Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 1 of 32
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 1 of 32
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`EXHIBIT B
`EXHIBIT B
`
`

`

`( 12 ) United States Patent
`Jakobsson
`
`US 11,475,105 B2
`( 10 ) Patent No .:
`( 45 ) Date of Patent :
`* Oct . 18 , 2022
`
`US011475105B2
`
`( * ) Notice :
`
`( 54 ) AUTHENTICATION TRANSLATION
`( 71 ) Applicant : RightQuestion , LLC , Portola Valley ,
`CA ( US )
`( 72 ) Inventor : Bjorn Markus Jakobsson , Portola
`Valley , CA ( US )
`( 73 ) Assignee : RightQuestion , LLC , Portola Valley ,
`CA ( US )
`Subject to any disclaimer , the term of this
`patent is extended or adjusted under 35
`U.S.C. 154 ( b ) by 0 days .
`This patent is subject to a terminal dis
`claimer .
`( 21 ) Appl . No .: 17 / 123,018
`( 22 ) Filed :
`Dec. 15 , 2020
`( 65 )
`Prior Publication Data
`Jun . 10 , 2021
`US 2021/0173897 A1
`Related U.S. Application Data
`( 63 ) Continuation - in - part of application No. 17 / 027,481 ,
`filed on Sep. 21 , 2020 , which is a continuation of
`( Continued )
`
`( 51 ) Int . Cl .
`G06F 21/00
`G06F 21/10
`
`( 52 ) U.S. CI .
`CPC
`
`( 2013.01 )
`( 2013.01 )
`( Continued )
`G06F 21/10 ( 2013.01 ) ; G06F 21/121
`( 2013.01 ) ; G06F 21/128 ( 2013.01 ) ; G06F
`21/31 ( 2013.01 ) ; G06F 21/32 ( 2013.01 ) ;
`G06F 21/44 ( 2013.01 ) ; H04L 63/08 ( 2013.01 ) ;
`H04L 63/083 ( 2013.01 ) ; H04L 63/0815
`( 2013.01 ) ; H04L 63/0823 ( 2013.01 ) ; H04L
`
`63/0861 ( 2013.01 ) ; H04L 63/10 ( 2013.01 ) ;
`H04L 63/20 ( 2013.01 ) ; H04L 63/0281
`( 2013.01 ) ; H04L 63/0869 ( 2013.01 )
`( 58 ) Field of Classification Search
`None
`See application file for complete search history .
`
`( 56 )
`
`WO
`WO
`
`References Cited
`U.S. PATENT DOCUMENTS
`5,010,571 A
`5,499,298 A
`
`4/1991 Katznelson
`3/1996 Narasimhalu
`( Continued )
`FOREIGN PATENT DOCUMENTS
`2004051585
`6/2004
`2005001751
`1/2005
`
`OTHER PUBLICATIONS
`IPR2022-00244 Claim Mapping Table for the ' 696 Patent . Nov. 30 ,
`2021 .
`
`( Continued )
`
`Primary Examiner — Andrew J Steinle
`( 74 ) Attorney , Agent , or Firm Van Pelt , Yi & James
`LLP
`
`ABSTRACT
`( 57 )
`Authentication translation is disclosed . A request to access a
`resource is received at an authentication translator , as is an
`authentication input . The authentication input corresponds
`to at least one stored record . The stored record is associated
`at least with the resource . In response to the receiving , a
`previously stored credential associated with the resource is
`accessed . The credential is provided to the resource .
`
`35 Claims , 15 Drawing Sheets
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 2 of 32
`
`-122
`
`Bank
`Website
`
`-124
`
`Online
`Camera
`Retailer
`
`-134
`
`Authentication
`Translator for Bank
`Website
`
`-140
`
`Cloud
`Storage
`Service
`
`-136
`30 Party
`Authentication
`Translator
`
`-108
`
`-120
`
`Social
`Networking
`Site
`
`132
`
`102
`
`Authentication
`Translator
`Module
`
`100
`
`1
`
`-106
`
`104
`
`?
