Methods and apparatus for authentication in an electronic device

Patent metadata

Field	Value
Publication number	US-10552595-B2
Application number	US-201715804714-A
Country	US
Kind code	B2
Filing date	Nov 6, 2017
Priority date	Nov 7, 2016
Publication date	Feb 4, 2020
Grant date	Feb 4, 2020

Abstract

Embodiments of the invention provide methods and apparatus for monitoring the routing configuration within an electronic device such that a biometric authentication process can be carried out without interference from other components of the device, such as may occur when the device has become infected with malware for example. The invention may provide a codec or speaker recognition processor, coupled to receive biometric input data, comprising a security module that determines whether a routing configuration complies with one or more rules. The security module may be implemented to prevent genuine biometric data from being output from the speaker recognition processor, and/or to prevent spoof biometric data from being inserted into the authentication module.

First claim

The invention claimed is:

1. A biometric authentication system, comprising:
one or more inputs, for receiving biometric input signals from a user;
a biometric authentication module having one or more biometric authentication module inputs, and being configured to carry out biometric authentication of signals received at the one or more biometric authentication module inputs and generate an authentication result;
a control interface, for receiving one or more control signals from an application processor;
a routing module, having a set of routing inputs and a set of routing outputs, at least one of the routing inputs being coupled to the one or more inputs and at least one of the routing outputs being coupled to the biometric authentication module, the routing module being configurable by the one or more control signals to route signals from one or more of the routing inputs to one or more of the routing outputs; and
a security module, operable to determine whether a routing module configuration complies with one or more rules and, responsive to a determination that the routing module configuration does not comply with one or more of the one or more rules, generate a signal indicating that the routing module configuration is insecure.

2. The biometric authentication system according to claim 1 , wherein the security module is operable in a plurality of modes, and wherein each mode has a respective set of one or more rules for determining whether a routing module configuration is secure or not.

3. The biometric authentication system according to claim 2 , wherein the plurality of modes includes one or more of a biometric authentication mode and a biometric enrolment mode.

4. The biometric authentication system according to claim 3 , wherein the security module is operable in the biometric authentication mode or the biometric enrolment mode to determine whether the routing module configuration is such that signal paths terminating at the one or more biometric authentication module inputs originate from one of a plurality of predefined secure inputs and, responsive to a determination that one or more signal paths terminating at the one or more biometric authentication module inputs do not originate from a predefined secure input, determine that the routing module configuration does not comply with one of the one or more rules.

5. The biometric authentication system according to claim 3 , wherein the security module is operable in the biometric authentication mode or the biometric enrolment mode to determine whether the routing module configuration is such that any signal path originating at the one or more inputs terminates at an output interface of the biometric authentication system and, responsive to a determination that one or more signal paths originating at the one or more inputs terminate at an output interface of the biometric authentication system, determine that the routing module configuration does not comply with one of the one or more rules.

6. The biometric authentication system according to claim 3 , wherein the security module is operable in the biometric authentication mode or the biometric enrolment mode to determine whether the routing module configuration is such that any signal path originating at the one or more inputs terminates at a node other than an input of the biometric authentication module and, responsive to a determination that one or more signal paths originating at the one or more inputs terminates at a node other than an input of the biometric authentication module, determine that the routing module configuration does not comply with one of the one or more rules.

7. The biometric authentication system according to claim 2 , wherein the plurality of modes includes a listen mode in which the biometric authentication module is configured to carry out biometric authentication of signals received at the one or more biometric authentication module inputs, responsive to receipt of a trigger indicating that the biometric input signals contain voice content.

8. The biometric authentication system according to claim 7 , wherein the security module is operable in the listen mode to determine whether the routing module configuration complied with one or more rules during a time window in which the voice content was uttered.

9. The biometric authentication system according to claim 8 , wherein the security module is operable in the listen mode to determine whether the routing module configuration during the time window was such that:
signal paths terminating at the one or more biometric authentication module inputs originated from a secure input and, responsive to a determination that one or more signal paths terminating at the one or more biometric authentication module inputs did not originate from a secure input, determine that the routing module configuration did not comply with one of the one or more rules;
any signal path originating at the one or more inputs terminated at an output interface of the biometric authentication system and, responsive to a determination that one or more signal paths originating at the one or more inputs terminated at an output interface of the biometric authentication system, determine that the routing module configuration did not comply with one of the one or more rules; or
any signal path originating at the one or more inputs terminated at a node other than an input of the biometric authentication module and, responsive to a determination that one or more signal paths originating at the one or more inputs terminated at a node other than an input of the biometric authentication module, determine that the routing module configuration did not comply with one of the one or more rules.

10. The biometric authentication system according to claim 4 , wherein the security module is operable to access a configuration file containing a list of secure inputs in the biometric authentication system.

11. The biometric authentication system according to claim 4 , wherein the predefined plurality of secure inputs comprise a subset of the inputs, being those inputs coupled to a predefined set of inputs of the routing module.

12. The biometric authentication system according to claim 2 , wherein the security module is configured to determine whether a routing module configuration complies with one or more rules upon receipt of a request to enter a particular mode.

13. The biometric authentication system according to claim 1 , wherein one of the following applies:
the biometric authentication module is configured to abort the biometric authentication responsive to generation of the signal indicating that the routing module configuration is insecure;
the security module is configured to invalidate the authentication result responsive to generation of the signal indicating that the routing module configuration is insecure; and
the security module is configured to append to the authentication result an indication that the routing module configuration did not comply with one or more of the one or more rules, responsive to generation of the signal indicating that the routing module configuration is insecure.

14. The biometric authentication system according to claim 1 , further comprising a data-authentication module operable to authenticate the authentication result.

15. An electronic device comprising a biometric authentication system as claimed in claim 1 .

16. The electronic device as claimed in claim 15 , further comprising an application processor in communication with the biometric authentication system.

17. The electronic device as claimed in c

Assignees

• Cirrus Logic Int Semiconductor Ltd
• Cirrus Logic Inc

Inventors

• Oswal Nikesh
• Roberts Ryan
• Page Michael

Classifications

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/32 Primary

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title

• G06F21/70

  Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer · CPC title

• G06F3/165

  Management of the audio stream, e.g. setting of volume, audio stream path · CPC title

• G10L17/24

  the user being prompted to utter a password or a predefined phrase · CPC title