System and method for device security with a plurality of authentication modes

• US 8,595,804 B2
• Filed: 11/06/2008
• Issued: 11/26/2013
• Est. Priority Date: 11/06/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Sullivan, Marc, Pratt, James, Pearson, Larry
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US12/265,900
• Publication Number:
  US 20100115607A1
• Time in Patent Office: 1,846 Days
• Field of Search: 726 2- 10, 726 16- 21, 726 26- 30, 713182-186, 340 58- 585
• US Class Current: 726/5
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A security processing element stores authentication data corresponding to a plurality of possible authentication modes. At a time of activation, the security processing element randomly selects one of the authentication modes for presentation to the user. The user must successfully enter data corresponding to the randomly selected authentication mode. In an alternative embodiment, the security processing element can randomly select a plurality of authentication modes that are sequentially presented to the user. The user must successfully respond to each of the plurality of requested authentication modes. In another embodiment, for high security communications, the security processing element may select from a subset of authentication modes that are considered to be more robust. Conversely, the security processing element may select from a subset of randomly presented authentication modes that are considered less robust when used in a low security setting.

Claims

1. An authentication system comprising:

an authentication data storage storing reference data for authentication, the reference data comprising a correct user-selected image, a user-selected personal identification number, a user-selected voice passphrase, a user-selected photograph, and a user-selected biometric; and

an authentication processor in communication with the authentication data storage, the authentication processor performing operations comprising

receiving a user identification,

identifying a user based upon the user identification,

randomly selecting at least two authentication modes from a group of available authentication modes for presentation to the user in solicitation of input for use in authenticating the user to utilize an electronic device, wherein the group of available authentication modes is associated with the user identification and consists of;

a first authentication mode in which multiple thumbnail images, including the correct user-selected image and a plurality of false images, and an instruction to select a number on a keypad of the electronic device corresponding to the correct user-selected image are presented,

a second authentication mode in which the user is prompted to enter a personal identification number for comparison to the user-selected personal identification number,

a third authentication mode in which the user is prompted to speak a voice passphrase for comparison to the user-selected voice passphrase,

a fourth authentication mode in which the user is prompted to take a photograph of the user for comparison to the user-selected photograph, and

a fifth authentication mode in which the user is prompted to provide a biometric input for comparison to the user-selected biometric, receiving a response to each of the at least two authentication modes,

determining whether a match exists between the response received for each of the at least two authentication modes and a portion of the reference data corresponding to each of the at least two authentication modes by comparing the response received for each of the at least two authentication modes with the portion of the reference data corresponding to each of the at least two authentication modes, and

allowing the user to utilize the electronic device if the authentication processor determines that a match exists between the response received for each of the at least two authentication modes and the portion of the reference data corresponding to each of the at least two authentication modes.

2. The authentication system of claim 1, wherein the electronic device is used in a high security activity, and wherein the at least two authentication modes are randomly selected from a high security subset of the group of available authentication modes.

3. The authentication system of claim 1, wherein the authentication processor is located in a different location than the electronic device.

4. The authentication system of claim 3, wherein the electronic device is a wireless communication device and communicates with the authentication processor via a wireless communication link.

5. The authentication system of claim 1, wherein the authentication processor is coupled to the electronic device via a Wide Area Network.

6. The authentication system of claim 5, further comprising a communication interface including a network interface controller for communicating with the authentication processor via the Wide Area Network.

7. The authentication system of claim 1, wherein the authentication processor is coupled to the electronic device via a Local Area Network.

8. The authentication system of claim 7, further comprising a communication interface including a network interface controller for communicating with the authentication processor via the Local Area Network.

9. The authentication system of claim 1, wherein the authentication processor is embedded within the electronic device.

10. The authentication system of claim 1, wherein the authentication data storage stores the reference data in an encrypted form.

11. The authentication system of claim 1, further comprising a library of authentication modes, the library of authentication modes storing the group of available authentication modes.

12. The authentication system of claim 1, wherein the authentication processor performs additional operations comprising analyzing the voice passphrase during the third authentication mode to determine a degree of similarity between the user-selected voice passphrase stored in the authentication data storage and the voice passphrase recorded at an indicated time.

