting selected from a group consisting of:

user, computer, global, and some combination thereof.

68. The apparatus according to claim 49, wherein the accessing user normally has to provide at the computer both an ID and the capture BIR data to access the network, after initiating storage of the enrollment BIR data and on a subsequent attempt by the accessing user to gain access via the network, the program causes the accessing user to provide the capture BIR data to the computer without providing the ID;

and causes the evaluation of the capture BIR data against the stored enrollment BIR data to determine whether the accessing user is to be given access to the computer as the privileged user.

69. The apparatus according to claim 68, wherein the program initiates granting the privileged user access to the computer in response to determining a match between the capture BIR data and the stored copy of the enrollment BIR data.

70. The apparatus according to claim 68, wherein the program initiates associating the enrollment BIR data with the ID.

71. The apparatus according to claim 68, wherein the program initiates retrieving the ID in response to receiving the capture BIR data.

72. The apparatus according to claim 68, wherein the program initiates associating the enrollment BIR data with the password.

73. The apparatus according to claim 68, wherein the program initiates retrieving the ID in response to receiving the capture BIR data.

74. The apparatus according to claim 68, wherein the program initiates verifying the computer is configured to allow access to the privileged user absent the ID.

75. The apparatus according to claim 68, wherein the program initiates determining the preferred biometric login device.

76. The apparatus according to claim 75, wherein the preferred biometric enrollment device is determined according to the machine setting.

77. The apparatus according to claim 75, wherein the program initiates determining whether the preferred biometric enrollment device is available on the computer.

78. The apparatus according to claim 75, wherein the program initiates determining if the computer is configured to allow access using the preferred biometric enrollment device absent the ID.

79. The apparatus according to claim 78, wherein the program initiates causing the user to provide the ID in response to the preferred biometric enrollment device being unavailable.

80. The apparatus according to claim 68, wherein the program initiates determining a second preferred biometric enrollment device.

81. The apparatus according to claim 68, wherein the program initiates encryption of the ID.

82. The apparatus according to claim 68, wherein the program initiates storing the ID of the accessing user for later recall.

54-1. The apparatus according to claim 49, wherein after storing the copy of the enrollment BIR data at the computer, and thereafter, while the computer is not communicating with the network, the program further causes the accessing user to provide the captured BIR data to the computer;

and initiates the evaluation of the capture BIR data and the stored copy of the enrollment BIR data to determine whether the accessing user is to be given access to the computer as the privileged user.

83. An apparatus for biometrically controlling access of a user to information retrievable via a computer, wherein the user normally has to provide at the computer both an D) and capture BIR data to gain access to the information, comprising:

a memory;

a database resident within the memory, the database storing enrollment BIR data correlated with a privileged user;

a program configured to, after storing a copy of enrollment BIR data and on a subsequent attempt by the accessing user to gain access to the information, cause the user to provide the capture BIR data to the computer without providing the ID; and

to initiate an evaluation of the capture BIR data against the stored enrollment BIR data to determine whether the user is to be given access to the information.

84. The apparatus of claim 83, wherein the program grants the user access to the information in response to determining a match between the capture BIR data and the stored copy of the enrollment BIR data.

85. A program product, comprising:

a program configured to prompt an accessing user to provide capture BIR data to a computer, wherein memory of the computer stores enrollment BIR data retrieved from a network and correlated with a privileged user, and to cause the computer to communicate with the network; and

further to initiate an evaluation of the capture BIR data with the enrollment BIR data to determine whether an accessing user is to be given access to the network as the privileged user via the computer, and if so, configured to thereafter store a copy of the enrollment BIR data in the database for later use; and

a signal bearing medium bearing the program.

86. The program product of claim 85, wherein the signal bearing medium includes at least one of a recordable medium and a transmission medium.

87. A program product, comprising:

a program configured to cause an accessing user to provide capture BIR data to a computer without providing an ID, wherein a copy of an enrollment BIR data was stored on a previous attempt by the accessing user to gain access via a network, and to evaluate the capture BIR data against the stored enrollment BIR data to determine whether the accessing user is to be given access to the computer as the privileged user; and

a signal bearing medium bearing the program.

88. The program product of claim 87, wherein the signal bearing medium includes at least one of a recordable medium and a transmission medium.