`
`

`

`US 11,475,105 B2
`Page 2
`
`9/2005 Yeates
`2005/0198348 Al
`4/2006 Buer
`2006/0085844 Al
`2007/0257104 A1 * 11/2007 Owen
`
`2007/0266256 A1
`2008/0059804 A1 *
`
`11/2007 Shah
`3/2008 Shah
`
`2009/0100269 Al
`2009/0191846 A1
`2010/0242102 Al
`2011/0078771 A1
`2011/0138450 A1
`2011/0205016 A1
`2011/0231651 A1
`2012/0110341 A1
`2012/0167193 A1
`2014/0250079 Al *
`
`4/2009 Naccache
`7/2009 Shi
`9/2010 Cross
`3/2011 Griffin
`6/2011 Kesanupalli
`8/2011 Al - Azem
`9/2011 Bollay
`5/2012 Beigi
`6/2012 Gargaro
`9/2014 Gardner
`
`2017/0230179 Al
`
`8/2017 Mannan
`
`G06Q 20/4014
`235/380
`
`G06F 21/41
`713/186
`
`G06F 11/1453
`707/646
`
`OTHER PUBLICATIONS
`IPR2022-00244 Petition for Inter Partes Review of U.S. Pat . No.
`10,824,696 . Nov. 30 , 2021 .
`IPR2022-00251 Claim Mapping Table for the ’ 512 Patent . Dec. 1 ,
`2021 .
`IPR2022-00251 Petition for Inter Partes Review of U.S. Pat . No.
`10,929,512 . Dec. 1 , 2021 .
`“ Managing Authorization and Access Control ” , Author : unknown ,
`Published Nov. 3 , 2005 , pp . 1-12 , URL : http://technet.microsoft .
`com / en - us / library / bb457115.aspx .
`Brands et al . Distance - Bounding Protocols . Jan. 28 , 1994 : https : //
`citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.51.6437&rep=
`repl & type = pdf .
`Hammer - Lahav , Ed . “ The OAuth 1.0 Protocol ” , from https : // tools .
`ietf.org/html/rfc5849 , Apr. 2010 .
`Jakobsson et al . Proving Without Knowing : On Oblivious , Agnostic
`and Blindfolded Provers . Jul . 24 , 1996 : http : // markus - jakobsson .
`com / papers / jakobsson - crypto96.pdf .
`Monrose et al . Using Voice to Generate Cryptographic Keys . May
`13 , 2001 : https://www.cs.unc.edu/~fabian/papers/odyssey.pdf .
`Seshadri et al . Pioneer : Verifying Code Integrity and Enforcing
`Untampered Code Execution on Legacy Systems . Oct. 23 , 2005 :
`https://netsec.ethz.ch/publications/papers/pioneer.pdf .
`* cited by examiner
`
`2
`
`Related U.S. Application Data
`application No. 16 / 773,767 , filed on Jan. 27 , 2020 ,
`now Pat . No. 10,929,512 , which is a continuation of
`application No. 16 / 563,715 , filed on Sep. 6 , 2019 ,
`now Pat . No. 10,824,696 , which is a continuation of
`application No. 16 / 273,797 , filed on Feb. 12 , 2019 ,
`now Pat . No. 10,521,568 , which is a continuation of
`application No. 15 / 042,636 , filed on Feb. 12 , 2016 ,
`now Pat . No. 10,360,351 , which is a continuation of
`application No. 13 / 706,254 , filed on Dec. 5 , 2012 ,
`now Pat . No. 9,294,452 .
`( 60 ) Provisional application No. 61 / 587,387 , filed on Jan.
`17 , 2012 , provisional application No. 61 / 569,112 ,
`filed on Dec. 9 , 2011 .
`( 51 ) Int . Cl .
