Authenticating A User Of A System Via An Authentication Image Mechanism

• US 20130347087A1
• Filed: 06/25/2012
• Published: 12/26/2013
• Est. Priority Date: 06/25/2012
• Status: Active Grant

• Current Assignee: Tahoe Research Limited (f/k/a Learndale Limited) (Vector Capital Corporation)
• Original Assignee: Intel Corporation
• Inventors: Smith, Ned M.
• Granted Patent: US 8,973,095 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/36 by graphic or iconic representation

Abstract

In an embodiment, the present invention includes a method for receiving a request for user authentication of a system, displaying an authentication image on a display of the system using a set of random coordinates, receiving a plurality of gesture input values from the user, and determining whether to authenticate the user based at least in part on the plurality of gesture input values. Other embodiments are described and claimed.

Claims

1. A mobile system comprising:

a processor to execute instructions;

a manageability engine coupled to the processor and to authenticate a user of the mobile system; and

a trusted storage associated with the manageability engine to store an authentication image and at least one authentication gesture associated with the authentication image, wherein the manageability engine is to cause the authentication image to be displayed on a display of the mobile system within a portion of a display frame image to be displayed on the display according to a set of random coordinates, receive at least one gesture input value from the user based on the displayed frame image, and determine whether the user is authenticated based on the at least one gesture input value and the at least one authentication gesture.

2. The mobile system of claim 1, wherein the manageability engine is to adjust the at least one gesture input value according to the set of random coordinates.

3. The mobile system of claim 2, wherein the manageability engine is to compare the at least one adjusted gesture input value to the at least one authentication gesture.

4. The mobile system of claim 3, wherein the manageability engine is to authenticate the user and allow the user to access the system if the at least one adjusted gesture input value is within a predetermined threshold of the at least one authentication gesture, and otherwise to not authenticate the user and to prevent the user from access to the mobile system.

5. The mobile system of claim 4, wherein if the at least one adjusted gesture input value does not match the at least one authentication gesture within the predetermined threshold, the manageability engine is to display a second authentication image within a portion of a second display frame image to be displayed on the display according to a second set of random coordinates to enable the user to retry an authentication.

6. The mobile system of claim 1, wherein the manageability engine is to cause the display to sequentially display a plurality of authentication images each associated with a different set of random coordinates, and to authenticate the user if at least a threshold number of at least one gesture input value received from the user for a corresponding one of the plurality of authentication images matches a corresponding at least one authentication gesture associated with the one of the plurality of authentication images.

7. The mobile system of claim 1, wherein the manageability engine is to provide the display frame image to the display of the mobile system via a trusted channel that is not accessible to an operating system (OS) or an application executing on the mobile system.

8. The mobile system of claim 1, wherein the mobile system is to create a secure channel with a remote system to receive the authentication image.

9. The mobile system of claim 8, wherein the mobile system is to receive the authentication image via the secure channel responsive to a user selection of the authentication image.

10. A method comprising:

receiving a request for user authentication of a system in a security engine of the system;

preparing, in the security engine, a display frame image including an authentication image, the display frame image larger than the authentication image and the authentication image located with the display frame image using a set of random coordinates;

displaying the display frame image on a display of the system; and

receiving a plurality of gesture input values from the user, and determining whether to authenticate the user based at least in part on the plurality of gesture input values.

11. The method of claim 10, further comprising displaying the authentication image as a bitmap overlaid over the display frame image.

12. The method of claim 11, further comprising providing the display frame image including the authentication image from the security engine to the display of the system via a trusted channel inaccessible to an operating system (OS) or an application executing on the system.

13. The method of claim 12, further comprising receiving the plurality of gesture input values in the security engine via an untrusted channel of the system.

14. The method of claim 10, further comprising displaying a sequence of authentication images, each using a corresponding set of random coordinates within the display frame image, and receiving a plurality of gesture input values from the user for each of the sequence of authentication images.

15. The method of claim 10, further comprising authenticating the user if the plurality of gesture input values matches a stored set of authentication gestures associated with the authenticated image, within a predetermined threshold.

16. The method of claim 15, further comprising receiving the stored set of authentication gestures from the user during a security initialization procedure, in which the authentication image is located at an unrandomized set of coordinates.

17. The method of claim 16, further comprising storing the stored set of authentication gestures in a trusted storage of the system.

18. The method of claim 10, further comprising responsive to not authenticating the user for a first time, re-displaying the display frame image using a different set of random coordinates, and receiving a second plurality of gesture input values from the user, and determining whether to authenticate the user based at least in part on the second plurality of gesture input values.

19. The method of claim 10, wherein the plurality of gesture input values are subject to access by malware executing on the system, and the authentication image within the display frame image is not subject to access by the malware.

20. At least one non-transitory machine-readable storage medium including instructions that when executed enable a system to:

create a secure channel with a remote system to receive an authentication image;

prepare the authentication image according to a first set of coordinates for display of the authentication image on a display of the system to obtain at least one authentication gesture from a user viewing the authentication image; and

store the authentication image and the at least one authentication gesture associated with the authentication image in a trusted storage of the system, wherein the authentication image is to be displayed on the display during a plurality of authorization challenges each according to a random and different set of coordinates than the first set of coordinates.

21. The at least machine-readable storage medium of claim 20, further comprising instructions to display the authentication image within a portion of a display frame image on the display according to the random and different set of coordinates, receive at least one gesture input value from the user, and determine whether the user is authenticated based on the at least one gesture input value and the at least one authentication gesture.

22. The at least one machine-readable storage medium of claim 21, further comprising instructions to adjust the at least one gesture input value according to the random and different set of coordinates and compare the at least one adjusted gesture input value to the at least one authentication gesture.