# US 8,752,146 B1 · Providing authentication codes which include token codes and biometric factors > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,146 B1 - Document ID: US8752146B1 - Status: Granted - Kind: B1 - Application number: 13/434,280 - Filed: 2012-03-29 - Granted: 2014-06-10 - Earliest claimed: 2012-03-29 - Assignees: EMC Corporation - Applicants: Marten van Dijk; Kevin D. Bowers; Samuel Curry; Sean P. Doyle; Nikolaos Triandopoulos; Riaz Zolfonoon - Inventors: Marten van Dijk; Kevin D. Bowers; Samuel Curry; Sean P. Doyle; Nikolaos Triandopoulos; Riaz Zolfonoon - Web page: https://patentgrep.com/patent/US8752146B1 ## CPC - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - G06F 21/43: wireless channels - H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)} - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 63/0838: {using one-time-passwords} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A technique provides authentication codes to authenticate a user to an authentication server. The technique involves generating, by an electronic apparatus (e.g., a smart phone, a tablet, a laptop, etc.), token codes from a cryptographic key. The technique further involves obtaining biometric measurements from a user, and outputting composite passcodes as the authentication codes. The composite passcodes include the token codes and biometric factors based on the biometric measurements. Additionally, the token codes and the biometric factors of the composite passcodes operate as authentication inputs to user authentication operations performed by the authentication server. In some arrangements, the biometric factors are results of facial recognition (e.g., via a camera), voice recognition (e.g., via a microphone), gate recognition (e.g., via an accelerometer), touch recognition and/or typing recognition (e.g., via a touchscreen or keyboard), combinations thereof, etc. ## Claims ### Claim 1 A method of providing authentication codes to authenticate a user to an authentication server, the method comprising: generating, by an electronic apparatus, token codes from a cryptographic key; obtaining, by the electronic apparatus, biometric measurements from a user; and outputting, by the electronic apparatus, composite passcodes as the authentication codes; wherein the composite passcodes include the token codes and biometric factors based on the biometric measurements; wherein the token codes and the biometric factors of the composite passcodes act as authentication inputs to user authentication operations performed by the authentication server; wherein the electronic apparatus is a mobile device which stores the cryptographic key and which runs a soft token application; wherein generating the token codes from the cryptographic key includes deriving, as the token codes, a series of one-time use passwords (OTPs) based on the cryptographic key using the soft token application, each OTP being valid during a respective time window and invalid outside that respective time window; wherein the mobile device is equipped with a set of biometric assessment applications; wherein the method further comprises processing, by the mobile device, the biometric measurements using the set of biometric assessment applications to form the biometric factors based on the biometric measurements; wherein the set of biometric assessment applications includes a typing recognition application; wherein obtaining the biometric measurements from the user includes capturing, by a keyboard of the mobile device, a set of current typing samples from the user during a current authentication attempt; wherein processing the biometric measurements using the set of biometric assessment applications includes identifying, using the typing recognition application, a deliberate mistyping and typing correction event provided by the user; and wherein outputting the composite passcodes as the authentication codes includes providing an alert to signal user distress to the authentication server in response to identification of the deliberate mistyping and typing correction event. ### Claim 2 (depends on 1) A method as in claim 1 wherein the set of biometric assessment applications further includes (i) a set of physiological characteristic recognition applications to compare current physiological measurements of the user to expected physiological measurements stored in the mobile device and (ii) a set of behavioral characteristic recognition applications to compare current behavioral measurements of the user to expected behavioral measurements stored in the mobile device; and wherein the method further comprises: performing a discovery operation to identify which physiological measurements and behavioral measurements are capable of being captured by the mobile device to run only a subset of the set of biometric assessment applications on the mobile device. ### Claim 3 (depends on 2) A method as in claim 2, further comprising: running different biometric assessment applications during different authentication attempts to alternate among the biometric assessment applications. ### Claim 4 (depends on 1) A method as in claim 1 wherein processing the biometric measurements using the set of biometric assessment applications to form the biometric factors further includes: providing, as a biometric factor, a binary result indicating whether biometric recognition is successful or unsuccessful. ### Claim 5 (depends on 1) A method as in claim 1 wherein processing the biometric measurements using the set of biometric assessment applications to form the biometric factors further includes: providing, as a biometric factor, a multi-bit score indicating a level of closeness between a current biometric measurement and an expected biometric measurement. ### Claim 6 (depends on 1) A method as in claim 1 wherein processing the biometric measurements using the set of biometric assessment applications to form the biometric factors further includes: providing, as a biometric factor, a multi-bit biometric measurement. ### Claim 7 (depends on 1) A method as in claim 1 wherein outputting the composite passcodes further includes: visually displaying, as a composite passcode for a particular authentication attempt, a character string sequence to the user through a display of the mobile device, the character string sequence defining a OTP and a biometric factor, the biometric factor defined by the character string sequence being un-discernable to the user. ### Claim 8 (depends on 1) A method as in claim 1 wherein outputting the composite passcodes further includes: transmitting, as a composite passcode for a particular authentication attempt, a character string sequence to the authentication server from the mobile device, the character string sequence defining a OTP and a biometric factor. ### Claim 9 An electronic apparatus, comprising: input/output (IO) circuitry; memory which stores a cryptographic key; and a controller coupled to the IO circuitry and the memory, the controller being constructed and arranged to: generate token codes from the cryptographic key, obtain biometric measurements from a user through the IO circuitry, and output, as authentication codes, composite passcodes through the IO circuitry; wherein the composite passcodes include the token codes and biometric factors based on the biometric measurements; wherein the token codes and the biometric factors of the composite passcodes act as authentication inputs to user authentication operations performed by an authentication server; wherein the controller, when obtaining the biometric measurements from the user, is constructed and arranged to capture, via the IO circuitry, a set of current typing samples from the user during a current authentication attempt; wherein the