Apparatus and method for ensuring device security through fingerprint authentication

Abstract

The present invention provides an apparatus and method for device security, wherein a fingerprint image is acquired on a touch screen, and an authentication process is performed based on the first fingerprint image. Thereafter, a second fingerprint image is acquired and a difference between the characteristics of the first and second fingerprint images is determined, and based on whether the difference is greater than a threshold, a second authentication process is performed.

Description

[0001] This application is a divisional application of a patent application filed on October 10, 2018, entitled “Apparatus and method for ensuring device security through fingerprint identification” and application number 201880066926.7.

[0002] This patent application claims priority to U.S. Non-Provisional Application No. 15 / 798,327, filed on October 30, 2017, entitled “APPARATUS AND METHOD FOR DEVICE SECURITY,” which is assigned to the present assignee and is hereby expressly incorporated herein by reference. Background Art

[0003] In devices with fingerprint sensors, the fingerprint sensor can be used to authenticate the user. The authentication process can enable access to data or functions that are not otherwise accessible to unauthorized users.

[0004] The fingerprint sensor may reside, for example, under the touch screen and be able to sense touches on the entire screen. It may also reside under only a portion of the touch screen. The fingerprint sensor may also reside on the back or side of the device, or on a button. The fingerprint sensor may be operatively coupled to other components in the device, such as a processor or a touch screen. The fingerprint sensor may also be integrated with the touch screen of the device, or act as the touch screen of the device.

[0005] In conventional devices with fingerprint sensors, a user places their finger on the fingerprint sensor and once their fingerprint is authenticated, they are then able to access certain data or functions of the device. Typically, the device provides a timeout function that prohibits access once the device has not been interacted with for a period of time. After the device times out, the user must re-authenticate in order to access certain data or functions.

[0006] The timeout period may be user adjustable, and for example, a user who does not wish to authenticate frequently may set the timeout period to 10 minutes or more.

[0007] One disadvantage of this technique is that a user can authenticate with the device, and a second unauthorized user can access the device as if it were an authorized user, as long as the second unauthorized user does so before the device times out.

[0008] One solution to the aforementioned drawbacks is to continuously authenticate the user's fingerprint while the user is using the device. However, the downsides of continuous authentication are twofold: it consumes more power, and because the full fingerprint authentication process has an associated latency, this can adversely affect the user experience.

[0009] Thus, there is a need for a power efficient and low latency authentication process that provides additional security to processes that rely on timeouts. Summary of the invention

[0010] The systems, methods and devices of the present disclosure each have several innovative aspects, no single one of which is solely responsible for the desirable attributes disclosed herein.

[0011] One innovative aspect of the subject matter described in the present disclosure may be implemented in a device. The device may include a touch-sensitive surface, one or more processors, and a fingerprint sensor. The fingerprint sensor may be configured to acquire a first fingerprint image at an area on the touch-sensitive surface near a first contact location and acquire a second fingerprint image at an area on the touch-sensitive surface near a second contact location. The one or more processors may be configured to perform a first authentication process based on the first fingerprint image, determine a difference between characteristics of the second fingerprint image and characteristics of the first fingerprint image, and perform a second authentication process based on whether the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is greater than a threshold.

[0012] In some aspects, a method for authentication may include acquiring a first fingerprint image at an area near a first contact location on a touch-sensitive surface; performing a first authentication process based on the first fingerprint image; acquiring a second fingerprint image at an area near a second contact location on the touch-sensitive surface; determining a difference between characteristics of the second fingerprint image and characteristics of the first fingerprint image; and performing a second authentication process based on whether the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is greater than a threshold.

[0013] In some aspects, an apparatus for identification may include a device for acquiring a first fingerprint image and a second fingerprint image; a device for performing an identification process based on the first fingerprint image; a device for determining a difference between characteristics of the second fingerprint image and characteristics of the first fingerprint image; and a device for performing a second identification process based on whether the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is greater than a threshold.

[0014] In some aspects, a non-transitory computer-readable medium may store software that includes instructions that, when executed by one or more processors, cause a device to perform one or more operations including: acquiring a first fingerprint image at an area on a touch-sensitive surface near a first contact location; performing an identification process based on the first fingerprint image; acquiring a second fingerprint image at an area on the touch-sensitive surface near a second contact location; determining a difference between characteristics of the second fingerprint image and characteristics of the first fingerprint image; and performing a second identification process based on whether the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is greater than a threshold.

[0015] The touch-sensitive surface, fingerprint sensor and / or one or more processors may include one or more general-purpose single-chip or multi-chip processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or a combination thereof.

