Embedded authentication systems in an electronic device

• US 9,038,167 B2
• Filed: 12/27/2013
• Issued: 05/19/2015
• Est. Priority Date: 09/24/2007
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Fadell, Anthony, Hodge, Andrew, Schell, Stephan, Caballero, Ruben, Dorogusker, Jesse Lee, Zadesky, Stephen, Sanford, Emery
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US14/142,674
• Publication Number:
  US 20140115696A1
• Time in Patent Office: 508 Days
• Field of Search: 726/19
• US Class Current: 726/19
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 3/0412 Digitisers structurally integrated in a display
• CPC Class Codes: G06F 3/0416 Control or interface arrangements specially adapted for digitisers
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0488 using a touch-screen or digitiser, e.g. input of commands through traced gestures
• CPC Class Codes: G06F 3/04883 for inputting data by handwriting, e.g. gesture or text
• CPC Class Codes: G06V 40/1306 non-optical, e.g. ultrasonic or capacitive sensing
• CPC Class Codes: G06V 40/1312 direct reading, e.g. contactless acquisition
• CPC Class Codes: G06V 40/1365 Matching; Classification
• CPC Class Codes: G06V 40/165 using facial parts and geometric relationships
• CPC Class Codes: G06V 40/166 using acquisition arrangements
• CPC Class Codes: G06V 40/67 by interactive indications to the user
• CPC Class Codes: G09G 2358/00 Arrangements for display data security
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/068 : using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 88/02 : Terminal devices

Abstract

This invention is directed to an electronic device with an embedded authentication system for restricting access to device resources. The authentication system may include one or more sensors operative to detect biometric information of a user. The sensors may be positioned in the device such that the sensors may detect appropriate biometric information as the user operates the device, without requiring the user to perform a step for providing the biometric information (e.g., embedding a fingerprint sensor in an input mechanism instead of providing a fingerprint sensor in a separate part of the device housing). In some embodiments, the authentication system may be operative to detect a visual or temporal pattern of inputs to authenticate a user. In response to authenticating, a user may access restricted files, applications (e.g., applications purchased by the user), or settings (e.g., application settings such as contacts or saved game profile).

Claims

1. An electronic device, comprising:

a display;

a fingerprint sensor;

one or more processors;

memory; and

one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions for;

displaying a first user interface on the display;

while displaying the first user interface on the display, receiving a request to access resources of a first type from a respective user, wherein;

the device includes resources of the first type;

a first subset of resources of the first type are associated with a first user;

the first subset of resources of the first type are secured by an authentication system;

a second subset of resources of the first type are associated with a second user;

the second subset of resources of the first type are secured by the authentication system;

the first user and the second user are members of a predefined group; and

the predefined group has access to one or more group resources; and

in response to receiving the request to access resources of the first type;

in accordance with a determination that the respective user has been authenticated with the authentication system as the first user, providing access to a first plurality of resources of the first type of resources, including the first subset of resources and the group resources;

in accordance with a determination that the respective user has not been authenticated with the authentication system as the first user, providing access to a second plurality of resources of the first type that does not include the first subset of resources;

in accordance with a determination that the respective user has been authenticated with the authentication system as the second user, providing access to a third plurality of resources of the first type of resources, including the second subset of resources and the group resources; and

in accordance with a determination that the respective user has not been authenticated with the authentication system as the second user, providing access to a plurality of resources of the first type that does not include the second subset of resources,

wherein the second user does not have access to the first subset of resources; and

the first user does not have access to the second subset of resources.

2. The device of claim 1, wherein:

the first subset of resources include electronic communications associated with the first user;

the second subset of resources include electronic communications associated with the second user; and

the group resources include shared documents.

3. The device of claim 1, wherein:

the device includes resources of a plurality of types, including the first type and a second type; and

in addition to the first subset of resources of the first type, a first subset of a plurality of resources of the second type are also associated with the first user.

4. The device of claim 3, wherein:

the first type of resources includes contact information; and

the second type of resources includes communication history information.

5. The device of claim 1, wherein:

providing access to the first plurality of resources includes displaying contact information restricted for use by the first user; and

providing access to the second plurality of resources includes displaying contact information does not include contact information restricted for use by the first user.

6. The device of claim 1, wherein:

providing access to the first plurality of resources includes displaying communication history information restricted for use by the first user; and

providing access to the second plurality of resources includes displaying communication history information that does not include communication history information restricted for use by the first user.

