Authentication techniques in response to attempts to access sensitive information

Patent metadata

Field	Value
Publication number	US-10824705-B2
Application number	US-201815980694-A
Country	US
Kind code	B2
Filing date	May 15, 2018
Priority date	Jun 4, 2017
Publication date	Nov 3, 2020
Grant date	Nov 3, 2020

Abstract

The present disclosure describes techniques for changing a required authentication type based on a request for a particular type of information. For example, consider a situation where a user has asked a virtual assistant “who owns this device?” By default, the device may allow biometric authentication to unlock. In response to identification of the owner by the virtual assistant, however, the device may require one or more other types of authentication (e.g., manual entry of a passcode) to unlock the device. In various embodiments, the disclosed techniques may increase the security of the device by making it more difficult for malicious entities to obtain the sensitive information or to access device functionality once the sensitive information has been disclosed. In various embodiments, this may prevent or reduce unauthorized access to the device.

First claim

What is claimed is:

1. An apparatus, comprising:
one or more processing elements configured to:
store a set of personal identification information that includes information that identifies a user of the apparatus;
authorize a request for a first action using a first type of authentication during a first mode of operation;
detect that the apparatus has, in response to user input, output at least a portion of the set of personal identification information externally to the apparatus in visual or audio form; and
in response to detecting the external output of the at least a portion of the set of personal identification information that identifies the user, change to a second, different mode of operation in which the one or more processing elements require a user to perform a second, different type of authentication before authorizing a request for the first action.

2. The apparatus of claim 1 , wherein the first action is unlocking the apparatus and wherein the at least a portion of the set of personal identification information is externally output while the apparatus is in a locked state.

3. The apparatus of claim 1 , wherein the external output is performed by a virtual assistant program.

4. The apparatus of claim 1 , wherein the one or more processing elements include a secure circuit configured to control access to the information that identifies the user and wherein the apparatus is configured such that other processing elements in the apparatus are configured to communicate with the secure circuit via only a predetermined subset of circuitry included in the secure circuit, wherein hardware resources of the secure circuit, other than the predetermined subset of circuitry, are not accessible to the other processing elements in the apparatus.

5. The apparatus of claim 4 , wherein the first type of authentication is a biometric authentication and wherein the secure circuit is configured to control access to template information for one or more known users for comparison with input information for the biometric authentication.

6. The apparatus of claim 4 , wherein the secure circuit is configured to issue a token to another processing element based on the first type of authentication for the user and wherein the secure circuit is configured to invalidate the token in response to the external output.

7. The apparatus of claim 6 , wherein the other processing element is a secure element configured to perform payment transactions.

8. The apparatus of claim 1 , wherein the external output includes display of information via a lock screen interface generated by the apparatus.

9. The apparatus of claim 1 , wherein the external output includes physical removal of a storage element from the apparatus.

10. The apparatus of claim 1 , wherein the information that identifies the user is usable to determine the user's name.

11. The apparatus of claim 10 , wherein the information that identifies the user includes one or more of: an account name, medical information, a username, or contact information.

12. The apparatus of claim 1 , wherein the apparatus is configured to, in response to detecting the external output, instruct another device of the user to require a non-default type of authentication.

13. The apparatus of claim 1 , wherein in the second mode of operation the one or more processing elements require both the first and second types of authentication before authorization a request for the first action.

14. A non-transitory computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:
store a set of personal identification information that includes information that identifies a user of the computing device;
in a first mode of operation, authorizing a request for a first action based on a first type of authentication; and
in response to detecting visual or audio external output of at least a portion of the set of personal identification information that identifies the user by the computing device, causing the computing device to change to a second mode of operation, wherein, in the second mode of operation, the computing device requires a user to perform a second type of authentication before authorizing a request for the first action.

15. The non-transitory computer-readable medium of claim 14 , wherein the first action is unlocking the computing device via a lock screen, wherein the first type of authentication is biometric authentication and the second type of authentication requires manual entry of a passcode.

16. The non-transitory computer-readable medium of claim 14 , wherein the external output of the information that identifies the user is performed by a virtual assistant.

17. The non-transitory computer-readable medium of claim 14 , wherein access to the information that identifies the user is controlled by a secure circuit in the computing device, wherein other processing elements in the computing device are configured to communicate with the secure circuit via only a predetermined subset of circuitry included in the secure circuit, wherein hardware resources of the secure circuit, other than the predetermined subset of circuitry, are not accessible to the other processing elements in the computing device.

18. The non-transitory computer-readable medium of claim 17 , wherein the secure circuit is also configured to control access to biometric template information for one or more known users.

19. The non-transitory computer-readable medium of claim 17 , wherein at least a portion of the instructions are executable by the secure circuit.

20. The non-transitory computer-readable medium of claim 14 , wherein the first type of authentication is a biometric authentication and wherein the second type of authentication requires manual entry of an authentication credential.

21. A non-transitory computer readable storage medium having stored thereon design information that specifies a design of at least a portion of a hardware integrated circuit in a format recognized by a semiconductor fabrication system that is configured to use the design information to produce the hardware integrated circuit according to the design, including:
one or more processing elements configured to:
store a set of personal identification information that includes information that identifies a user of an apparatus that includes the hardware integrated circuit;
in a first mode of operation, authorize a request for a first action based on a first type of authentication; and
in response to detecting external output of at least a portion of the set of personal identification information that identifies the user by the apparatus that includes the hardware integrated circuit, change to a second mode of operation, wherein, in the second mode of operation, the one or more processing elements are configured to require a user to perform a second type of authentication before authorizing a request for the first action.

22. The non-transitory computer readable storage medium of claim 21 , wherein the one or more processing elements include a secure circuit configured to control access to the information that identifies the user and wherein the design is configured such that other processing elements in the design are configured to communicate with the secure circuit via only a predetermined subset of circuitry included in the secure circuit, wherein hardware resources of the secure circuit, other than the predetermined subset of circuitry, are

Assignees

• Apple Inc

Inventors

• Ballard Lucia E
• Hauck Jerrold V
• Prakash Deepti S
• Cibulka Jan
• Krstic Ivan

Classifications

• H04M1/724631

  by limiting the access to the user interface, e.g. locking a touch-screen or a keypad · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• H04W12/084

  using delegated authorisation, e.g. open authorisation [OAuth] protocol · CPC title

• H04W12/068

  using credential vaults, e.g. password manager applications or one time password [OTP] applications · CPC title

• H04W12/40

  Security arrangements using identity modules · CPC title