Accelerating biometric login procedures

• US 20070136792A1
• Filed: 12/05/2005
• Published: 06/14/2007
• Est. Priority Date: 12/05/2005
• Status: Abandoned Application

• Current Assignee: Imprivata Incorporated
• Original Assignee: Imprivata Incorporated
• Inventors: Ting, David, Saulnier, Michael
• Application Number:
  US11/294,354
• Publication Number:
  US 20070136792A1
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints

Abstract

User authentication requests to computer systems are accelerated by selectively comparing user-provided biometric authentication credentials to a subset of credentials. If the user-supplied credential is not recognized, an alternate form of authentication is requested. Valid login events are used to update the subset such that subsequent authentication requests are handled in an expedited manner.

Claims

1. A method for authenticating a user to a computer system, the method comprising the steps of:

receiving a set of biometric authentication credentials;

receiving a biometric authentication credential attributed to the user;

comparing the received user biometric authentication credential to a subset of the set of valid biometric authentication credentials; and

requesting the user to provide an additional authentication credential if the received user biometric authentication credential does not match any of the valid authentication credentials in the subset.

2. The method of claim 1 wherein the set of biometric authentication credentials comprises one or more of fingerprints, retinal scans, facial scans, and voiceprints.

3. The method of claim 1 further comprising receiving an identifier associated with a computer.

4. The method of claim 3 wherein the identifier comprises one or more of a MAC address, an IP address and a digital signature of the computer.

5. The method of claim 3 wherein the subset is based on the identifier associated with the computer from which the biometric authentication credential was received.

6. The method of claim 1 wherein the computer system comprises one or more secure applications.

7. The method of claim 1 wherein the additional authentication credential comprises one or more of a user ID, a password, and a secure token.

8. The method of claim 1 further comprising authenticating the additional authentication credential.

9. The method of claim 8 further comprising granting access to the computer system based on the authenticated additional authentication credential.

10. The method of claim 8 further comprising adding the user biometric authentication credential to the subset.

11. The method of claim 10 wherein adding the user biometric authentication credential to the subset comprises creating an association between the user biometric authentication credential and an identifier associated with at least a computer from which the biometric authentication credential was received.

12. The method of claim 11 wherein the association facilitates a subsequent authentication of the user to the computer system using only the user'"'"'s biometric authentication credential.

13. The method of claim 10 wherein adding the user biometric authentication credential to the subset comprises creating an association between the user biometric authentication credential and an identifier associated with a computer other than a computer from which the biometric authentication credential was received.

14. The method of claim 1 further comprising receiving a usage history of the computer.

15. The method of claim 14 wherein the usage history of the computer comprises time-referenced data relating user authentication request to a timestamp.

16. The method of claim 14 wherein the subset is based on the usage history of the computer from which the biometric authentication credential was received.

17. The method of claim 14 further comprising removing the user biometric authentication credential from the subset.

18. The method of claim 1 wherein the computer is not associated with the computer system.

19. The method of claim 1 further comprising:

(a) expanding the subset to include additional valid biometric authentication credentials; and

(b) prior to requesting the user to provide an additional authentication credential, repeating the comparison.

20. The method of claim 19 further comprising repeating steps (a) and (b) until a time threshold is reached.

21. The method of claim 20 wherein the time threshold is configurable.

22. The method of claim 1 wherein the subset is based on a set of users having been granted physical access to a computer within the computer system.

23. A system for authenticating a user to a secure computer system, the system comprising:

a data storage module for storing a set of biometric authentication credentials;

a receiver for receiving a biometric authentication credential attributed to the user; and

an authentication module for;

comparing the received user biometric authentication credential to a subset of the biometric authentication credentials; and

requesting the user to provide one or more additional authentication credentials if the received user biometric authentication credential does not match any of the authentication credentials in the subset.

24. The system of claim 23 wherein the data storage module, receiver and authentication module reside on separate physical devices.

25. The system of claim 23 wherein the receiver is further configured to receive an identifier associated with the computer.

26. The system of claim 25 wherein the authentication module is further configured to create the subset based on the identifier associated with the computer.

27. The system of claim 23 wherein the receiver module is further configured to receive a usage history of the computer.

28. The system of claim 27 wherein the authentication module is further configured to create the subset based on the usage history of the computer.

29. The system of claim 23 wherein authentication module is further configured to authenticate the user to the computer system based on the additional authentication credential.

30. A system for authenticating a user to a secure computer system, the system being responsive to a biometric capture device and a server, and comprising an authentication agent residing on a computer in communication with a secure computer system, the agent being configured to:

receive one or more biometric authentication credentials from the capture device;

receive from the server a subset of a set of biometric authentication credentials representing users of the secure computer system;

compare the received biometric authentication credential to the subset; and

request the user to provide one or more additional authentication credentials if the received biometric authentication credential does not match any of the authentication credentials in the subset.

31. The system of claim 30 wherein the agent is further configured to receive an identifier associated with the computer and transmit the identifier to the server.

32. The system of claim 31 wherein the server is further configured to create the subset based on the identifier associated with the computer.

33. The system of claim 30 wherein the agent is further configured to receive a usage history of the computer and transmit the usage history to the server.

34. The system of claim 33 wherein the server is further configured to create the subset based on the usage history of the computer.

35. The system of claim 30 wherein the agent is further configured to authenticate the user to the secure computer system based on the additional authentication credentials.

36. The system of claim 30 wherein the subset is stored in RAM of the client.

37. An article of manufacture having computer-readable program portions embodied thereon for authenticating users to a secure computer system, the article comprising computer-readable instructions for:

receiving one or more biometric authentication credentials from a biometric capture device;

receiving, from a server, a subset of a set of biometric authentication credentials representing users of the secure computer system;

comparing the received biometric authentication credential to a subset of the biometric authentication credentials; and

requesting the user to provide one or more additional authentication credentials if the received biometric authentication credential does not match any of the authentication credentials in the subset.

38. The article of manufacture of claim 37 further comprising computer-readable instructions for receiving an identifier associated with a computer within the secure computer system.

39. The article of manufacture of claim 38 further comprising computer-readable instructions for creating the subset of the valid biometric authentication credentials based on the identifier associated with the computer.

40. The article of manufacture of claim 37 further comprising computer-readable instructions for receiving a usage history of a computer within the secure computer system.

41. The article of manufacture of claim 40 further comprising computer-readable instructions for creating the subset of the valid biometric authentication credentials based on the usage history of the computer.

42. The article of manufacture of claim 37 further comprising computer-readable instructions for authenticating the user to the computer system based on the additional authentication credentials.