[0016] The touch-sensitive surface and fingerprint sensor may be integrated into a single sensor capable of sensing both fingerprint images and touches, and measuring both the fingerprint image and location of one or more touches simultaneously or substantially simultaneously. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the following description. Other features, aspects, and advantages will become apparent from the description, drawings, and claims. It should be noted that the relative dimensions of the following figures may not be drawn to scale. The same reference numerals and names in the various figures indicate the same elements.

[0018] As described herein, "touch screen," "touch sensor," and "touch-sensitive surface" may be used alternatively and interchangeably. The touch-sensitive surface may or may not be located proximate to the display device.

[0019] Figure 1 A front view of a pictorial representation of an example device including a touch sensor and a fingerprint sensor is shown according to some embodiments.

[0020] Figure 2A A block diagram representation of components of an example fingerprint identification system is shown in accordance with some embodiments.

[0021] Figure 2B A block diagram representation of components of an example fingerprint authentication system shown incorporated with components of a mobile device is shown in accordance with some embodiments.

[0022] Figure 3 A graphical representation of a finger contacting a touch sensor with an incorporated fingerprint sensor is shown in accordance with some embodiments.

[0023] Figure 4A A graphical representation of a finger contacting a touch-sensitive surface and sliding from left to right is shown according to some embodiments.

[0024] Figure 4B A graphical representation showing one finger contacting a touch-sensitive surface and, at a later time, another finger contacting the touch-sensitive surface according to some embodiments.

[0025] Figure 5 A graphical representation of a finger contacting a touch-sensitive surface, at a later time, ceasing contact with the touch-sensitive surface, and additionally at a later time resuming contact with the touch-sensitive surface according to some embodiments.

[0026] Figure 6 An example of an authentication process according to some embodiments is shown.

[0027] Figure 7 An example of an authentication process according to some embodiments is shown. DETAILED DESCRIPTION

[0028] The following description is directed to certain implementations for the purpose of describing the innovative aspects of the present disclosure. However, those skilled in the art will readily recognize that the teachings herein may be applied in many different ways. The described implementations may be implemented in any device, apparatus, or system that includes a biometric system as disclosed herein. In addition, it is contemplated that the described implementations may be included in or associated with a variety of electronic devices, such as, but not limited to: mobile phones, cellular phones with multimedia Internet capabilities, mobile television receivers, wireless devices, smart phones, smart cards, wearable devices such as bracelets, shoulder straps, wristbands, rings, headbands, patches, devices, personal data assistants (PDAs), wireless email receivers, handheld or portable computers, netbooks, notebook computers, smart computers, tablet computers, printers, copiers, scanners, fax devices, global positioning system (GPS) receivers / navigators, cameras, digital media players (e.g., MP3 players), camcorders, game consoles, watches, clocks, calculators, television monitors, flat panel displays, electronic reading devices (e.g., e-readers), mobile health devices, computer monitors, automotive displays (including odometer and speedometer displays, etc.), cockpit controls and / or displays , camera view displays (e.g., displays for rear view cameras in vehicles), electronic photographs, electronic billboards or signs, projectors, architectural structures, microwave ovens, refrigerators, stereo systems, cassette recorders or players, DVD players, CD players, VCRs, radios, portable memory chips, washers, dryers, washer / dryers, automated teller machines (ATMs), parking meters, packaging (e.g., in electromechanical systems (EMS) applications including microelectromechanical systems (MEMS) applications as well as non-EMS applications), aesthetic structures (e.g., image displays on a piece of jewelry or clothing), and a variety of EMS devices. The teachings herein may also be used in applications such as, but not limited to, electronic switching devices, radio frequency filters, sensors, accelerometers, gyroscopes, motion sensing devices, magnetometers, inertial components for consumer electronic devices, parts for consumer electronic device products, automotive doors, steering wheels or other automotive parts, varactors, liquid crystal devices, electrophoretic devices, drive schemes, manufacturing processes, and electronic test equipment. Thus, the teachings are not intended to be limited to only the implementations depicted in the figures, but instead have broad applicability as will be readily apparent to those skilled in the art.

[0029] In some embodiments, the identification method may include acquiring a first fingerprint image at an area near the touch location after the user touches the touch-sensitive surface of the device. The touch-sensitive surface may be a surface that is sensitive to physical touch by means of conventional touch sensing methods, including capacitive, resistive, optical, or ultrasonic methods. Sensors that sense touch in the touch-sensitive surface may reside on the surface, within the surface, or below the surface. The location may be determined based on the touch centroid, the initial touch location, or any other geometric method for determining the touch location. The area may be near the touch location and may be circular, square, rectangular, or any arbitrary shape. The area may also be determined by the area of ​​skin of the finger in contact with the touch-sensitive surface. The area may be expanded to exceed, or reduced to a size less than, the area of ​​skin of the finger in contact with the touch-sensitive surface. The area may be an outline of a region of interest within or adjacent to the contact area of ​​the finger with the touch-sensitive surface.