controller is further constructed and arranged to identify, using a typing recognition application, a deliberate mistyping and typing correction event provided by the user; and wherein the controller, when outputting the composite passcodes as the authentication codes, is constructed and arranged to provide an alert to signal user distress to the authentication server in response to identification of the deliberate mistyping and typing correction event. ### Claim 10 (depends on 9) An electronic apparatus as in claim 9 wherein the memory further stores a soft token application and a set of biometric assessment applications which includes the typing recognition application; wherein the controller, when generating the token codes from the cryptographic key, is constructed and arranged to derive, as the token codes, a series of one-time use passwords (OTPs) based on the cryptographic key using the soft token application, each OTP being valid during a respective time window and invalid outside that respective time window; and wherein the controller is further constructed and arranged to process the biometric measurements using the set of biometric assessment applications to form the biometric factors based on the biometric measurements. ### Claim 11 (depends on 10) An electronic apparatus as in claim 10 wherein the electronic apparatus is a mobile device; and wherein the controller, when outputting the composite passcodes, is constructed and arranged to: visually display, as a composite passcode for a particular authentication attempt, a character string sequence to the user through a display of the mobile device, the character string sequence defining a OTP and a biometric factor, the biometric factor defined by the character string sequence being un-discernable to the user. ### Claim 12 (depends on 10) An electronic apparatus as in claim 10 wherein the electronic apparatus is a mobile device; and wherein the controller, when outputting the composite passcodes, is constructed and arranged to: transmit, as a composite passcode for a particular authentication attempt, a character string sequence to the authentication server from a transmitter of the mobile device, the character string sequence defining a OTP and a biometric factor. ### Claim 13 A computer program product which includes a non-transitory computer readable medium storing a set of instructions to provide authentication codes to authenticate a user to an authentication server, the set of instructions causing computing circuitry to perform a method, comprising: generating, by the computing circuitry, token codes from a cryptographic key; obtaining, by the computing circuitry, biometric measurements from a user; and outputting, by the computing circuitry, composite passcodes as the authentication codes; wherein the composite passcodes include the token codes and biometric factors based on the biometric measurements; wherein the token codes and the biometric factors of the composite passcodes act as authentication inputs to user authentication operations performed by the authentication server; wherein obtaining the biometric measurements from the user includes capturing a set of current typing samples from the user during a current authentication attempt; wherein the method further comprises identifying, using a typing recognition application, a deliberate mistyping and typing correction event provided by the user; and wherein outputting the composite passcodes as the authentication codes includes providing an alert to signal user distress to the authentication server in response to identification of the deliberate mistyping and typing correction event. ### Claim 14 A method of providing authentication codes to authenticate a user to an authentication server, the method comprising: generating, by an electronic apparatus, token codes from a cryptographic key; obtaining, by the electronic apparatus, biometric measurements from a user; and outputting, by the electronic apparatus, composite passcodes as the authentication codes; wherein the composite passcodes include the token codes and biometric factors based on the biometric measurements; wherein the token codes and the biometric factors of the composite passcodes act as authentication inputs to user authentication operations performed by the authentication server wherein obtaining the biometric measurements from the user includes capturing a set of current typing samples from the user during a current authentication attempt; wherein the method further comprises identifying, using a typing recognition application, a deliberate mistyping and typing correction event provided by the user; and wherein outputting the composite passcodes as the authentication codes includes providing an alert to signal user distress to the authentication server in response to identification of the deliberate mistyping and typing correction event. ### Claim 15 (depends on 1) A method as in claim 1 wherein the set of biometric assessment applications further includes a facial recognition application; wherein obtaining the biometric measurements from the user further includes capturing, by a camera of the mobile device, a set of current images of the user's face; and wherein processing the biometric measurements using the set of biometric assessment applications further includes performing, using the facial recognition application, a facial recognition operation on the set of current images of the user's face. ### Claim 16 (depends on 1) A method as in claim 1 wherein the set of biometric assessment applications further includes a voice recognition application; wherein obtaining the biometric measurements from the user further includes capturing, by a microphone of the mobile device, a set of current voice samples of the user's voice; and wherein processing the biometric measurements using the set of biometric assessment applications further includes performing, using the voice recognition application, a voice recognition operation on the set of current voice samples of the user's voice. ### Claim 17 (depends on 1) A method as in claim 1 wherein the set of biometric assessment applications further includes a walking gait recognition application; wherein obtaining the biometric measurements from the user further includes capturing, by an accelerometer of the mobile device, a set of current gait samples; and wherein processing the biometric measurements using the set of biometric assessment applications further includes performing, using the walking gait recognition application, a gait recognition operation on the set of current gait samples. ### Claim 18 (depends on 1) A method as in claim 1 wherein the set of biometric assessment applications further includes a touch recognition application; wherein obtaining the biometric measurements from the user further includes capturing, by a touchscreen of the mobile device, a set of current touch samples of the user's hand; and wherein processing the biometric measurements using the set of biometric assessment applications further includes performing, using the touch recognition application, a touch recognition operation on the set of current touch samples. ### Claim 19 (depends on 1) A method as in claim 1 wherein the set of biometric assessment applications further includes a hand gesture recognition application; wherein obtaining the biometric measurements from the user further includes capturing, by a touchscreen of the mobile device, a set of current hand gesture samples of the user's hand; and wherein processing the biometric measurements using the set of biometric assessment applications further includes performing, using the hand gesture recognition application, a hand gesture recognition operation on the set of current hand gesture samples.