Authenticating a user of a system via an authentication image mechanism

• US 9,607,140 B2
• Filed: 02/24/2015
• Issued: 03/28/2017
• Est. Priority Date: 06/25/2012
• Status: Active Grant

• Current Assignee: Tahoe Research Limited (f/k/a Learndale Limited) (Vector Capital Corporation)
• Original Assignee: Intel Corporation
• Inventors: Smith, Ned M.
• Primary Examiner(s): Kim, Tae
• Assistant Examiner(s): KU, SHIUH-HUEI P
• Application Number:
  US14/629,646
• Publication Number:
  US 20150169862A1
• Time in Patent Office: 763 Days
• Field of Search: 380200-270, 709217-227, 713150-189, 726/2, 726 26- 28
• US Class Current: 1/1
• CPC Class Codes: G06F 21/36 by graphic or iconic representation

Abstract

In an embodiment, the present invention includes a method for receiving a request for user authentication of a system, displaying an authentication image on a display of the system using a set of random coordinates, receiving a plurality of gesture input values from the user, and determining whether to authenticate the user based at least in part on the plurality of gesture input values. Other embodiments are described and claimed.

Claims

1. A system comprising:

a display;

a processor to execute instructions;

a security processor coupled to the display via a trusted channel to authenticate a user of the system, the trusted channel inaccessible to an operating system of the system; and

a trusted storage coupled to the security processor to store an authentication image and at least one authentication gesture associated with the authentication image, wherein the security processor is to generate a display frame image having the authentication image included within a portion of the display frame image according to a set of random coordinates, provide the display frame image to the display via the trusted channel, receive at least one gesture input value from the user via an untrusted channel, and determine whether the user is authenticated based on the at least one gesture input value and the at least one authentication gesture.

2. The system of claim 1, wherein the security processor is to adjust the at least one gesture input value according to the set of random coordinates.

3. The system of claim 2, wherein the security processor is to compare the at least one adjusted gesture input value to the at least one authentication gesture.

4. The system of claim 3, wherein the security processor is to authenticate the user and allow the user to access the system if the at least one adjusted gesture input value is within a threshold of the at least one authentication gesture, and otherwise to not authenticate the user.

5. The system of claim 4, wherein if the at least one adjusted gesture input value is not within the threshold of the at least one authentication gesture, the security processor is to display a second authentication image within a portion of a second display frame image to be displayed on the display according to a second set of random coordinates to enable the user to retry an authentication.

6. The system of claim 1, wherein the security processor is to cause the display to sequentially display a plurality of authentication images each associated with a different set of random coordinates, and to authenticate the user if at least a threshold number of at least one gesture input value received from the user for a corresponding one of the plurality of authentication images matches a corresponding at least one authentication gesture associated with the one of the plurality of authentication images.

7. The system of claim 1, wherein the system is to create a secure channel with a remote system to receive the authentication image, and receive the authentication image via the secure channel responsive to a user selection of the authentication image.

8. The system of claim 1, wherein the display frame image comprises a lock screen image.

9. The system of claim 1, wherein the trusted channel is not visible to the operating system or an application to execute on the system.

10. At least one non-transitory machine-readable storage medium including instructions that when executed enable a system to perform a method comprising:

receiving, in a security engine of the system, a request for user authentication;

preparing, in the security engine, a display frame image including an authentication image, the display frame image larger than the authentication image and the authentication image having an anchor location identified by a set of random coordinates;

providing the display frame image including the authentication image within a portion of the display frame image from the security engine to a display of the system via a trusted channel for display of the display frame image on the display of the system, the trusted channel inaccessible to an operating system of the system; and

receiving a plurality of gesture input values from the user in the security engine via an untrusted channel of the system, and determining whether to authenticate the user based at least in part on the plurality of gesture input values.

11. The at least one non-transitory machine-readable storage medium of claim 10, further comprising instructions that when executed enable the computer to perform the method further comprising displaying the authentication image as a bitmap overlaid over the display frame image.

12. The at least one non-transitory machine-readable storage medium of claim 10, further comprising instructions that when executed enable the computer to perform the method further comprising displaying a sequence of authentication images, each having an anchor location identified by a corresponding set of random coordinates, and receiving a plurality of gesture input values from the user for each of the sequence of authentication images.

13. The at least one non-transitory machine-readable storage medium of claim 10, further comprising instructions that when executed enable the computer to perform the method further comprising authenticating the user if the plurality of gesture input values matches a stored set of authentication gestures associated with the authentication image, within a threshold.

14. The at least one non-transitory machine-readable storage medium of claim 13, further comprising instructions that when executed enable the computer to perform the method further comprising receiving the stored set of authentication gestures from the user during a security initialization procedure, in which the authentication image is located at an unrandomized set of coordinates.

15. The at least one non-transitory machine-readable storage medium of claim 14, further comprising instructions that when executed enable the computer to perform the method further comprising storing the stored set of authentication gestures in a trusted storage of the system.

16. The at least one non-transitory machine-readable storage medium of claim 10, further comprising instructions that when executed enable the computer to perform the method further comprising adjusting the plurality of gesture input values according to the set of random coordinates.

17. The at least one non-transitory machine-readable storage medium of claim 10, further comprising instructions that when executed enable the computer to perform the method further comprising, responsive to not authenticating the user for a first time, re-displaying the display frame image including the authentication image having a second anchor location identified by a second set of random coordinates, and receiving a second plurality of gesture input values from the user, and determining whether to authenticate the user based at least in part on the second plurality of gesture input values.

18. The at least one non-transitory machine-readable storage medium of claim 10, further comprising instructions that when executed enable the computer to perform the method, wherein the plurality of gesture input values are subject to access by malware executing on the system, and the authentication image within the display frame image is not subject to access by the malware.

19. A method comprising:

preparing, in a security engine of a system, an authentication image according to a first set of coordinates for display of the authentication image on a display of the system to obtain at least one authentication gesture from a user viewing the authentication image;

storing the authentication image and the at least one authentication gesture associated with the authentication image in a trusted storage of the system, wherein the authentication image is to be displayed on the display during an authorization challenge; and

generating, in the security engine of the system, a display frame image including the authentication image within a portion of the display frame image and anchored to a randomized set of coordinates within the display frame image, providing the display frame image via a trusted channel to the display of the system for display, the trusted channel inaccessible to an operating system of the system, receiving at least one gesture input value from the user based on the display frame image, and determining whether the user is authenticated based on the at least one gesture input value and the at least one authentication gesture.

20. The method of claim 19, further comprising adjusting the at least one gesture input value according to the randomized set of coordinates and comparing the at least one adjusted gesture input value to the at least one authentication gesture.