[0030] A first fingerprint image may be acquired by a fingerprint sensor. Such fingerprint sensors may operate according to the principles of optics, capacitance, ultrasound, or any other technology capable of acquiring a fingerprint image. The fingerprint image may then be stored in a memory such as in a processor cache, in a memory resident in a fingerprint sensor, in a memory resident in a controller, or in a memory resident in or operatively connected to any of one or more processors in a device.

[0031] The identification process may be performed on a fingerprint image, such as a first fingerprint image, by any algorithm known in the art for fingerprint identification, such as by comparing features extracted from the fingerprint image to a database of known fingerprints. Such a database may reside on the device, on another local device, or on any remote device.

[0032] The difference between the characteristics of the first fingerprint image and the characteristics of the second fingerprint image may be determined by a processor or a digital signal processor (DSP) residing in or configured as a fingerprint sensor, a controller, a general-purpose processor, an application processor, a processor that also handles touch, a graphics processor, or any circuit within a device capable of processing image data.

[0033] Figure 1 A graphical representation of an example mobile device 100 including a fingerprint sensing system according to some embodiments is shown. For example, the mobile device 100 may represent various portable computing devices such as cellular phones, smart phones, smart watches, multimedia devices, personal gaming devices, tablet computers, and notebook computers, as well as other types of portable computing devices. However, the various embodiments described herein are not limited to application in portable computing devices. In fact, the various techniques and principles disclosed herein can be applied in traditionally non-portable devices and systems, for example, in computer monitors, television displays, all-in-one machines, vehicle navigation devices, and audio systems, among other applications. In addition, the various embodiments described herein are not limited to application in devices including displays.

[0034] The mobile device 100 generally includes a housing (also referred to as a "housing" or "casing") 102 within which various circuits, sensors, and other electrical components are located. In the illustrated example embodiment, the mobile device 100 also includes a touch screen display (also referred to herein as a "touch-sensitive display") 104. The touch screen display 104 generally includes a display and a touch screen disposed over, incorporated into, or integrated with the display. The display 104 may generally represent any of a variety of suitable display types employing any of a variety of suitable display technologies. For example, the display 104 may be a digital micro-shutter (DMS)-based display, a light emitting diode (LED) display, an organic LED (OLED) display, a liquid crystal display (LCD), an LCD display using LEDs as a backlight, a plasma display, an interferometric modulator (IMOD)-based display, or another type of display suitable for use in conjunction with a touch-sensitive user interface (UI) system.

[0035] The mobile device 100 may include various other devices or components for interacting with a user, or for transmitting information to or receiving information from a user. For example, the mobile device 100 may include one or more microphones 106, one or more speakers 108, and in some cases, one or more at least partially mechanized buttons 110. The mobile device 100 may include various other components that enable additional features such as one or more video or still image cameras 112, one or more wireless network interfaces (not shown) (e.g., Bluetooth, WiFi, or cellular), and one or more non-wireless interfaces 116 (e.g., a universal serial bus (USB) interface or an HDMI interface).

[0036] The mobile device 100 may include an ultrasonic sensing system 118 capable of scanning and imaging a subject signature (e.g., a fingerprint, palm print, or handprint). In some embodiments, the fingerprint sensing system 118 may act as a touch-sensitive control button. In some embodiments, the touch-sensitive control button may be positioned below the fingerprint sensing system 118 or implemented as a mechanical or voltage-sensitive system integrated with the fingerprint sensing system 118. In other words, in some embodiments, the area occupied by the ultrasonic sensing system 118 may act as a user input button to control the mobile device 100 and as a fingerprint sensor to implement security features (e.g., user authentication features). In some embodiments, the fingerprint sensing system 118 may be positioned below the glass cover of the display or below a portion of the display itself. In some embodiments, the fingerprint sensing system 118 may be positioned on a side wall or on the back side of the mobile device cover 102. The cover 102 may accommodate a fingerprint sensor that may be configured to operate in a touch sensing mode or a fingerprint sensing mode as part of the fingerprint sensing system 118.

[0037] Figure 2AA block diagram representation of a device for authenticating fingerprints is shown. The fingerprint sensor 202 is operably connected to the touch sensor 204, the authentication module 208, and the controller 206. The fingerprint sensor 202 and the touch sensor 204 can be integrated into a block that performs both fingerprint sensing functions and touch sensing functions. The authentication module 208 and the controller 206 can be integrated into a block that performs both authentication functions and control functions. The authentication module 208 and the controller 206 can also be integrated into a general purpose processor of the device, or reside in one or more of any processors in the device.

