Password management

• US 9,979,547 B2
• Filed: 05/08/2013
• Issued: 05/22/2018
• Est. Priority Date: 05/08/2013
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google LLC (Alphabet Inc.)
• Inventors: Starner, Thad Eugene, Johnson, Michael Patrick
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Almeida, Devin E
• Application Number:
  US13/889,872
• Publication Number:
  US 20140337634A1
• Time in Patent Office: 1,840 Days
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 3/013 Eye tracking input arrangements G06F3/015 takes precedence
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/33 using wearable devices, e.g. using a smartwatch or smart-glasses
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

Methods, apparatus, and computer-readable media are described herein related to biometric authentication. A first computing device can detect a machine-readable code displayed by a second computing device, where the machine-readable code can identify protected information viewable via the second computing device. In response to detecting the machine-readable code, the first computing device can acquire biometric data via one or more biometric sensors associated with the first computing device. Based at least in part on the biometric data, the first computing device can generate an authentication message that includes authentication information and identifies the protected information. The first computing device can then send the authentication message to an authentication server for verification of the authentication information, where verification of the authentication information can allow access to the protected information via the second computing device.

Claims

1. A method, comprising:

determining, by a first computing device, that the first computing device is being worn;

while the first computing device is determined to be worn, detecting, by the first computing device, a machine-readable code that is displayed by a second computing device, wherein the machine-readable code identifies protected information that is viewable via the second computing device; and

responsive to detecting the machine-readable code while the first computing device is determined to be worn;

causing one or more biometric sensors associated with the first computing device to perform actions to collect, at the first computing device, biometric data after the first computing device detects the machine-readable code,

based at least in part on the biometric data, the first computing device generating an authentication message that includes authentication information and identifies the protected information,

sending the authentication message to an authentication server for verification of the authentication information, wherein verification of the authentication information allows access to the protected information via the second computing device, and

after sending the authentication message to the authentication server for the verification of the authentication information, deleting the collected biometric data.

2. The method of claim 1, wherein verification of the authentication information includes a determination of whether the biometric data substantially matches stored biometric data, the method further comprising:

responsive to the determination being that the biometric data substantially matches the stored biometric data, the first computing device receiving information indicating that access to the protected information via the second computing device has been granted.

3. The method of claim 1, wherein verification of the authentication information includes a determination of whether the biometric data substantially matches stored biometric data, the method further comprising:

responsive to the determination being that the biometric data does not substantially match the stored biometric data, the first computing device;

receiving information indicating that access to the protected information has been denied, and

entering into a guest-operation mode, wherein the first computing device is configured to disable guest-operation-related functionality of the first computing device after entering the guest-operation mode, and wherein the first computing device is configured to enable the guest-operation-related functionality after exiting the guest-operation mode.

4. The method of claim 1, wherein the authentication information comprises encrypted biometric data generated by the first computing device based on the collected biometric data, wherein generating the encrypted biometric data comprises encoding additional data into the biometric data, wherein the additional data includes at least one identifier associated with the first computing device and a public key associated with the first computing device.

5. The method of claim 4, wherein the at least one identifier associated with the first computing device includes at least one of a serial number and a computer networking address.

6. The method of claim 4, wherein generating the encrypted biometric data further comprises encrypting the biometric data based at least in part on a private key associated with the first computing device.

7. The method of claim 1, wherein the biometric data includes eye-scan data corresponding to at least one eye.

8. The method of claim 1, wherein at least one of the machine-readable code and the protected information is displayed on a webpage.

9. The method of claim 1, wherein the machine-readable code comprises a bar code.

10. The method of claim 9, wherein the bar code comprises a two-dimensional bar code.

11. The method of claim 1, wherein the stored biometric data is stored locally at the first computing device.

12. The method of claim 1, wherein the stored biometric data is stored remotely at one or more of the authentication server and the second computing device.

13. The method of claim 1, wherein the first computing device is a head-mountable device (HMD), wherein the HMD includes an eyeglass frame configuration.

