Apparatus and method for implementing biometrics-based authentication. In a preferred embodiment, the present invention is embodied in a portable device. Specifically, in one embodiment, the portable device includes a microprocessor, a non-volatile memory coupled thereto, and a biometrics-based authentication module controlled by the microprocessor. Preferably, the biometrics technology used is fingerprint authentication technology. The authentication module is capable of registering a fingerprint upon first use of the portable device, storing an encoded version of the fingerprint in the non-volatile memory. Subsequently, the authentication module can read a person's fingerprint and reliably determine whether the fingerprint matches the registered fingerprint stored in the non-volatile memory. If a match is found, access to information in the non-volatile memory is granted to that person; otherwise, access is denied. Embodiments of the present invention thus provide a highly convenient, secured and reliable method and system for user authentication and access control which was not achievable in prior art password-based authentication approaches.

A portable device having biometrics-based authentication capabilities

An apparatus and method of storage anti-piracy key encryption (SAKE) device controls data access for a storage/memory/network. An authentication system includes a first storage, a ROM and a microcontroller and verifies the password of a host. The first storage unit stores an authentication sequence (e.g. biometric information) and the authentication algorithm is programmed on the ROM. Upon receiving the password from the host the microcontroller loads and executes the authentication algorithm to verify the password with the hard coded authentication sequence. Access to the second storage unit/memory/network is permitted only if password is verified.

Method and apparatus of storage anti-piracy key encryption (SAKE) device to control data access for networks

A computer security system comprises a security module adapted to control access to a secure computer resource by a user via a client based on verification of a security credential provided by the user. The computer security system also comprises verification data disposed on the client and accessible by the security module. The security module is adapted to enable the user to recover the security credential based on a response received from the user associated with the verification data.

Computer security system and method

This invention provides a simple and secure PIN unblock mechanism for use with a security token. A set of one or more passphrases are stored on a remote server during personalization. Likewise, the answers to the passphrases are hashed and stored inside the security token for future comparison. A local client program provides the user input and display dialogs and ensures a secure communications channel is provided before passphrases are retrieved from the remote server. Retrieval of passphrases and an administrative unblock secret from the remote server are accomplished using a unique identifier associated with the security token, typically the token's serial number. A PIN unblock applet provides the administrative mechanism to unblock the security token upon receipt of an administrative unblock shared secret. The remote server releases the administrative unblock shared secret only after a non-forgeable confirmatory message is received from the security token that the user has been properly authenticated. The administrative unblock shared secret is encrypted with the token's public key during transport to maximize security.

Authenticated remote PIN unblock

Systems and methods for recovering from a lost password are described A password reset disk is created by generating a key pair consisting of a private key and a corresponding public key The private key is stored on a removable computer-readable medium so that it can be removed and securely stored remote from the computer system on which it was created The public key is stored on the computer system and used to maintain an up-to-date encrypted copy of the current password This encrypted copy is stored on the computer system If, at a later time, the user forgets a user password, the user may insert the password reset disk into the computer system The private key is retrieved from the password reset disk and the encrypted password is decrypted using the private key If the decryption is successful, the user is allowed to set a new password The password reset disk is effective even if the user password has been changed since the creation of the password reset disk In this way, a user does not have to contact customer service to recover from a forgotten password The user may also create the password reset disk when there is no password set When a password is set, the password is encrypted with the public key and stored

Systems and methods for setting and resetting a password

The BIOS device or some other secure store of a portable computer or other valuable device stores a password-based security program, an encrypted password, and an encryption key. When the PC is booted, the security program executes first and prompts the user for a password, encrypts it with the stored key, and compares it with the stored password. If the passwords do not match, boot is aborted and the PC is disabled. Only if the passwords do match is boot continued and use of the PC enabled. If this security measure is advertised, theft of the PC is deterred because of the difficulty of accessing or bypassing the password and the security program in the BIOS device. The encrypted password is also registered with a remote trusted certificate authority or is stored on a local external storage device. To establish or change the password, a communication connection is established from the PC to the TCA or storage device. If a password already exists in the PC, it is compared against the password stored by the TCA or the storage device. If they match, or if a password does not yet exist, the user is prompted for a new password, which is then encrypted and stored in both the BIOS device and the TCA or storage device. The password is also available for retrieval from the TCA or storage device in case the user forgets it.

John S. Thompson

Papers

Device security mechanism based on registered passwords