[0038] The fingerprint sensor 202 may generate an image, or data representing an image, by any means of capturing a fingerprint and converting the fingerprint into an image or image data. The identification module 208 may receive a fingerprint image or fingerprint image data from the fingerprint sensor. Such fingerprint image data may include features extracted from the fingerprint. The identification module 208 may perform the identification process by any method known in the art for fingerprint identification, such as by comparing the features extracted from the fingerprint image to a database of fingerprint features associated with authorized users. The identification module 208 may perform the identification process on received raw image data, received filtered or pre-processed image data, or received feature data. The identification module 208 may also filter or pre-process the received image or image data and extract features from the image or data.

[0039] The controller 206 may be operably connected to the fingerprint sensor 202 , the touch sensor 204 , and the authentication module 208 to control the configuration, power mode, security level, or other aspects of the fingerprint sensor 202 , the touch sensor 204 , and the authentication module 208 .

[0040] Figure 2B Fingerprint sensing system 200 is shown incorporated into mobile device 230. Mobile device 230 may also contain power source 210, image processing module 218, processor 216, and memory 212, for example.

[0041] Figure 2B Shows that it contains Figure 2A 2 is a block diagram representation of components of an example mobile device 230 of the fingerprint sensing system 200. For example, the mobile device 230 may be the mobile device 230 described above in Figure 1 Displayed and referenced Figure 1A block diagram representation of the described mobile device 100. Although the controller 206 is shown and described as a single component, in some embodiments, the controller 206 may collectively refer to two or more distinct control units or processing units that are in electrical communication with each other. In some embodiments, the controller 206 may include one or more of a general-purpose single-chip or multi-chip processor, a central processing unit (CPU), a digital signal processor (DSP), an application processor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device (PLD), discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions and operations described herein.

[0042] Figure 2B The fingerprint sensing system 200 may include an image processing module 218. In some embodiments, the raw measured image data provided by the fingerprint sensor 202 may be sent, transmitted, communicated, or otherwise provided to the image processing module 218. The image processing module 218 may include any appropriate combination of hardware, firmware, and software configured, adapted, or otherwise operable to process the image data provided by the fingerprint sensor 202. In some embodiments, the image processing module 218 may include signal or image processing circuits or circuit components, including, for example, amplifiers (e.g., instrumentation amplifiers or buffer amplifiers), analog or digital mixers or multipliers, switches, analog / digital converters (ADCs), passive filters or active analog filters, and the like. In some embodiments, one or more of such circuits or circuit components may be integrated within the controller 206, for example, where the controller 206 is implemented as a system-on-chip (SoC) or a system-in-package (SIP). In some embodiments, one or more of such circuits or circuit components may be integrated within a DSP that is included within or coupled to the controller 206. In some implementations, the image processing module 218 may be implemented at least in part via software. For example, one or more functions of one or more of the circuits or circuit components just described or operations performed by one or more of the circuits or circuit components may actually be performed by one or more software modules executed, for example, in a processing unit of the controller 206 (e.g., in a general purpose processor or DSP). In some implementations, the image processing module 218, or portions thereof, may be implemented with software that may run on an application processor (e.g., the processor 216 associated with the mobile device 230). The application processor may have a dedicated co-processor and / or software module for secure processing of biometric image data within the application processor (sometimes referred to as a "trust partition").

[0043] In some implementations, in addition to the fingerprint sensing system 200, the mobile device 230 may include a separate processor 216, a memory 212, an interface 220, and a power source 210. In some implementations, the controller 206 of the fingerprint sensing system 200 may control the fingerprint sensor 202 and the image processing module 218, and the processor 216 of the mobile device 230 may control other components of the mobile device 230. In some implementations, the processor 216 transmits data including, for example, instructions or commands to the controller 206. In some such implementations, the controller 206 may transmit data including, for example, raw or processed image data (also referred to as "image information") to the processor 216. It should also be understood that in some other implementations, the functions of the controller 206 may be implemented entirely or at least partially by the processor 216. In some such implementations, a separate controller 206 for the fingerprint sensing system 200 may not be required because the functions of the controller 206 may be performed by the processor 216 of the mobile device 230.

[0044] Depending on the implementation, one or both of the controller 206 and the processor 216 may store data in the memory 212. For example, the data stored in the memory 212 may include measured raw image data, filtered or otherwise processed image data, estimated image data, or final optimized image data. The memory 212 may store processor executable code or other executable computer readable instructions that can be executed by one or both of the controller 206 and the processor 216 to perform various operations (or cause other components such as the fingerprint sensor 202, the image processing module 218, or other modules to perform operations), including any of the calculations, calculations, estimates, or other determinations described herein. It should also be understood that the memory 212 may collectively refer to one or more memory devices (or "components"). For example, depending on the implementation, the controller 206 may access and store data in a different memory device than the processor 216. In some implementations, one or more of the memory components may be implemented as a NOR or NAND-based flash memory array. In some other embodiments, one or more of the memory components may be implemented as different types of non-volatile memory. In addition, in some embodiments, one or more of the memory components may include a volatile memory array, such as a type of RAM.

