Methods and devices for secure authentication to a compute device

• US 10,715,654 B1
• Filed: 05/23/2019
• Issued: 07/14/2020
• Est. Priority Date: 05/20/2014
• Status: Active Grant

• Current Assignee: Invincea, Inc. (Sophos Group Ltd.)
• Original Assignee: Invincea, Inc. (Sophos Group Ltd.)
• Inventors: Lack, Michael Nathan
• Primary Examiner(s): Lai, Daniel
• Application Number:
  US16/420,916
• Time in Patent Office: 418 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04B 5/72 for local intradevice communication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04M 1/67 by electronic means
• CPC Class Codes: H04M 1/724631 by limiting the access to the user interface, e.g. locking a touch-screen or a keypad
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

An apparatus includes a memory of a mobile compute device, and a hardware processor of the mobile compute device. The hardware processor is configured to implement an operating system and an authentication module. The operating system is configured to receive a first authentication identifier, and is also configured to authorize use of the mobile compute device based on the first authentication identifier meeting a first criterion. The authentication module is configured to, in response to the operating system authorizing use of the mobile compute device, disable at least one function of the mobile compute device and request a second authentication identifier. The authentication module is also configured to receive the second authentication identifier. The authentication module is also configured to enable the at least one function in response to the second authentication identifier meeting a second criterion.

Claims

1. An apparatus, comprising:

a memory of a mobile compute device; and

a hardware processor of the mobile compute device, the hardware processor configured to implement an operating system and a native authentication application,

the operating system configured to receive an authentication identifier, the operating system configured to authorize use of the mobile compute device based on the authentication identifier meeting a first criterion,

the native authentication application configured to, in response to the operating system authorizing use of the mobile compute device, disable at least one function of the mobile compute device and transmit a request for a biometric authentication identifier,

the native authentication application configured to receive the biometric authentication identifier via a biometric interface associated with the mobile compute device, the biometric authentication identifier including an indication of biometric information, the native authentication application configured to enable the at least one function in response to the biometric authentication identifier meeting a second criterion,

a timeout time period associated with the operating system periodically requesting the authentication identifier is different from a timeout time period associated with the native authentication application periodically requesting the biometric authentication identifier.

2. The apparatus of claim 1, wherein the authentication identifier is associated with an operating system-based authentication mode and the biometric authentication identifier is associated with a non-operating system-based authentication mode.

3. The apparatus of claim 1, wherein the biometric interface is a fingerprint scanning interface, the native authentication application configured to receive the biometric authentication identifier from the fingerprint scanning interface.

4. The apparatus of claim 1, wherein the biometric interface is a facial scanning interface, the native authentication application configured to receive the biometric authentication identifier from the facial scanning interface.

5. The apparatus of claim 1, wherein the native authentication application is not part of the operating system, is executed by the operating system, but is not integrated with the operating system.

6. The apparatus of claim 1, wherein the biometric authentication identifier is a first instance of the biometric authentication identifier, and the native authentication application is configured to:

receive a second instance of the biometric authentication identifier, including a stored copy of the biometric information, from the memory of the mobile compute device;

compare the indication of the biometric information with the stored copy of the biometric information;

generate, based on the comparing, a value associated with a match between the indication of the biometric information and the stored copy of the biometric information; and

compare the value with the second criterion, in response to receiving the first instance of the biometric authentication identifier.

7. The apparatus of claim 1, wherein the native authentication application is configured to register with the operating system to receive an indication from the operating system that the operating system has authorized use of the mobile compute device.

8. The apparatus of claim 1, wherein the native authentication application is configured to monitor for an indication broadcast by the operating system that the operating system has authorized use of the mobile compute device.

9. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive, using a native application that is not part of an operating system on a mobile compute device, an indication that the operating system has authorized use of the mobile compute device;

disable, at a first time and using the native application and in response to receiving the indication, at least one function of the mobile compute device;

request a biometric authentication identifier from a biometric interface associated with the mobile compute device;

receive, from the biometric interface and at a second time after the first time, the biometric authentication identifier; and

enable the at least one function of the mobile compute device when the biometric authentication identifier meets a predetermined criterion.

10. The non-transitory processor-readable medium of claim 9, wherein the biometric authentication identifier includes an indication of a fingerprint.

11. The non-transitory processor-readable medium of claim 9, wherein the biometric authentication identifier includes an indication of a face.

12. The non-transitory processor-readable medium of claim 9, wherein the biometric authentication identifier is a first authentication identifier and the predetermined criterion is a first predetermined criterion,

the code to cause the processor to disable includes code to cause the processor to disable the at least one function of the mobile compute device in response to the operating system of the mobile compute device authorizing use of the mobile compute device based on a second authentication identifier meeting a second predetermined criterion.

13. The non-transitory processor-readable medium of claim 9, wherein the biometric authentication identifier is a first instance of the biometric authentication identifier, the code further comprising code to cause the processor to:

receive a second instance of the biometric authentication identifier, including a stored copy of biometric information;

compare biometric information of the first instance of the biometric authentication identifier with the stored copy of the biometric information;

generate, based on the comparing, a value associated with a match between the biometric information of the first instance of the biometric authentication identifier and the stored copy of the biometric information; and

compare the value with the predetermined criterion, in response to receiving the first instance of the biometric authentication identifier.

14. The non-transitory processor-readable medium of claim 9, wherein the native application that is not part of the operating system on the mobile compute device is executed by the operating system of the mobile compute device.

15. The non-transitory processor-readable medium of claim 9, wherein the code to cause the processor to enable includes code to cause the processor to enable the at least one function of the mobile compute device at a third time after the second time, the code further comprising code to cause the processor to:

disable the at least one function of the mobile compute device a predetermined time period after the third time.

16. The non-transitory processor-readable medium of claim 9, the code further comprising code to cause the processor to:

register with the operating system to receive the indication at the native application.

17. The non-transitory processor-readable medium of claim 9, the code further comprising code to cause the processor to:

monitor, using the native application, for the indication broadcast by the operating system.

18. A method, comprising:

disabling, via a native authentication application, at least one function of a mobile compute device;

receiving, via the native authentication application, at a first time and in response to the disabling, a biometric authentication identifier;

receiving via an operating system, at a second time after the first time, and based on the biometric authentication identifier meeting a first criterion, an authentication identifier,

authorizing, via the operating system, use of the mobile compute device based on the authentication identifier meeting a second criterion;

receiving, via the native authentication application, an indication from the operating system that the operating system has authorized use of the mobile compute device; and

enabling, via the native authentication, the at least one function in response to the receiving the indication.

19. The method of claim 18, wherein the biometric authentication identifier is a first instance of the biometric authentication identifier, the method further comprising:

receiving, via the native authentication application, a second instance of the biometric authentication identifier from a memory associated with the mobile compute device;

comparing the first instance of the biometric authentication identifier and the second instance of the biometric authentication identifier to generate a value indicating a match between the first instance of the biometric authentication identifier and the second instance of the biometric authentication identifier; and

enabling the at least one function in response to the value meeting the first criterion.