7. The device of claim 1, wherein:

providing access to the first plurality of resources includes displaying representations of electronic messages restricted for use by the first user; and

providing access to the second plurality of resources includes displaying representations of electronic messages that do not include representations of electronic messages restricted for use by the first user.

8. The device of claim 1, wherein:

providing access to the first plurality of resources includes displaying a user interface with an appearance that has been customized in accordance with user preferences of the first user; and

providing access to the second plurality of resources includes displaying a user interface that has not been customized in accordance with user preferences of the first user.

9. The device of claim 1, wherein:

providing access to the first plurality of resources includes displaying a first set of application icons that includes one or more application icons for applications restricted for use by the first user; and

providing access to the second plurality of resources includes displaying a second set of application icons that does not include the one or more application icons for applications restricted for use by the first user.

10. The device of claim 9, wherein:

the first set of application icons includes one or more common application icons that are included in the second set of application icons; and

the one or more common application icons correspond to applications that are available, by default, for use by any user of the device.

11. The device of claim 10, wherein:

the one or more common application icons are displayed in a first arrangement in the first set of application icons; and

the one or more common application icons are displayed in a second arrangement that is different from the first arrangement in the second set of application icons.

12. The device of claim 9, wherein:

the first set of application icons are displayed on a home screen of the device; and

the second set of application icons are displayed on a home screen of the device.

13. A method, comprising:

at an electronic device with a fingerprint sensor and a display;

displaying a first user interface on the display;

while displaying the first user interface on the display, receiving a request to access resources of a first type from a respective user, wherein;

the device includes resources of the first type;

a first subset of resources of the first type are associated with a first user;

the first subset of resources of the first type are secured by an authentication system;

a second subset of resources of the first type are associated with a second user;

the second subset of resources of the first type are secured by the authentication system;

the first user and the second user are members of a predefined group; and

the predefined group has access to one or more group resources; and

in response to receiving the request to access resources of the first type;

in accordance with a determination that the respective user has been authenticated with the authentication system as the first user, providing access to a first plurality of resources of the first type of resources, including the first subset of resources and the group resources;

in accordance with a determination that the respective user has not been authenticated with the authentication system as the first user, providing access to a second plurality of resources of the first type that does not include the first subset of resources;

in accordance with a determination that the respective user has been authenticated with the authentication system as the second user, providing access to a third plurality of resources of the first type of resources, including the second subset of resources and the group resources; and

in accordance with a determination that the respective user has not been authenticated with the authentication system as the second user, providing access to a plurality of resources of the first type that does not include the second subset of resources,

wherein the second user does not have access to the first subset of resources; and

the first user does not have access to the second subset of resources.

14. The method of claim 13, wherein:

the first subset of resources include electronic communications associated with the first user;

the second subset of resources include electronic communications associated with the second user; and

the group resources include shared documents.

15. The method of claim 13, wherein:

the device includes resources of a plurality of types, including the first type and a second type; and

in addition to the first subset of resources of the first type, a first subset of a plurality of resources of the second type are also associated with the first user.

16. The method of claim 15, wherein:

the first type of resources includes contact information; and

the second type of resources includes communication history information.

17. The method of claim 13, wherein:

providing access to the first plurality of resources includes displaying contact information restricted for use by the first user; and

providing access to the second plurality of resources includes displaying contact information does not include contact information restricted for use by the first user.

18. The method of claim 13, wherein:

providing access to the first plurality of resources includes displaying communication history information restricted for use by the first user; and

providing access to the second plurality of resources includes displaying communication history information that does not include communication history information restricted for use by the first user.

19. The method of claim 13, wherein:

providing access to the first plurality of resources includes displaying representations of electronic messages restricted for use by the first user; and

providing access to the second plurality of resources includes displaying representations of electronic messages that do not include representations of electronic messages restricted for use by the first user.

20. The method of claim 13, wherein:

providing access to the first plurality of resources includes displaying a user interface with an appearance that has been customized in accordance with user preferences of the first user; and

providing access to the second plurality of resources includes displaying a user interface that has not been customized in accordance with user preferences of the first user.

21. The method of claim 13, wherein:

providing access to the first plurality of resources includes displaying a first set of application icons that includes one or more application icons for applications restricted for use by the first user; and

providing access to the second plurality of resources includes displaying a second set of application icons that does not include the one or more application icons for applications restricted for use by the first user.

