Apparatus and method for authenticating access to a network resource

• US 7,603,565 B2
• Filed: 03/16/2004
• Issued: 10/13/2009
• Est. Priority Date: 02/12/2001
• Status: Active Grant

• Current Assignee: Symbol Technologies, LLC (Zebra Technologies Corporation)
• Original Assignee: Symbol Technologies, Inc. (Zebra Technologies Corporation)
• Inventors: Harmon, Mance E., Armstrong, James E. Jr., Baird, Leemon C. III, Young, R. Reed
• Primary Examiner(s): Moazzami; Nasser G
• Assistant Examiner(s): Traore; Fatoumata
• Application Number:
  US10/802,073
• Publication Number:
  US 20040230807A1
• Time in Patent Office: 2,037 Days
• Field of Search: None
• US Class Current: 713/184
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

A device for providing access to a remote site is disclosed. Access to the device is gained through an authentication process during which a user password and biometrics are provided to the device. The device also includes a security feature such that only authorized users of the specific device can gain access to it. Once authenticated, the device authorizes access to a remote site (e.g., a web site or a server on a local area network). The communications from the device to the remote site is encrypted and further the hand-held device uses a computer generated password to gain access to the site. In this way, user generated passwords, which are typically simple and infrequently changed, are avoided in favor of a more complex and frequently changed computer generated passwords for site access.

Claims

1. A device for providing a user with a secure access to a network resource, comprising:

a memory storing data related to at least one of accounts and preferences; and

a processor coupled to the memory, the processor authenticating the user with the device by verifying a device password and a user biometric that are specific to the device and transmitting a resource password to establish a connection to the network resource, the resource password being unknown to the user and specific to the network resource, wherein if a duress password is entered for authenticating the user, the processor replaces the data of the memory with non-sensitive data.

2. The device of claim 1, wherein the user is granted access to the memory upon verification.

3. The device of claim 1, wherein the data of the memory is encrypted, the data being decrypted with a device dependent key specific to the device.

4. The device of claim 1, wherein the user biometric is at least one of a path and a speed of a use of an input device, a fingerprint description, an iris scan, and a voice print.

5. The device of claim 4, wherein the path and the speed of the use of the input device include a signature of the device password to combine the device password and the biometric for the verification.

6. The device of claim 1, further comprising:

a true random number generator generating the resource password.

7. The device of claim 1, wherein the resource password is generated at a predetermined time for the access to the network resource.

8. The device of claim 1, wherein communications with the network resource are encrypted.

9. A method for authenticating a user to a device for contacting a network resource, comprising:

verifying a device password and a user biometric that are specific to the device;

transmitting a resource password to establish a connection to the network resource, the resource password being unknown to the user, the resource password being specific to the network resource;

receiving a duress password for authenticating the user; and

replacing data of the memory with non-sensitive data when the duress password is received.

10. The method of claim 9, further comprising:

upon the verifying, accessing a memory including at least one of accounts and preferences.

11. The method of claim 10, wherein the data of the memory is encrypted, the data being decrypted with a device dependent key specific to the device.

12. The method of claim 9, wherein the user biometric is at least one of a path and a speed of a use of an input device, a fingerprint description, an iris scan, and a voice print.

13. The method of claim 12, wherein the path and the speed of the use of the input device include a signature of the device password to combine the device password and the biometric for the verifying.

14. The method of claim 9, further comprising:

generating the resource password using a true random number generator.

15. The method of claim 9, further comprising:

generating the resource password at a predetermined time for the access to the network resource.

16. The method of claim 9, wherein communications with the network resource are encrypted.

17. A device for providing a user with a secure access to a network resource, comprising:

a storage means for storing data related to at least one of accounts and preferences; and

a processing means for authenticating the user with the device by verifying a device password and a user biometric that are specific to the device and for transmitting a resource password to establish a connection to the network resource, the resource password being unknown to the user and specific to the network resource, the processing means being coupled to the storage means, wherein if a duress password is entered for authenticating the user, the processing means replaces the data of the storage means with non-sensitive data.