Multiple user authentications on a communications device

• US 9,497,191 B2
• Filed: 11/07/2014
• Issued: 11/15/2016
• Est. Priority Date: 06/15/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Pall, Gurdeep S.
• Primary Examiner(s): Anderson, Michael D
• Application Number:
  US14/535,560
• Publication Number:
  US 20150067801A1
• Time in Patent Office: 739 Days
• Field of Search: 713/186
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04M 1/2535 adapted for voice communication over an Internet Protocol [IP] network Voice over Internet Protocol (VoIP) network equipment and services H04M7/006; implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] H04L69/16
• CPC Class Codes: H04M 1/67 by electronic means

Abstract

A communications device provides a biometric reader to authenticate users onto the communications device based on a single biometric input. The communications device maintains a local copy of the strong authentication credentials, such as a user identification and password, and the biometrics which were previously input by users of the communications device. Then, rather than requiring re-entry of the strong authentication credentials to authenticate (or re-authenticate) these users onto the communications device, the communications device is able to authenticate the users based on the input of the appropriate biometric. When a biometric input is received, the communications device identifies the locally stored strong authentication credentials that is associated with the input biometric, and uses the locally stored strong authentication credentials to authenticate the user.

Claims

1. A computer-implemented method for authenticating a first user of a communications device having a biometric reader, the method comprising:

receiving from the first user authentication credentials for authenticating the first user to a service, the service storing a copy of the authentication credentials;

storing on the communications device the authentication credentials;

receiving via the biometric reader of the communications device a first instance of a biometric characteristic from the first user;

storing on the communications device the first instance of the biometric characteristic in association with the stored authentication credentials;

after storing the first instance of the biometric characteristic and the authentication credentials,

receiving via the biometric reader a second instance of the biometric characteristic of a user;

determining whether the second instance of the biometric characteristic matches the first instance of the biometric characteristic; and

in response to determining that the second instance of the biometric characteristic matches the first instance of the biometric characteristic,

retrieving the authentication credentials that is stored in association with the first instance of the biometric characteristic; and

providing to the service the retrieved authentication credentials so that the service can authenticate the first user based on the stored copy of the authentication credentials.

2. The method of claim 1 wherein the biometric characteristic is a fingerprint scan.

3. The method of claim 1 wherein the biometric characteristic is a retina scan.

4. The method of claim 1 including authenticating the user by:

requesting log on to a server using the authentication credentials;

upon successfully logging on, allowing use of the communications device; and

upon unsuccessfully logging on, denying use of the communications device.

5. The method of claim 1 further comprising upon receiving a third instance of the biometric characteristic that matches the first instance of the biometric characteristic, authenticating the user using the authentication credentials.

6. A device for authenticating a user of the device, the device comprising:

a biometric reader;

one or more memories storing computer-executable instructions that control the device to;

receive authentication credentials for a first user, the authentication credentials not being a biometric characteristic;

receive via the biometric reader a first biometric characteristic for the first user;

associate the first biometric characteristic with the authentication credentials; and

after the first biometric characteristic is associated with the authentication credentials,

receive via the biometric reader a second biometric characteristic for a user;

determine whether the second biometric characteristic matches the first biometric characteristic;

in response to determining that the second biometric characteristic matches the first biometric characteristic, provide the authentication credentials to authenticate the first user; and

a processor for executing the computer-executable instructions stored in the one or more memories.

7. The device of claim 6 wherein the first biometric characteristic and the second biometric characteristic are fingerprint scans.

8. The device of claim 6 wherein the first biometric characteristic and the second biometric characteristic are retina scans.

9. The device of claim 6 wherein the instructions that provide further provide the authentication credentials to a server so that the server can authenticate the first user.

10. The device of claim 6 wherein the instructions that provide further provide the authentication credentials to an application so that the application can authenticate the first user.

11. The device of claim 6 wherein the instructions further comprise instructions that encrypt the authentication credentials.

12. The device of claim 6 wherein the instructions further comprise instructions that receive additional authentication credentials of the first user and encrypt a list of the authentication credentials and the additional authentication credentials.

13. The device of claim 12 wherein the instructions further comprise instructions that associate the first biometric characteristic with the additional authentication credentials.

14. The device of claim 6 wherein the instructions that provide further provide the authentication credentials for locally authenticating the first user to use a feature of the device.

15. One or more computer memories that store computer-executable instructions that control a communications device provide authentication credentials for authenticating a user of the communications device, the device having a biometric reader, the instructions comprising instructions control the communications device to:

receive authentication credentials from a first user;

receive via the biometric reader a first biometric characteristic from the first user;

encrypt the authentication credentials;

create a first representation of the first biometric characteristic;

store the encrypted authentication credentials and the first representation of the first biometric characteristic locally in non-volatile memory of the communications device; and

after the first representation of the first biometric characteristic and the authentication credentials are stored,

receive via the biometric reader a second biometric characteristic of a user;

create a second representation of the second biometric characteristic;

determine whether the second representation matches the first representation; and

in response to determining that the second representation matches the first representation,

retrieve the encrypted authentication credentials stored locally in non-volatile memory;

decrypt the encrypted authentication credentials for use in authenticating the first user; and

provide the decrypted authentication credentials for authenticating the first user.

16. The one or more computer memories of claim 15 wherein the first biometric characteristic and the second biometric characteristic are fingerprint scans.

17. The one or more computer memories of claim 15 wherein the first biometric characteristic and the second biometric characteristic are retina scans.

18. The one or more computer memories of claim 15 wherein the instructions that provide further comprise instructions to send the authentication credentials to a server so that the first user can be logged on to the server.

19. The one or more computer memories of claim 15 wherein instructions that provide further comprise instructions to provide the authentication credentials to an application so that the first user can use the application.

20. The one or more computer memories of claim 15 wherein the instructions further comprise instructions to receive additional authentication credentials of the first user and encrypt a list of the authentication credentials and the additional authentication credentials.

21. The one or more computer memories of claim 15 wherein the instructions further comprise instructions that associate the first biometric characteristic with the encrypted list.

22. The one or more computer memories of claim 15 wherein the authentication credentials are provided for locally authenticating the first user to use a feature of the communications device.