`H04L 9/40
`GOOF 21/31
`G06F 21/32
`G06F 21/44
`G06F 21/12
`
`( 2022.01 )
`( 2013.01 )
`( 2013.01 )
`( 2013.01 )
`( 2013.01 )
`References Cited
`U.S. PATENT DOCUMENTS
`
`( 56 )
`
`6,016,476 A
`6,691,232 B1
`7,512,965 B1
`7,697,729 B2
`7,780,080 B2
`7,950,051 B1
`8,145,916 B2
`8,549,300 B1
`8,577,813 B2
`8,776,214 B1
`*
`8,856,539 B2
`8,984,596 B2
`9,100,826 B2
`10,872,152 B1
`2004/0107170 A1
`2004/0236632 A1
`
`1/2000 Maes
`2/2004 Wood
`3/2009 Amdur
`4/2010 Howell
`8/2010 Owen
`5/2011 Spitz
`3/2012 Boshra
`10/2013 Kumar
`11/2013 Weiss
`7/2014 Johansson
`
`10/2014 Weiss
`3/2015 Griffin
`8/2015 Weiss
`12/2020 Martel
`6/2004 Labrou
`11/2004 Maritzen
`
`HO4L 63/1433
`726/18
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 3 of 32
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 1 of 15
`
`US 11,475,105 B2
`
`-122
`
`Bank
`Website
`
`124
`
`Online
`Camera
`Retailer
`
`134
`
`Authentication
`Translator for Bank
`Website
`
`-120
`
`Social
`Networking
`Site
`
`-132
`
`102
`
`Authentication
`Translator 1
`Module
`??
`
`-110
`
`140
`
`Cloud
`Storage
`Service
`
`-136
`3rd party
`Authentication
`Translator
`
`-108
`
`1 X 21
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 4 of 32
`
`100
`
`104
`
`-106
`
`FIG . 1
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 2 of 15
`
`US 11,475,105 B2
`
`-202
`
`-210
`
`220
`
`Template 1
`
`Template 2
`
`Template 3
`
`I
`
`1
`
`domain , username , credential
`,
`
`M
`
`1
`1
`
`domain , username , credential
`
`domain , username , credential
`
`M
`
`M
`
`MY
`
`MY
`
`w
`
`-214
`
`204
`1
`
`Template 1
`
`Template 2
`
`1
`
`206
`
`Template 1
`
`Template 2
`
`---
`1
`domain , username , credential
`1
`
`domain , username , credential
`
`1
`
`domain , username , credential
`
`domain , username , credential
`
`-
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 5 of 32
`
`-212
`
`200
`
`FIG . 2
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 3 of 15
`
`US 11,475,105 B2
`
`304
`
`processor
`
`302
`
`Insecure storage ( large )
`
`-308
`
`processor
`
`306
`
`Secure storage ( small )
`
`sensor
`
`) 310
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 6 of 32
`
`300
`
`FIG . 3
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 4 of 15
`
`US 11,475,105 B2
`
`406
`
`Site
`
`404
`
`Primary Device
`
`408
`410
`
`402
`
`Peripheral
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 7 of 32
`
`FIG . 4
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 5 of 15
`
`US 11,475,105 B2
`
`500
`
`Receive request to access resource and receive
`authentication input .
`
`Access stored credential associated with resource .
`
`Provide credential to resource .
`
`502
`
`504
`
`506
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 8 of 32
`
`FIG . 5
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 6 of 15
`
`US 11,475,105 B2
`
`Client
`
`Proxy
`
`Server
`
`data request
`( no identity information )
`
`record UA
`
`data request
`( no cookie )
`
`data
`SET cookie
`
`data
`SET cookie
`SET cache cookie
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 9 of 32
`
`record cookie ,
`cache cookie
`
`FIG . 6
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 7 of 15
`
`US 11,475,105 B2
`
`Client
`
`Proxy
`
`Server
`
`data request
`( + identity information )
`
`find record
`get cookie
`
`data request
`( + cookie )
`
`data
`
`data
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 10 of 32
`
`FIG . 7
`
`

`

`uniquename.jpg
`
`U.S. Patent
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 11 of 32
`
`Oct. 18 , 2022
`
`Sheet 8 of 15
`
`US 11,475,105 B2
`
`samename.html
`
`FIG . 8
`
`callingpage.html
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 9 of 15
`
`US 11,475,105 B2
`
`exchange is performed
`
`Key
`
`
`
`Vault transferred
`
`Decryption key transferred
`
`904
`
`905
`
`906
`
`FIG . 9
`
`Vault is utilized ( optional )
`
`907
`
`903
`
`902
`
`
`
`Policy verification
`
`Pairing is initiated
`
`registers on computational device
`
`User