13. The authentication system of claim 1, wherein the authentication processor performs additional operations comprising analyzing the photograph during the fourth authentication mode to determine a degree of similarity between the user-selected photograph and the photograph.

14. The authentication system of claim 1, wherein the system is integrated into the electronic device.

15. The authentication system of claim 14, wherein the electronic device is a television set.

16. The authentication system of claim 1, wherein the electronic device is an automatic teller machine.

17. A non-transitory computer-readable medium having instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:

causing reference data for authentication of a user to be stored in an authentication data storage, the reference data comprising a correct user-selected image, a user-selected personal identification number, a user-selected voice passphrase, a user-selected photograph, and a user-selected biometric;

receiving a user identification;

identifying a user based upon the user identification;

randomly selecting at least two authentication modes from a group of available authentication modes for presentation to the user in solicitation of input for use in authenticating the user to utilize an electronic device, wherein the group of available authentication modes is associated with the user identification and consists of;

a first authentication mode in which multiple thumbnail images, including the correct user-selected image and a plurality of false images, and an instruction to select a number on a keypad of the electronic device corresponding to the correct user-selected image are presented,

a second authentication mode in which the user is prompted to enter a personal identification number for comparison to the user-selected personal identification number,

a third authentication mode in which the user is prompted to speak a voice passphrase for comparison to the user-selected voice passphrase,

a fourth authentication mode in which the user is prompted to take a photograph of the user for comparison to the user-selected photograph, and

a fifth authentication mode in which the user is prompted to provide a biometric input for comparison to the user-selected biometric;

receiving a response to each of the at least two authentication modes;

determining whether a match exists between the response received for each of the at least two authentication modes and a portion of the reference data corresponding to each of the at least two authentication modes by comparing the response received for each of the at least two authentication modes with the portion of the reference data corresponding to each of the at least two authentication modes; and

allowing the user to utilize the electronic device if the processor determines that a match exists between the response received for each of the at least two authentication modes and the portion of the reference data corresponding to each of the at least two authentication modes.

18. The non-transitory computer-readable medium of claim 17, wherein the authentication data storage stores the reference data in an encrypted form.

19. The non-transitory computer-readable medium of claim 17, wherein the processor is located in a different location than the electronic device.

20. The non-transitory computer-readable medium of claim 19, wherein the electronic device is a wireless communication device and communicates with the processor via a wireless communication link.

21. The non-transitory computer-readable medium of claim 17, wherein the processor is embedded within the electronic device.

22. A method comprising:

causing, by an authentication processor, reference data for authentication to be stored in an authentication data storage, the reference data comprising a correct user-selected image, a user-selected personal identification number, a user-selected voice passphrase, a user-selected photograph, and a user-selected biometric;

randomly selecting, by the authentication processor, at least two authentication modes from a group of available authentication modes for presentation to a user in solicitation of input for use in authenticating the user to utilize an electronic device, wherein the group of available authentication modes is associated with the user identification and consists of;

a first authentication mode in which multiple thumbnail images, including the correct user-selected image and a plurality of false images, and an instruction to select a number on a keypad of the electronic device corresponding to the correct user-selected image are presented,

a second authentication mode in which the user is prompted to enter a personal identification number for comparison to the user-selected personal identification number,

a third authentication mode in which the user is prompted to speak a voice passphrase for comparison to the user-selected voice passphrase,

a fourth authentication mode in which the user is prompted to take a photograph of the user for comparison to the user-selected photograph, and

a fifth authentication mode in which the user is prompted to provide a biometric input for comparison to the user-selected biometric

receiving, at the authentication processor, a response to each of the at least two authentication modes;

determining, using the authentication processor, whether a match exists between the response received for each of the at least two authentication modes and a portion of the reference data corresponding to each of the at least two authentication modes by comparing the response received for each of the at least two authentication modes with the portion of the reference data corresponding to each of the at least two authentication modes; and

allowing the user to utilize the electronic device if the authentication processor determines that a match exists between the response received for each of the at least two authentication modes and the portion of the reference data corresponding to each of the at least two authentication modes.

23. The method of claim 22, wherein randomly selecting the at least two authentication modes further comprises randomly selecting the at least two authentication modes without replacement after each selection.

24. The method of claim 22, wherein the group of available authentication modes are stored in a library of authentication modes.