Credential interface

• US 7,810,143 B2
• Filed: 04/22/2005
• Issued: 10/05/2010
• Est. Priority Date: 04/22/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Stephens, John, Flo, Eric R., Richards, Stefan, Hutz, Benjamin A., McNeil, Brian K., Guzak, Chris J., Ruzyski, David M., Wentz, Brian D., Ilac, Cristian, Reasor, Sterling M., Hong, James H., Schutz, Klaus U., Perlin, Eric C.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): RAHIM, MONJUR
• Application Number:
  US11/112,844
• Publication Number:
  US 20060242427A1
• Time in Patent Office: 1,992 Days
• Field of Search: 380/278, 380/277, 705/76, 726/3, 726/6, 726/4, 726/8, 726/5, 713/168, 713/182, 709/217
• US Class Current: 726/5
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

Systems and/or methods are described that enable a credential interface. These systems and/or methods may build a credential user interface enabling a user to choose between multiple credentials and submit an authenticator for a chosen credential. These systems and/or methods may also gather information about arbitrary credentials and build a user interface for submission of authenticators for these arbitrary credentials.

Claims

1. A method, when executed by a computing device, cause the computing device to perform acts comprising:

registering a plurality of credential providers in a credential registry, the plurality of credential providers including a first credential provider that is integral to an operating system of the computing device, and a second credential provider at an arbitrary source that is separate from the operating system each of the plurality of credential providers authenticates one or more authenticators;

receiving multiple sets of credential information for multiple credentials from the plurality of credential providers in the credential registry, each set of credential information to enable tailoring of a portion of a graphical user interface to present one of the multiple credentials and to specify an acceptable credential type for the one of the multiple credentials;

receiving a request to authenticate a user;

presenting the multiple credentials on the graphical user interface, the graphical user interface including a corresponding portion for each of the multiple credentials that is tailored based on its set of credential information;

receiving an authenticator specified by one of the multiple credentials that is of the acceptable credential type from the user; and

authenticating the received authenticator at a corresponding credential provider.

2. The method of claim 1, wherein at least one of the multiple credentials comprises a biometric type of credential.

3. The method of claim 1, wherein the act of receiving the request comprises receiving the request from the operating system of the computing device, the operating system'"'"'s request made in order to determine whether or not to log the user onto the operating system.

4. The method of claim 1, wherein the user is logged onto the operating system of the computing device and the act of receiving the request comprises receiving the request from controlled-access software, the controlled-access software'"'"'s request made in order to determine whether or not to permit a currently prohibited task.

5. The method of claim 1, wherein the acceptable credential type includes one of a thumb biometric, a retina biometric, a voice recognizer, a password, and a smart card.

6. The method of claim 1, further comprising permitting the user to log onto the operating system when the received authenticator is authenticated.

7. The method of claim 1, further comprising receiving a selection of one of the multiple credentials presented on the graphical user interface.

8. The method of claim 1, wherein the act of receiving the request is performed prior to the act of receiving multiple sets of credential information.

9. One or more computer-readable storage device having computer-readable instructions therein that, when executed by a computing device, cause the computing device to perform acts comprising:

gathering sets of information associated with two or more credentials from a plurality of credential providers registered in a credential registry, the credential providers including a first credential provider that is integral to an operating system of the computing device, and a second credential provider at an arbitrary source that is separate from the operating system, each of the credential providers to authenticate one or more authenticators, the sets of information associated with the each of the credentials including instructions for submitting an authenticator for the each of the credentials to an authenticating entity;

tailoring a graphical user interface to display the sets of information associated with the two or more credentials;

presenting the graphical user interface, the graphical user interface enabling selection of at least one of the two credentials;

receiving at least one authenticator specified by the instructions for one of the credentials, from-the user.

10. The storage device of claim 9, wherein the act of gathering sets of information comprises requesting sets of information having a particular format.

11. The storage device of claim 9, further comprising authenticating each received authenticator at a corresponding credential provider.

12. The storage device of claim 9, wherein the act of gathering sets of information comprises gathering a set of information associated with one of the credentials, this set of information indicating that enabling submission of the authenticator for that credential requires a data-entry field and textual instructions to be presented on a graphical user interface.

13. The storage device of claim 12, wherein the act of tailoring the graphical user interface to the sets of information comprises adding the data entry field and the textual instructions to the graphical user interface.

14. The storage device of claim 9, wherein the act of tailoring the graphical user interface is performed without the sets of information comprising localization, keyboard accessibility, and scrolling instructions.

15. The storage device of claim 9, wherein one of the credentials requires two or more authenticators;

and

further comprising;

enabling submission of the authenticators, receiving submission of the authenticators,

packaging the submitted authenticators with the credential requiring the authenticators effective to enable authentication of the credential, and

permitting a user to log onto an operating system when an authenticating entity authenticates the two or more authenticators.

16. The storage device of claim 9, further comprising, prior to the act of tailoring the graphical user interface, receiving a request to authenticate a user, the request received from an operating system of the computing device.

17. The storage device of claim 9, further comprising, responsive to receiving a selection of one of the credentials, altering the graphical user interface to enable submission of an authenticator for the selected credential.

18. One or more computer-readable storage device having computer-readable instructions therein that, when executed by a computing device, cause the computing device to perform acts comprising:

presenting, responsive to receiving a first set of information from a first credential provider, registered in a credential registry, a first portion of a graphical user interface that is tailored based on the first set of information to display a first set of credentials usable to authenticate a user, the first credential provider to authenticate one or more first authenticators;

presenting, responsive to receiving a second set of information from a second credential provider registered in the credential registry, a second portion of the graphical user interface that is tailored based on the second set of information to display a second set of credentials usable to authenticate the user, the second credential provider to authenticate one or more second authenticators, wherein the first set of credentials and the second set of credentials are of different types;

receiving an authenticator specified by the first set of information of the first set of credentials or the second set of information of the second set of credentials, the authenticator for authenticating the user; and

packaging the authenticator into an eXtensible Markup Language (XML) package for transmission to a corresponding credential provider an authenticating entity, the XML package defining the characteristics of the authenticator.

19. The storage device of claim 18, wherein the first graphical user interface and the second graphical user interface are both capable of enabling the user to submit an authenticator.

20. The storage device of claim 19, further comprising permitting the user to log on to an operating system if the authenticating entity authenticates the authenticator.