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 12 of 32
`
`901
`
`900
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 10 of 15
`
`US 11,475,105 B2
`
`
`
`Securely store portions of profile
`
`Obtain authentication information
`
`
`
`Create new profile
`
`1004
`
`FIG . 10
`
`
`
`Initiate registration as a second
`
`user
`
`1003
`
`1002
`
`1001
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 13 of 32
`
`1000
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 11 of 15
`
`US 11,475,105 B2
`
`
`
`Access matched profile
`
`
`
`Initiate action
`
`1104
`
`
`
`
`
`Search for a match with stored profiles
`
`Receive authentication input
`
`1103
`
`1102
`
`1101
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 14 of 32
`
`1100
`
`FIG . 11
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 12 of 15
`
`US 11,475,105 B2
`
`1206
`
`1207
`
`1208
`
`1209
`
`Communication element
`input element
`User
`
`
`Secure storage
`processor
`
`Secure
`
`Insecure storage
`Application processor
`
`
`
`Power source
`
`
`
`User - facing output element
`
`FIG . 12
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 15 of 32
`
`1202
`
`1201
`
`1203
`
`1204
`
`1205
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 13 of 15
`
`US 11,475,105 B2
`
`1306
`
`1307
`
`1308
`
`1309
`
`Communication element
`input element
`User
`
`
`
`Secure storage
`
`Insecure storage
`
`
`
`Power source
`
`Processor
`
`
`
`Secure mode
`
`Non - secure mode
`
`
`
`User - facing output element
`
`FIG . 13
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 16 of 32
`
`1302
`
`1303
`
`1304a
`
`1301
`
`1304b
`
`1305
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 14 of 15
`
`US 11,475,105 B2
`
`Policies generated ( optional )
`
`Data synchronized
`
`1404
`
`1405
`
`Evaluate compliance
`
`Compliance data transmitted
`
`
`
`request transmitted
`Pairing
`
`1403
`
`1402
`
`1401
`
`FIG . 14
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 17 of 32
`
`1400
`
`

`

`U.S. Patent
`
`Oct. 18 , 2022
`
`Sheet 15 of 15
`
`US 11,475,105 B2
`
`code comparison
`Perform
`
`Make
`
`pairing determination
`
`1504
`
`1505
`
`
`
`Generate code
`
`
`
`Receive pairing signal
`
`
`
`Receive biometric input
`
`1503
`
`1502
`
`1501
`
`FIG . 15
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 18 of 32
`
`1500
`
`

`

`1
`AUTHENTICATION TRANSLATION
`
`US 11,475,105 B2
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 19 of 32
`
`a
`
`a
`
`2
`FIG . 6 illustrates an example of what occurs when a client
`device first visits the site of a legacy server via an authen
`CROSS REFERENCE TO OTHER
`tication translator .
`FIG . 7 illustrates an example of what occurs when a
`APPLICATIONS
`5 device subsequently visits the site of a legacy server via an
`This application is a continuation in part of U.S. patent
`authentication translator .
`FIG . 8 shows the structure of an example of a cache
`application Ser . No. 17 / 027,481 entitled AUTHENTICA-
`cookie used in some embodiments .
`TION TRANSLATION filed Sep. 21 , 2020 , which is incor
`FIG . 9 is a flow diagram illustrating an embodiment of a
`porated herein by reference for all purposes , which is a
`10 backup process .
`continuation of U.S. patent application Ser . No. 16 / 773,767 ,
`FIG . 10 is a flow diagram illustrating an embodiment of
`entitled AUTHENTICATION TRANSLATION filed Jan.
`a process of a user registering as a second user on a
`27 , 2020 which is incorporated herein by reference for all
`computational device .
`purposes , which is a continuation of U.S. patent application
`FIG . 11 is a flow diagram illustrating an embodiment of
`a
`Ser .
`No. 16 / 563,715 ,
`entitled AUTHENTICATION 15 a process an authentication attempt on a computational
`TRANSLATION filed Sep. 6 , 2019 , now U.S. Pat . No.
`device .
`10,824,696 , which is incorporated herein by reference for all
`FIG . 12 illustrates an embodiment of a computational
`purposes , which is a is a continuation of U.S. patent appli
`device .