[0045] In some embodiments, the controller 206 or the processor 216 may transmit data stored in the memory 212 or data received directly from the image processing module 218 through the interface 220. For example, such transmitted data may include image data or data derived from the image data or otherwise determined. The interface 220 may collectively refer to one or more interfaces of one or more different types. In some embodiments, the interface 220 may include a memory interface for receiving data from an external memory (e.g., a removable memory device) or storing data to an external memory (e.g., a removable memory device). Additionally or alternatively, the interface 220 may include one or more wireless network interfaces or one or more wired network interfaces capable of transmitting raw or processed data to an external computing device, system, or server and receiving data from an external computing device, system, or server.

[0046] The power supply 210 can provide power to some or all components in the mobile device 230. The power supply 210 can include one or more of a variety of energy storage devices. For example, the power supply 210 can include a rechargeable battery, such as a nickel-cadmium battery or a lithium-ion battery. Additionally or alternatively, the power supply 210 can include one or more supercapacitors. In some embodiments, the power supply 210 can be charged (or "recharged") using power obtained from, for example, a wall socket (or "socket") or a photovoltaic device (or "solar cell" or "solar cell array") integrated with the mobile device 230. Additionally or alternatively, the power supply 210 can be wirelessly rechargeable. The power supply 210 can include a power management integrated circuit and a power management system.

[0047] As used hereinafter, the term "processing unit" refers to any combination of one or more of a controller of the fingerprint sensing system (e.g., controller 206), an image processing module (e.g., image processing module 218), or a separate processor of a device including the fingerprint sensing system (e.g., processor 216). In other words, operations described hereinafter as being performed by or using the processing unit may be performed by one or more of a controller of the fingerprint sensing system, an image processing module, or a separate processor of a device including the fingerprint sensing system.

[0048] Figure 3 A cross-sectional projection view of a diagrammatic representation of a portion of an example fingerprint sensing system 300 is shown according to some implementations. For example, the fingerprint sensing system 300 may implement reference Figure 2A and Figure 2BThe fingerprint sensing system 200 described above. The fingerprint sensing system 300 may include a fingerprint sensing layer 308 located above a substrate or display 304 and below a platen (e.g., a "cover plate" or "glass cover") 306. Alternatively, the fingerprint sensing layer 308 may be located below the substrate or display 304 (not shown). Alternatively, the fingerprint sensing layer 308 may be integrated with the substrate or display 304.

[0049] In some implementations, the display 304 can be positioned between the pressure plate 306 and the fingerprint sensing layer 308. In some implementations, the display 304 can serve as the pressure plate 306. One or more protective layers, acoustic matching layers, anti-smudge layers, adhesive layers, decorative layers, conductive layers, or other coatings (not shown) can be included on one or more sides of the display 304, the fingerprint sensing layer 308, and the pressure plate 306.

[0050] The pressure plate 306 can be formed of any suitable material that can be operably coupled to the fingerprint sensing layer 308. For example, the pressure plate 306 can be formed of one or more of glass, plastic, ceramic, sapphire, metal, or metal alloy. In some embodiments, the pressure plate 306 can be a cover plate (e.g., a glass cover plate) or a lens glass of the underlying display. In some embodiments, the pressure plate 306 can include one or more polymers (e.g., one or more types of polyparaxylene) and can be significantly thinner. In some embodiments, the pressure plate 306 can have a thickness in the range of about 10 micrometers (μm) to about 1000 μm or more.

[0051] Figure 4A An example implementation of a device 400 is shown that includes a fingerprint sensing system 404 that can authenticate a fingerprint based on a first fingerprint image from a first contact near a first area 406, and can then acquire a second fingerprint image after a user swipes his / her finger across a touch-sensitive surface 402.

[0052] At proximity time t1, the user places his / her finger 408 at a first contact proximate to the first area 406. The device 400 may acquire a first fingerprint image at an area proximate to the first contact proximate to the first area 406 and may perform an authentication process on the fingerprint image to ensure that the fingerprint belongs to an authorized user. The authentication process may also ensure that the fingerprint does not belong to a user who has been specifically blacklisted for unauthorized users.

[0053] At the proximity time t2, the user slides his / her finger 408 from the first contact near the first area 406 to the second contact position 410. The device 400 may acquire a second fingerprint image at an area near the second contact position 410. The device 400 may determine a difference between one or more characteristics of the second fingerprint image and one or more characteristics of the first fingerprint image, and perform a second authentication process if the one or more characteristics exceed a threshold value.

