Distributing biometric authentication between devices in an ad hoc network

Patent metadata

Field	Value
Publication number	US-2016127900-A1
Application number	US-201414532608-A
Country	US
Kind code	A1
Filing date	Nov 4, 2014
Priority date	Nov 4, 2014
Publication date	May 5, 2016
Grant date	—

Abstract

One feature pertains to biometric authentication of a user between devices. In one aspect, an ad hoc personal wireless network may include a primary device and one or more secondary devices using grouping policies such proximity policies and other permissions. The primary device shares a biometric authentication value of a user with the one or more secondary devices. Each secondary device may then perform additional authentication of the same user using a relatively low reliability biometric sensor such as a digital camera for facial recognition, a microphone for voice recognition or an accelerometer for gesture recognition. The secondary authentication results may be combined with the biometric authentication score/level from the primary device to form a final authentication score/level of the secondary device, which is used to authenticate the user of the secondary device for one or more transactions such as consumer purchases, secure content access, or secure control.

First claim

What is claimed is:

1 . A method operational by a primary device for authentication of a user, comprising:
obtaining at least one biometric parameter representative of a user of the primary device; determining a primary authentication value representative of a degree of authentication of the user of the primary device based on the at least one biometric parameter; authenticating the user of the primary device based on the primary authentication value; and sharing the primary authentication value with a secondary device to facilitate authentication of the user.

2 . The method of claim 1 , wherein the primary authentication value representative of a degree of authentication of the user is at least one of: (a) an authentication score, or (b) a trust level.

3 . The method of claim 1 , further including detecting a trigger for deauthenticating the user of the primary device and, in response, deauthenticating the user of the primary device and the secondary device.

4 . The method of claim 3 , wherein the trigger for deauthenticating the user of the primary device includes at least one of: (a) a user initiated primary device deauthentication, (b) a primary device timeout, or (c) a primary device threat indication representative of a security compromise of the primary device.

5 . The method of claim 1 , further including detecting a trigger for deauthenticating the user of the secondary device and, in response, sending a signal to the secondary device to deauthenticate the user of the secondary device.

6 . The method of claim 5 , wherein the trigger for deauthenticating the user of the secondary device includes at least one of: (a) a user initiated secondary device deauthentication, (b) a secondary device timeout, (c) a secondary device threat indication representative of a security compromise of the secondary device, (d) a loss of communication with the secondary device, (e) a loss of commonality between the primary device and the secondary device, or (f) a violation of a predetermined permission policy.

7 . The method of claim 6 , wherein the loss of commonality between the primary device and the secondary device includes a loss of commonality in at least one of ambient noise, ambient light, location, motion, or a shared communication link.

8 . The method of claim 1 , wherein the primary device is at least one of:
(a) a control computer of a vehicle and wherein the secondary device is a mobile device in proximity to the vehicle; (b) a control computer of a building and wherein the secondary device is a mobile device in proximity to the building; or (c) a smartphone and wherein the secondary device is at least one of a smartwatch, a pair of smartglasses, a mobile health monitor, or an article of smartclothing.

9 . The method of claim 1 , wherein the primary device and secondary device communicate via an ad hoc wireless network.

10 . A primary device, comprising:
a biometric parameter detector configured to obtain at least one biometric parameter representative of a user of a primary device; a transmitter; and a processing circuit coupled to the biometric parameter detector and the transmitter, the processing circuit configured to
determine a value representative of a degree of authentication of the user of the primary device based on the at least one biometric parameter,
authenticate the user of the primary device based on the value representative of the degree of authentication, and
share the value representative of the degree of authentication with a secondary device using the transmitter to facilitate authentication of the user.

11 . The primary device of claim 10 , wherein the value representative of a degree of authentication of the user is at least one of: (a) an authentication score, or (b) a trust level.

12 . The primary device of claim 10 , wherein the processing circuit is further configured to detect a trigger for deauthenticating the user of the primary device and, in response, to deauthenticate the user of the primary device and the secondary device.

13 . The primary device of claim 12 , wherein the trigger for deauthenticating the user of the primary device includes at least one of: (a) a user initiated primary device deauthentication, (b) a primary device timeout, or (c) a primary device threat indication representative of a security compromise of the primary device.

14 . The primary device of claim 10 , wherein the processing circuit is further configured to detect a trigger for deauthenticating the user of the secondary device and, in response, to send a signal to the secondary device using the transmitter to deauthenticate the user of the secondary device.

15 . The primary device of claim 14 , wherein the trigger for deauthenticating the user of the secondary device includes at least one of: (a) a user initiated secondary device deauthentication, (b) a secondary device timeout, (c) a secondary device threat indication representative of a security compromise of the secondary device, (d) a loss of communication with the at least one secondary device, (e) a loss of commonality between the primary device and the secondary device, or (f) a violation of a predetermined permission policy.

16 . The primary device of claim 15 , wherein the loss of commonality between the primary device and the secondary device includes a loss of commonality in at least one of ambient noise, ambient light, location, motion, or a shared communication link.

17 . The primary device of claim 10 , wherein the primary device and secondary device communicate via an ad hoc wireless network.

18 . A method operational by a secondary device for authentication of a user of the secondary device, comprising:
receiving a primary authentication value representative of a degree of authentication of the user from a primary device; and determining whether to perform a secondary authentication of the user and, if secondary authentication is to be performed, then
(a) obtaining at least one biometric parameter representative of the user using the secondary device,
(b) determining a secondary authentication value representative of a degree of authentication of the user based on the at least one biometric parameter obtained using the secondary device,
(c) combining the primary authentication value received from the primary device with the secondary authentication value to yield a combined authentication value, and
(d) authenticating the user of the secondary device using the combined authentication value.

19 . The method of claim 18 , further including detecting a trigger for deauthenticating the user of the secondary device and, in response, deauthenticating the user of the secondary device and notifying the primary device.

20 . The method of claim 19 , wherein the trigger for deauthenticating the user of the secondary device includes at least one of: (a) a user initiated secondary device deauthentication, (b) a secondary device timeout, (c) a secondary device threat indication representative of a security compromise of the secondary device, or (d) a primary device threat indication representative of a security compromise of the primary device.

21 . The method of claim 18 , further including detecting a primary device threat indication at the secondary device and sending a signal to the primary device to deauthenticate the user of the primary device.

22 . The method of claim 18 , wherein obtaining at least one biometric parameter using the secondary device

Assignees

• Qualcomm Inc

Inventors

• John Archibald Fitzgerald
• Schneider John

Classifications

• H04W12/06 Primary

  Authentication · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• H04W84/18

  Self-organising networks, e.g. ad-hoc networks or sensor networks · CPC title

• H04W12/33

  using wearable devices, e.g. using a smartwatch or smart-glasses · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title