`cation Ser . No. 16 / 273,797 , entitled AUTHENTICATION
`FIG . 13 illustrates an embodiment of a computational
`TRANSLATION filed Feb. 12 , 2019 , now U.S. Pat . No. 20 device .
`10,521,568 , which is incorporated herein by reference for all
`FIG . 14 is a flow diagram illustrating an embodiment of
`purposes , which is a is a continuation of U.S. patent appli-
`a backup process between two computational devices .
`?
`cation Ser . No. 15 / 042,636 , entitled AUTHENTICATION
`FIG . 15 is a flow diagram illustrating an embodiment of
`a
`TRANSLATION filed Feb. 12 , 2016 , now U.S. Pat . No.
`a pairing process .
`10,360,351 , which is incorporated herein by reference for all 25
`purposes , which is a continuation of U.S. patent application
`DETAILED DESCRIPTION
`a
`Ser .
`No. 13 / 706,254 ,
`entitled AUTHENTICATION
`The invention can be implemented in numerous ways ,
`TRANSLATION filed Dec. 5 , 2012 , now U.S. Pat . No.
`including as a process ; an apparatus ; a system ; a composi
`9,294,452 , which is incorporated herein by reference for all
`which claims priority to U.S. Provisional Appli 30 tion of matter ; a computer program product embodied on a
`purposes ,
`computer readable storage medium ; and / or a processor , such
`cation No. 61 / 587,387 ,
`entitled BIOMETRICS - SUP
`as a processor configured to execute instructions stored on
`PORTED SECURE AUTHENTICATION SYSTEM filed
`and / or provided by a memory coupled
`the processor . In
`Jan. 17 , 2012 which is incorporated herein by reference for
`this specification , these implementations , or any other form
`all purposes . U.S. patent application Ser . No. 13 / 706,254 35 that the invention may take , may be referred to as tech
`also claims priority to U.S. Provisional Patent Application
`niques . In general , the order of the steps of disclosed
`No. 61 / 569,112 entitled BACKWARDS COMPATIBLE
`processes may be altered within the scope of the invention .
`ROBUST COOKIES filed Dec. 9 , 2011 , which is incorpo-
`Unless stated otherwise , a component such as a processor or
`rated herein by reference for all purposes .
`a memory described as being configured to perform a task
`40 may be implemented as a general component that is tem
`porarily configured to perform the task at a given time or a
`BACKGROUND OF THE INVENTION
`specific component that is manufactured to perform the task .
`As used herein , the term “ processor ' refers to one or more
`Providing credentials to a service , whether via a mobile or
`devices , circuits , and / or processing cores configured to
`other device , is often a tedious experience for a user .
`Unfortunately , to make authentication easier for themselves , 45 process data , such as computer program instructions .
`users will often engage in practices such as password re - use ,
`A detailed description of one or more embodiments of the
`and / or the selection of poor quality passwords , which render
`invention is provided below along with accompanying fig
`their credentials less secure against attacks . Accordingly ,
`ures that illustrate the principles of the invention . The
`improvements in authentication techniques would be desir-
`invention is described in connection with such embodi
`able . Further , it would be desirable for such improvements 50 ments , but the invention is not limited to any embodiment .
`to be widely deployable , including on existing / legacy sys-
`The scope of the invention is limited only by the claims and
`the invention encompasses numerous alternatives , modifi
`tems .
`cations and equivalents . Numerous specific details are set
`forth in the following description in order to provide a
`55 thorough understanding of the invention . These details are
`provided for the purpose of example and the invention may
`be practiced according to the claims without some or all of
`these specific details . For the purpose of clarity , technical
`material that is known in the technical fields related to the
`60 invention has not been described in detail so that the
`invention is not unnecessarily obscured .
`FIG . 1 illustrates an embodiment of an environment in
`which authentication translation is provided . In the example
`shown , a variety of client devices 102-108 connect , via one
`65 or more networks ( represented as a single network cloud
`110 ) to a variety of services 120-124 ( also referred to herein
`as sites 120-124 ) . In particular , client device 102 is a
`
`BRIEF DESCRIPTION OF THE DRAWINGS
`Various embodiments of the invention are disclosed in the
`following detailed description and the accompanying draw-
`ings .