[0054] In this example shown, where the same user merely slides his / her finger from a first contact near the first area 406 of the touch-sensitive surface to a second contact position 410, the difference between one or more characteristics of the second fingerprint image and one or more characteristics of the first fingerprint image may be below a threshold, and thus the device 400 does not need to perform a second authentication process because it is sufficient to determine that the same authenticated user is still interfacing with the device 400.

[0055] Figure 4B An example implementation of a device 400 is shown that includes a fingerprint sensing system 404 that can authenticate a fingerprint based on a first fingerprint image from a first contact near a first area 406, and can then acquire a second fingerprint image after a user swipes his / her finger across a touch-sensitive surface 402.

[0056] At proximity time t1, the user places his / her finger 408 at a first contact proximate to the first area 406. The device 400 may acquire a first fingerprint image at the first contact proximate to the first area 406 and may perform an authentication process on the fingerprint image to ensure that the fingerprint belongs to an authorized user. The authentication process may also ensure that the fingerprint does not belong to a user who has been specifically blacklisted for unauthorized users.

[0057] At close time t2, the user (or a different, possibly unauthorized user) brings a different finger 409 into contact with the second contact location 407. The device 400 may acquire a second fingerprint image at an area close to the second contact location 407. The device 400 may determine a difference between one or more characteristics of the second fingerprint image and one or more characteristics of the first fingerprint image, and perform a second authentication process if the one or more characteristics exceed a threshold.

[0058] exist Figure 4B In this example shown in , when a different finger contacts the touch-sensitive surface at the second contact position 410, because the fingerprints are different, the difference between one or more characteristics of the second fingerprint image and one or more characteristics of the first fingerprint image may be greater than a threshold, and thus the device 400 performs a second authentication process because it is sufficient to determine that an unauthenticated user or finger is interfacing with the device 400.

[0059] The characteristics of a fingerprint image may change between one image and a subsequent image based on a number of factors. For example, a user may traverse his / her finger to the touch-sensitive surface, or touch the touch-sensitive surface with a different part of the finger, or apply more force to the touch-sensitive surface. The recognition module 208 and the image processing module 218 may account for this factor by applying an image transform to the second fingerprint image in order to minimize differences in one or more characteristics of multiple images from the same finger.

[0060] Figure 5 An example implementation of a device 500 is shown that includes a fingerprint sensing system 504 that can authenticate a fingerprint based on a first fingerprint image from a first contact near a first area 515 at time t1, then at a later time t2, the user can remove their finger from the touch-sensitive surface so that there is no longer a contact, then a second fingerprint image can be acquired after the user again places their finger on the touch-sensitive surface 502 at a second contact near a second area 516 at time t3. At some time near t3, the device 500 can determine a difference between characteristics of the second fingerprint image and characteristics of the first fingerprint image, and perform a second authentication process based on whether the difference between the characteristics of the second fingerprint image and characteristics of the first image is greater than a threshold.

[0061] At some time near time t1, after the fingerprint sensing system 504 authenticates the fingerprint based on the first fingerprint image from the first contact near the first area 515, the device 500 may be in an unlocked state, or in other words, in a state in which the user has been authenticated by his or her fingerprint and has accessed the device at a security level based on his or her authentication level and / or user account and / or device settings.

[0062] At some time near t2, where device 500 has authenticated the user by the user's fingerprint, the device may remain in the unlocked state until there is some interaction with device 500. Additionally, if t2 is greater than a threshold beyond t2, the device may enter a locked state.

[0063] At some time near t3, when the finger 508 contacts the touch-sensitive surface 502, the fingerprint sensing system 504 may then acquire a second fingerprint image after the user places his finger on the touch-sensitive surface 502 again at a second contact near the second area 516 at time t3. At some time near t3, the device 500 may determine the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image, and perform a second authentication process based on whether the difference between the characteristics of the second fingerprint image and the characteristics of the first image is greater than a threshold. The characteristic may be any of contact time, previous contact cessation, contact orientation, contact area, contact size, or other aspects. For example, by determining that there has been a contact cessation within an amount of time between a first contact near the first area 515 and a second contact near the second area 516, where the amount of time is greater than a threshold, the device 500 may perform the second authentication process. By way of another example, by determining that t3 is greater than t1 by an amount greater than a threshold, the device 500 may perform the second authentication process. The second authentication process may be performed, for example, on the second fingerprint image, or a fingerprint image obtained thereafter.

[0064] The aforementioned characteristic may also be image energy level, image energy distribution, image variance, image contour, image time stamp or correlation between images.

