Authentication techniques in response to attempts to access sensitive information

Patent metadata

Field	Value
Publication number	US-11537699-B2
Application number	US-202017084172-A
Country	US
Kind code	B2
Filing date	Oct 29, 2020
Priority date	Jun 4, 2017
Publication date	Dec 27, 2022
Grant date	Dec 27, 2022

Abstract

The present disclosure describes techniques for changing a required authentication type based on a request for a particular type of information. For example, consider a situation where a user has asked a virtual assistant “who owns this device?” By default, the device may allow biometric authentication to unlock. In response to identification of the owner by the virtual assistant, however, the device may require one or more other types of authentication (e.g., manual entry of a passcode) to unlock the device. In various embodiments, the disclosed techniques may increase the security of the device by making it more difficult for malicious entities to obtain the sensitive information or to access device functionality once the sensitive information has been disclosed. In various embodiments, this may prevent or reduce unauthorized access to the device.

First claim

What is claimed is:

1. A non-transitory computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:
storing personal information corresponding to a user of the computing device;
authorizing a request for a first action using a first type of authentication during a first mode of operation;
detecting that the computing device has received user input that requests an operation, wherein the operation includes to output at least a portion of the personal information externally to the computing device in audio or visual form; and
in response to the detecting, changing to a second mode of operation in which a user is required to perform a second type of authentication before authorizing a request for the first action, wherein the second type of authentication is a different than the first type of authentication.

2. The non-transitory computer-readable medium of claim 1 , wherein the operations further comprise:
externally outputting the at least a portion of the personal information in response to the request.

3. The non-transitory computer-readable medium of claim 1 , wherein the user input is detected via a microphone.

4. The non-transitory computer-readable medium of claim 1 , wherein the first type of authentication requires a biometric authentication and the second type of authentication requires a passcode authentication.

5. The non-transitory computer-readable medium of claim 1 , wherein the second type of authentication requires a greater number of authentication credentials than the first type of authentication.

6. The non-transitory computer-readable medium of claim 1 , wherein the operations further comprise:
revoking, in response to the detecting, a token that was issued based on the first type of authentication.

7. The non-transitory computer-readable medium of claim 1 , wherein the information corresponding to the user of the computing device includes one or more of: an account name, medical information, a username, contact information, or information usable to determine the user's name.

8. The non-transitory computer-readable medium of claim 1 , wherein the operations further comprise:
instructing another device of the user to require a non-default type of authentication for an action.

9. The non-transitory computer-readable medium of claim 1 , wherein in the second mode of operation the user is required to perform both the first and second types of authentication before authorizing a request for the first action.

10. An apparatus, comprising:
one or more processor circuits configured to:
store personal information corresponding to a user of the apparatus;
authorize a request for a first action using a first type of authentication during a first mode of operation;
detect that the apparatus has received user input that requests an operation, wherein the operation includes to output at least a portion of the personal information externally to the apparatus in audio or visual form; and
in response to the detection, change to a second mode of operation in which the one or more processor circuits require a user to perform a second type of authentication before authorizing a request for the first action, wherein the second type of authentication is a different than the first type of authentication.

11. The apparatus of claim 10 , wherein the one or more processor circuits are further configured to:
externally outputting the at least a portion of the personal information in response to the request.

12. The apparatus of claim 10 , further comprising:
a microphone, wherein the user input is detected via the microphone.

13. The apparatus of claim 10 , wherein the first type of authentication requires a biometric authentication and the second type of authentication requires a passcode authentication.

14. The apparatus of claim 10 , wherein the one or more processor circuits are further configured to:
revoke, in response to the detection, a token that was issued based on the first type of authentication.

15. The apparatus of claim 10 , wherein the one or more processor circuits include a secure circuit configured to control access to the personal information and wherein the apparatus is configured such that other processing elements in the apparatus are configured to communicate with the secure circuit via only a predetermined subset of circuitry included in the secure circuit, wherein hardware resources of the secure circuit, other than the predetermined subset of circuitry, are not accessible to the other processing elements in the apparatus.

16. A method, comprising:
storing, by a computing device, personal information corresponding to a user of the computing device;
authorizing, by the computing device, a request for a first action using a first type of authentication during a first mode of operation;
detecting, by the computing device, that the computing device has received user input that requests an operation, wherein the operation includes to output at least a portion of the personal information externally to the computing device in audio or visual form; and
in response to the detecting, the computing device changing to a second mode of operation in which a user is required to perform a second type of authentication before authorizing a request for the first action, wherein the second type of authentication is a different than the first type of authentication.

17. The method of claim 16 , wherein the user input is detected via a microphone.

18. The method of claim 16 , wherein the first type of authentication requires a biometric authentication and the second type of authentication requires a passcode authentication.

19. The method of claim 16 , further comprising:
revoking, in response to the detecting, a token that was issued based on the first type of authentication.

20. The method of claim 16 , further comprising:
instructing another device of the user to require a non-default type of authentication for an action.

Assignees

• Apple Inc

Inventors

• Ballard Lucia E
• Hauck Jerrold V
• Prakash Deepti S
• Cibulka Jan
• Krstic Ivan

Classifications

• H04M1/724631

  by limiting the access to the user interface, e.g. locking a touch-screen or a keypad · CPC title

• G06Q20/3227

  using secure elements embedded in M-devices · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• H04L9/3231

  Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861) · CPC title

• G06F21/32 Primary

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title