`FIG . 1 illustrates an embodiment of an environment in
`which authentication translation is provided .
`FIG . 2 illustrates an embodiment of credential informa-
`tion stored on a device .
`FIG . 3 illustrates an embodiment of a device with secure
`storage .
`FIG . 4 illustrates an example of a renegotiation .
`FIG . 5 illustrates an embodiment of a process for per-
`forming authentication translation .
`
`

`

`a
`
`2
`
`US 11,475,105 B2
`
`a
`
`3
`4
`against template 212. In this case , the typing speed of 90
`notebook computer owned by a user hereinafter referred to
`words per minute is similar enough to Alice's typical
`as Alice . Notebook 102 includes a camera , a microphone ,
`behavior , it is considered a match . Various policies can be
`and a fingerprint sensor . Client device 104 is a smartphone ,
`included in a profile that govern how matches are to be
`also owned by Alice . Client device 104 includes a camera .
`Client device 106 is a tablet owned by Bob , and sometimes 5 performed . For example , policies can specify thresholds /
`used by Bob's son Charlie . Client device 106 includes a
`tolerances for what constitutes a match , and can specify that
`camera and a fingerprint sensor . Client device 108 is a kiosk
`different levels of matches can result in different levels of
`a
`located in the lobby of a hotel . Kiosk 108 includes a camera
`access to different resources .
`and a microphone . The techniques described herein can be
`A profile is associated with a vault ( e.g. , vault 220 ) . The
`used with or adapted to be used with other devices , as 10 vault , in turn , contains triples specifying a service provider /
`applicable . For example , the techniques can be used in
`domain , a username , and a credential . The vault can also
`conjunction with gaming systems , with peripheral devices
`contain other sensitive user information , such as account
`such as mice , and with embedded devices , such as door
`numbers , address / phone number information , and health
`locks .
`care data . The credential for a service provider / domain can
`Service 120 is a social networking site . Service 122 is a 15 be a password ( e.g. , for legacy servers ) , and can also take
`website of a bank . Service 124 is the online store of a
`alternate forms ( e.g. , a cryptographic key for service pro
`boutique camera retailer . Each of services 120-124 requires
`viders supporting stronger authentication methods ) .
`In some embodiments , profiles , templates , and vaults
`a username and password ( and / or a cookie ) from a user prior
`to giving that user access to protected content and / or other
`( collectively “ authentication information ” )
`stored
`are
`features . As will be described in more detail below , using the 20 entirely in an unprotected storage area , and are stored in the
`techniques described herein , users need not type such user-
`clear . In other embodiments , secure storage techniques are
`names and passwords into their devices whenever required
`used to secure at least a portion of the authentication
`by a service . Instead , users can authenticate themselves to an
`information .
`“ authentication translator " via an appropriate technique , and
`One example of a device with secure storage is illustrated
`?
`the authentication translator will provide the appropriate 25 in FIG . 3. In the example shown , a mobile phone 300
`credentials to the implicated service on the user's behalf .
`includes a large and insecure storage 302 attached to a fast
`Also as will be described in more detail below , authentica
`processor 304 , and a smaller but secure storage 306 attached
`tion translators can be located in a variety of places within
`to a dedicated processor 308 and a sensor 310 ( e.g. , a camera
`an environment . For example , notebook computer 102
`or a fingerprint reader ) . Users ( and applications ) can read
`includes an authentication translator module 132 that pro- 30 from and write to the insecure storage area . However , users
`vides authentication translation services . The other devices
`cannot access the secure storage area , and the fast processor
`104-108 can also include ( but need not include ) their own
`can only communicate with the dedicated processor / sensor
`via a restricted API . As another example , a unique decryp
`respective authentication translator modules . The owner of
`bank website 122 also operates an authentication translator
`tion key associated with a given vault can be stored in a
`134 associated with the bank . Finally , authentication trans- 35 profile . The vault is an encrypted and authenticated con
`lator 136 provides authentication translation services to a
`tainer that can be stored on insecure storage , e.g. , on the
`variety of businesses , including online camera retailer 124 .