[0065] The aforementioned thresholds may also be based on the security level. For example, at a lower security level, a larger threshold may be acceptable, where larger differences between the images do not cause a second authentication process to be required. However, this may increase the false acceptance rate, which may be acceptable at a lower security level. For example, at a higher security level, a smaller threshold may be required, where smaller differences between the images are used to determine whether a second authentication process may be required. However, this may increase the false rejection rate, which may be acceptable at a higher security level.

[0066] After successful authentication, device 500 may remain in the unlocked state, or in the case of unsuccessful authentication, device 500 may transition to a locked state, or the user may be notified to authenticate again or by a different method.

[0067] Figure 6 A block diagram representation of an example implementation of a process 600 for authentication is shown. At block 605, a first fingerprint image is acquired at an area on the touch-sensitive surface proximate to a first contact location. At block 610, an authentication process is performed based on the first fingerprint image. At block 615, a second fingerprint image is acquired at an area on the touch-sensitive surface proximate to a second contact location. At block 620, a difference between characteristics of the second fingerprint image and characteristics of the first fingerprint image is determined. At block 625, a second authentication process is performed based on whether the difference between characteristics of the second fingerprint image and characteristics of the first fingerprint image is greater than a threshold.

[0068] The second identification process performed at block 625 may be performed, for example, on the second fingerprint image or a fingerprint image acquired thereafter. There may be some delay time between the acquisition of the second fingerprint image, the determination of the difference between the characteristics of the first fingerprint image and the characteristics of the second fingerprint image, and the second identification process. Thus, the second identification process may be performed based on an image other than the second fingerprint image.

[0069] If, for example, it is determined that the second fingerprint image is of low quality, or the security level does not require immediate re-authentication, a time delay may occur before performing the second authentication process. For a certain lower security level, it may be advantageous not to risk false rejection of fingerprints based on low quality images.

[0070] Figure 7 A flowchart representation of an example implementation 700 of an authentication process is shown.

[0071] At block 710, a first fingerprint image is acquired at an area on the touch-sensitive surface proximate to the first contact location. At block 711, authentication is performed based on the fingerprint image, e.g., the first fingerprint image. At determination point 712, if there is an unsuccessful authentication, this may indicate that the device remains locked, and the device returns to block 710 to wait until a successfully authenticated image is acquired. At determination point 712, after there is a successful authentication, this may indicate a situation where the user's fingerprint is authenticated and the device is unlocked, and at block 714 a second fingerprint image is acquired at an area on the touch-sensitive surface proximate to the second contact location, followed by determining, at block 716, a difference between characteristics of the second fingerprint image and characteristics of the first fingerprint image, and at block 718, determining whether the difference is greater than a threshold.

[0072] If the difference is greater than the threshold, this may be because the second fingerprint image represents the finger of an unauthorized user, and the device returns to locked mode and returns to block 710 to await authentication of the first fingerprint image. If the difference is not greater than the threshold, this may be because the second fingerprint image represents the finger of an authorized user, and no additional authentication process needs to be performed.

[0073] As used herein, a phrase referring to "at least one" of a list of items refers to any combination of those items, including single members. As an example, "at least one of: a, b, or c" is intended to cover: a, b, c, ab, ac, bc, and abc.

[0074] The various illustrative logics, logical blocks, modules, circuits, and algorithmic processes described in conjunction with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or a combination of both. The interchangeability of hardware and software has been generally described in terms of functionality and illustrated in the various illustrative components, blocks, modules, circuits, and processes described above. Whether such functionality is implemented in hardware or software depends on the specific application and design constraints imposed on the overall system.

[0075] The hardware and data processing devices used to implement various illustrative logics, logic blocks, modules, and circuits described in conjunction with the aspects disclosed herein may be implemented or performed by a general purpose single-chip or multi-chip processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination designed to perform the functions described herein. A general purpose processor may be a microprocessor or any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration. In some embodiments, specific processes and methods may be performed by circuits specific to a given function.

[0076] In one or more aspects, the functions described may be implemented in hardware, digital electronic circuitry, computer software, firmware (including the structures disclosed in this specification and their structural equivalents), or any combination thereof. The embodiments of the subject matter described in this specification may also be implemented as one or more computer programs, such as one or more modules of computer program instructions encoded on computer storage media to be executed by a data processing device or to control the operation of the data processing device.