14. The method of claim 1, wherein generating the authentication message that includes the authentication information based at least in part on the biometric data comprises:

based at least in part on the collected biometric data, determining, by the first computing device, a digital signature for the collected biometric data using a locally-sensitive hash (LSH) function, wherein the digital signature is different from the biometric data;

based on the unique digital signature, generating, by the first computing device, an encryption of the digital signature, wherein the authentication information comprises the encryption of the digital signature; and

generating the authentication message that includes the authentication information.

15. The method of claim 1, wherein determining that the first computing device is being worn comprises determining that the first computing device is being worn on a head of a wearer.

16. The method of claim 15, wherein determining that the first computing device is being worn on the head of the wearer comprises causing one or more sensors associated with the first computing device to detect a pulse of the wearer.

17. The method of claim 15, wherein determining that the first computing device is being worn on the head of the wearer comprises causing one or more sensors associated with the first computing device to perform actions to detect a live eye of the wearer.

18. A first computing device, comprising:

at least one processor; and

a non-transitory computer-readable storage medium having stored thereon program instructions that, upon execution by the at least one processor, cause the first computing device to perform functions comprising;

determining that the first computing device is being worn;

while the first computing device is determined to be worn, detecting a machine-readable code that is displayed by a second computing device, wherein the machine-readable code identifies protected information that is viewable via the second computing device; and

responsive to detecting the machine-readable code while the first computing device is determined to be worn;

causing one or more biometric sensors associated with the first computing device to perform actions to collect biometric data after the first computing device detects the machine-readable code,

based at least in part on the biometric data, generating an authentication message that includes authentication information and identifies the protected information,

sending the authentication message to an authentication server for verification of the authentication information, wherein verification of the authentication information allows access to the protected information via the second computing device, and

after sending the authentication message to the authentication server for the verification of the authentication information, deleting the collected biometric data.

19. The first computing device of claim 18, wherein verification of the authentication information includes a determination of whether the biometric data substantially matches stored biometric data, the functions further comprising:

responsive to the determination being that the biometric data substantially matches the stored biometric data, the first computing device receiving information indicating that access to the protected information via the second computing device has been granted.

20. The first computing device of claim 18, wherein the machine-readable code is detected by at least one first sensor associated with the first computing device, and wherein the first computing device causes at least one second sensor associated with the first computing device to perform the actions to collect the biometric data after the at least one first sensor detects the machine-readable code.

21. The first computing device of claim 20, wherein the at least one first sensor and the at least one second sensor each includes one or more of:

an infrared proximity sensor, an infrared photodiode, and a camera.

22. The first computing device of claim 18, wherein the machine-readable code is displayed on a first webpage by the second computing device and the protected information is displayed on a second webpage by the second computing device.

23. The first computing device of claim 22, wherein the machine-readable code includes encoded information associated with the first webpage including one or more of:

a uniform resource locator (URL) of the first webpage, an internet protocol (IP) address of the first webpage, a public key of the first webpage, and a time at which the information associated with the first webpage is received.

24. The first computing device of claim 18, wherein verification of the authentication information includes a determination of whether the biometric data substantially matches stored biometric data, the functions further comprising:

determining that the biometric data substantially matches the stored biometric data; and

responsively determining a password associated with the protected information, wherein the password is configured to allow access to the protected information.

25. The first computing device of claim 18, wherein the functions further comprise:

after determining that the first computing device is being worn, after detecting the machine-readable code, and before collecting the biometric data;

the first computing device receiving a challenge signal requesting a verification response verifying the authenticity of a wearer of the first computing device using the biometric data;

responsive to receiving the challenge signal, transmitting an acknowledgement signal; and

after transmitting the acknowledgement signal, the first computing device enabling the one or more biometric sensors to perform the actions to collect the biometric data.

26. The first computing device of claim 18, wherein the authentication information includes at least one identifier associated with the first computing device, wherein the at least one identifier includes one or more of a serial number of the first computing device, a public key of the first computing device, and an IP address of the first computing device.

27. The first computing device of claim 18, wherein the biometric data includes eye-scan data corresponding to at least one eye of a user operating the first computing device, and wherein the actions to collect the biometric data after the first computing device detects the machine-readable code comprise scanning the at least one eye of the user so as to capture the eye-scan data.