`device , and also backed up ( e.g. , to a cloud storage service
`FIG . 2 illustrates an embodiment of credential informa
`140 or to an alternate form of external storage ) . As needed ,
`tion stored on a device . In particular , device 200 stores three
`authentication information or portions thereof can be loaded
`user profiles 202-206 , each of which contains a username 40 into secure storage and decrypted . For example , one can use
`and one or more templates ( e.g. , template 210 ) associated
`AES to encrypt the files one by one , using a key stored on
`with the user . In various embodiments , a template is a
`the secured storage . A message authentication technique ,
`collection of biometric features . Using fingerprints as an
`such as HMAC , can be used for authenticating the encrypted
`example type of biometric , a corresponding template
`files to provide tamper prevention . Profiles and vaults can be
`includes a collection of patterns , minutia , and / or other 45 updated while in secure storage ; if this occurs , they are
`features that can be matched against to determine if a
`encrypted and MACed before being written back to the
`person's fingerprint matches the fingerprint of the registered
`insecure storage , which may in turn propagate them to
`user ( i.e. , the owner of a given user profile ) . A representation
`external backup storage . In yet other embodiments , profiles
`of a single fingerprint may be included in multiple templates
`and vaults are stored entirely in secure storage , in plaintext ,
`( e.g. , in different resolutions , in accordance with different 50 which allows them to be both read and written and in
`protocols , as captured during warm vs. cold conditions ,
`particular , searched .
`and / or by itself or in combination with multiple
`fingerprints ) . When other biometrics are employed ( e.g. ,
`Example Transaction Types
`facial recognition , voiceprint , or retina scan technology ) ,
`features appropriate to those types of biometrics are 55 A variety of transaction types can take place in the
`included in the template . Other types of features can also be
`environment shown in FIG . 1 , examples of which are
`included in templates . As one example , a user's typing speed
`discussed in this section .
`and / or accuracy can be measured by a device , such as device
`Initial Registration
`102 , and used to distinguish between multiple users of a
`device . For example , suppose Alice types at 100 words per 60
`minute and rarely makes mistakes . A representation of this
`In order to begin using the techniques described herein ,
`information can be stored in template 212. Also suppose
`users perform some form of initial registration . As one
`Alice's niece , who sometimes uses Alice's laptop computer
`example , suppose Alice launches an enrollment program
`when visiting Alice types at 20 words per minute and makes
`installed on laptop 102. She uses the program to capture
`many mistakes . In some embodiments , the fact that a user 65 various biometric information ( e.g. , fingerprints , photo
`was recently ( e.g. , within the last 5 minutes ) typing on
`graphs of her face , etc. ) . A user profile is created for Alice ,
`laptop 102 at 90 words per minute is evidence of a match
`and the biometric information captured about her is encoded
`
`Case 1:23-cv-00324-ADA Document 1-2 Filed 03/24/23 Page 20 of 32
`
`

`

`US 11,475,105 B2
`
`10
`
`15
`
`5
`6
`fingerprint scanner that is connected to the user's primary
`into a plurality of templates , such as templates 210 and 214 .
`device via USB ) . In such scenarios , the peripheral device
`In some embodiments , Alice is also explicitly asked to
`may be responsible for storing at least a portion of authen
`supply credential information for services she would like to
`tication information and may perform at least some of the
`use , such as by providing the domain name of social
`networking site 120 , along with her username and password 5 authentication tasks previously described as having been
`for site 120. In other embodiments , domain / username / cre-
`performed by Alice's computer . For example , instead of
`dential information is at least passively captured on Alice's
`processors 304 and 308 , and storages 302 and 306 being
`behalf and included in one or more vaults such as vault 220 .
`collocated on a single device ( e.g. , laptop 102 ) , processor
`Credential information can also be important from a browser
`304 and storage 302 may be present on a primary device , and
`password manager already in use by Alice or other appro
`processor 308 and storage 306 may be present on a periph
`priate source . In some embodiments , Alice also registers
`eral device ( e.g. , that also includes a sensor , such as a
`with cloud storage service 140 , which will allow her to back
`fingerprint reader ) .