22. The method of claim 21, wherein:

the first set of application icons includes one or more common application icons that are included in the second set of application icons; and

the one or more common application icons correspond to applications that are available, by default, for use by any user of the device.

23. The method of claim 22, wherein:

the one or more common application icons are displayed in a first arrangement in the first set of application icons; and

the one or more common application icons are displayed in a second arrangement that is different from the first arrangement in the second set of application icons.

24. The method of claim 21, wherein:

the first set of application icons are displayed on a home screen of the device; and

the second set of application icons are displayed on a home screen of the device.

25. A non-transitory computer readable storage medium storing one or more programs, the one or more programs comprising instructions, which when executed by an electronic device with a display and a fingerprint sensor, cause the device to:

display a first user interface on the display;

while displaying the first user interface on the display, receive a request to access resources of a first type from a respective user, wherein;

the device includes resources of the first type;

a first subset of resources of the first type are associated with a first user;

the first subset of resources of the first type are secured by an authentication system;

a second subset of resources of the first type are associated with a second user;

the second subset of resources of the first type are secured by the authentication system;

the first user and the second user are members of a predefined group; and

the predefined group has access to one or more group resources; and

in response to receiving the request to access resources of the first type;

in accordance with a determination that the respective user has been authenticated with the authentication system as the first user, provide access to a first plurality of resources of the first type of resources, including the first subset of resources and the group resources;

in accordance with a determination that the respective user has not been authenticated with the authentication system as the first user, provide access to a second plurality of resources of the first type that does not include the first subset of resources;

in accordance with a determination that the respective user has been authenticated with the authentication system as the second user, provide access to a third plurality of resources of the first type of resources, including the second subset of resources and the group resources; and

in accordance with a determination that the respective user has not been authenticated with the authentication system as the second user, provide access to a plurality of resources of the first type that does not include the second subset of resources,

wherein the second user does not have access to the first subset of resources; and

the first user does not have access to the second subset of resources.

26. The non-transitory computer readable storage medium of claim 25, wherein:

the first subset of resources include electronic communications associated with the first user;

the second subset of resources include electronic communications associated with the second user; and

the group resources include shared documents.

27. The non-transitory computer readable storage medium of claim 25, wherein:

the device includes resources of a plurality of types, including the first type and a second type; and

in addition to the first subset of resources of the first type, a first subset of a plurality of resources of the second type are also associated with the first user.

28. The non-transitory computer readable storage medium of claim 27, wherein:

the first type of resources includes contact information; and

the second type of resources includes communication history information.

29. The non-transitory computer readable storage medium of claim 25, wherein:

providing access to the first plurality of resources includes displaying contact information restricted for use by the first user; and

providing access to the second plurality of resources includes displaying contact information does not include contact information restricted for use by the first user.

30. The non-transitory computer readable storage medium of claim 25, wherein:

providing access to the first plurality of resources includes displaying communication history information restricted for use by the first user; and

providing access to the second plurality of resources includes displaying communication history information that does not include communication history information restricted for use by the first user.

31. The non-transitory computer readable storage medium of claim 25, wherein:

providing access to the first plurality of resources includes displaying representations of electronic messages restricted for use by the first user; and

providing access to the second plurality of resources includes displaying representations of electronic messages that do not include representations of electronic messages restricted for use by the first user.

32. The non-transitory computer readable storage medium of claim 25, wherein:

providing access to the first plurality of resources includes displaying a user interface with an appearance that has been customized in accordance with user preferences of the first user; and

providing access to the second plurality of resources includes displaying a user interface that has not been customized in accordance with user preferences of the first user.

33. The non-transitory computer readable storage medium of claim 25, wherein:

providing access to the first plurality of resources includes displaying a first set of application icons that includes one or more application icons for applications restricted for use by the first user; and

providing access to the second plurality of resources includes displaying a second set of application icons that does not include the one or more application icons for applications restricted for use by the first user.

34. The non-transitory computer readable storage medium of claim 33, wherein:

the first set of application icons includes one or more common application icons that are included in the second set of application icons; and

the one or more common application icons correspond to applications that are available, by default, for use by any user of the device.

35. The non-transitory computer readable storage medium of claim 34, wherein:

the one or more common application icons are displayed in a first arrangement in the first set of application icons; and

the one or more common application icons are displayed in a second arrangement that is different from the first arrangement in the second set of application icons.

36. The non-transitory computer readable storage medium of claim 33, wherein:

the first set of application icons are displayed on a home screen of the device; and

the second set of application icons are displayed on a home screen of the device.