`up her authentication information and to synchronize it
`In such scenarios , once Alice's login to banking website
`across her devices ( e.g. , 102 and 104 ) , as described in more
`122 is successfully completed , the secure session can be
`detail below .
`handed over from the peripheral device to the primary
`Other registration approaches can also be used . For
`device , in a way that does not allow the primary device
`example , registration can be integrated into the experience
`retroactive access to the plaintext data of the transcripts
`the first time a device is used . Thus , when Bob first turns on
`tablet 106 , he may be prompted to take a picture of his face
`exchanged between the peripheral device and the service
`( with a profile / templates being created in response ) . Simi- 20 provider . One way this can be accomplished is by renego
`larly , the first time Charlie uses tablet 106 , the techniques
`tiating SSL keys between the peripheral device and the
`described herein can be used to determine that Charlie does
`website , after which the newly negotiated key can be handed
`not yet have a profile ( e.g. , because none of the templates
`off from the peripheral device to the primary device . This
`already present on tablet 106 match his biometrics ) and
`avoids retroactive credential capture in a setting where the
`Charlie can be prompted to enroll as a second user of the 25 device is infected by malware .
`An example of renegotiation is depicted in FIG . 4. Spe
`device .
`cifically , after a user has successfully authenticated to a
`fingerprint reader , a login is performed to a service provider .
`Authentication
`Using the primary device ( 404 ) as a proxy , the peripheral
`Suppose Alice wishes to authenticate to banking website 30 fingerprint reader 402 negotiates a first SSL connection
`( 408 ) with a service provider 406 , over which credentials are
`122. Using a fingerprint reader incorporated into her laptop ,
`she performs a fingerprint scan , which causes her biometric
`exchanged . The proxy then renegotiates SSL ( 410 ) , which
`features to be extracted and compared to any stored tem-
`replaces the old key with a new one . The new key is
`plates residing on her computer . If a match is found , an
`disclosed to the device , which then seamlessly takes over the
`associated decryption key is selected , and the associated 35 connection with the service provider and performs the
`vault is loaded and decrypted . The vault is scanned for an
`transaction protected by the authentication . The credentials
`entry that matches the selected service provider ( i.e. , website
`exchanged during the first SSL connection cannot be
`122 ) . If a matching entry is found , the associated domain ,
`accessed by device 404 , since the key of the renegotiated
`username , and site credential are extracted from the vault . In
`session is independent of the key of the original session ; this
`some embodiments , the validity of the domain name map- 40 provides protection against malware residing on the device .
`ping is verified at this point to harden the system against
`Renegotiation can be used when the primary device 404 is
`domain name poisoning . Next , a secure connection is estab-
`believed to be in a safe state when performing the negotia
`lished between Alice's computer and the service provider ,
`tion of the SSL connection , but it is not known whether it is
`and Alice is authenticated . For service providers supporting
`in a safe state during the transaction protected by the
`strong user authentication , mutual SSL can be used , for 45 authentication . Renegotiation can also be used when a
`example . A variety of policies can be involved when per-
`secure component of the primary device 404 performs the
`forming matching . For example , to access certain domains ,
`negotiation of the SSL connection and another and poten
`Alice's print may need only match template 210. To access
`tially insecure component of the primary device 404 is
`other domains , Alice may need to match multiple templates
`involved in the transaction protected by the authentication .
`( e.g. , both 210 and 214 ) . As another example , in order to 50
`FIG . 5 illustrates an embodiment of a process for per
`access social networking site 120 , Alice may merely need to
`forming authentication translation . The process begins at
`be sitting in front of her computer , which has an integrated
`502 when a request to access a resource is received , as is an
`webcam . Even in relatively low light conditions , a match
`authentication input . One example of the processing per
`can be performed against Alice's face and features stored in
`formed at 502 is as follows . Suppose Alice wishes to sign
`a template . However , in order to access bank website 122 , 55 into social networking website 120. She directs a web
`Alice may need a high quality photograph ( i.e. , requiring her
`browser application installed on client 102 to the social
`to turn on a bright light ) and may need to demonstrate
`networking website . Authentication translator module 132
`liveness ( e.g. , by blinking or turning her head ) . As yet
`recognizes , from the context of Alice's actions ( e.g. , that she
`