[0077] If implemented in software, the function may be stored as one or more instructions or codes on a computer-readable medium (e.g., a non-transitory medium) or transmitted via the computer-readable medium (e.g., a non-transitory medium). The process of the method or algorithm disclosed herein may be implemented in a processor-executable software module that may reside on a computer-readable medium. Computer-readable media include both computer storage media and communication media, and the communication media include any media that can be enabled to transfer a computer program from one place to another. Storage media may be any available media accessed by a computer. By way of example and not limitation, non-transitory media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or any other media that can be used to store the desired program code in the form of instructions or data structures and can be accessed by a computer. Moreover, any connection may be appropriately referred to as a computer-readable medium. Disks and optical disks as used herein include compact disks (CDs), laser optical disks, optical optical disks, digital versatile disks (DVDs), floppy disks, and Blu-ray disks, where disks typically reproduce data magnetically, and optical disks reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media. In addition, the operations of a method or algorithm may reside as any one or any combination or set of codes and instructions on machine-readable media and computer-readable media that can be incorporated into a computer program product.

[0078] Various modifications to the embodiments described in the present invention may be readily apparent to those of ordinary skill in the art, and the general principles defined herein may be applied to other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the embodiments shown herein, but should be given the widest scope consistent with the claims, the principles and novel features disclosed herein. The word "exemplary" is used exclusively herein (where possible) to mean "serving as an example, instance, or illustration." Any embodiment described herein as "exemplary" should not necessarily be construed as preferred or advantageous over other embodiments.

[0079] Certain features described in this specification in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually in multiple embodiments or in any suitable subcombination. Furthermore, while features may be described above as functioning in certain combinations and even initially claimed, in some cases one or more features from a claimed combination may be deleted from the combination, and a claimed combination may be directed to a subcombination or variations of a subcombination.

[0080] Similarly, although the operation is depicted in a specific order in the accompanying drawings, this should not be understood as requiring to perform such operations in the specific order shown or in a sequential order, or to perform all described operations, to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of the various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and system can be integrated together in a single software product or encapsulated in multiple software products. In addition, other embodiments are within the scope of the appended claims. In some cases, the actions narrated in the claims can be performed in different orders and still achieve the desired result.

[0081] It will be understood that unless it is explicitly indicated that the features in any of the specific described embodiments are incompatible with each other, or the surrounding context implies that they are mutually exclusive and not easily combined in a complementary and / or supporting sense, the entire content of this disclosure anticipates and contemplates that the specific features of those complementary embodiments can be selectively combined to provide one or more comprehensive, but slightly different technical solutions. Therefore, it will be further understood that the above description has been given only by way of example, and that modifications in detail may be made within the scope of this disclosure.

Claims

1. A method for authentication, the method comprising: Acquiring a first fingerprint image at an area on the touch-sensitive surface proximate to a first contact location; performing a first identification process based on the first fingerprint image; acquiring a second fingerprint image at an area on the touch-sensitive surface proximate to a second contact location; determining a difference between a characteristic of the second fingerprint image and a characteristic of the first fingerprint image; and A second authentication process is performed based on whether the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is greater than a threshold, and wherein the second authentication process is performed on the second fingerprint image or a fingerprint image obtained thereafter.

2. The method of claim 1, wherein the characteristic of the second fingerprint image and the characteristic of the first fingerprint image are two-dimensional positions.

3. The method of claim 1, wherein the characteristic of the second fingerprint image and the characteristic of the first fingerprint image are energy levels.

4. The method of claim 1, wherein the characteristic of the second fingerprint image and the characteristic of the first fingerprint image are timestamps.

5. The method of claim 1, wherein the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is based on a correlation function.

6. The method of claim 1, further comprising: The characteristic of the second fingerprint image and the characteristic of the first fingerprint image are determined from among a set of characteristics based on a security level.

7. The method of claim 1, further comprising: Determine whether contact with a surface of a touch-sensitive device has ceased.

8. A device for authentication, the device comprising: Touch-sensitive surfaces; A fingerprint sensor configured to acquire: a first fingerprint image at an area on the touch-sensitive surface proximate to a first contact location and a second fingerprint image at an area on the touch-sensitive surface proximate to a second contact location; One or more processors coupled to the fingerprint sensor and configured to: performing a first identification process based on the first fingerprint image; determining a difference between a characteristic of the second fingerprint image and a characteristic of the first fingerprint image; and A second authentication process is performed based on whether the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is greater than a threshold, and wherein the second authentication process is performed on the second fingerprint image or a fingerprint image obtained thereafter.

9. The apparatus of claim 8, wherein the characteristic of the second fingerprint image and the characteristic of the first fingerprint image are two-dimensional positions.

10. The apparatus of claim 8, wherein the characteristic of the second fingerprint image and the characteristic of the first fingerprint image are energy levels.

11. The apparatus of claim 8, wherein the characteristic of the second fingerprint image and the characteristic of the first fingerprint image are timestamps.

12. The apparatus of claim 8, wherein the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is based on a correlation function.

13. The apparatus of claim 8, wherein the one or more processors are further configured to: The characteristic of the second fingerprint image and the characteristic of the first fingerprint image are determined from among a set of characteristics based on a security level.

14. The apparatus of claim 8, wherein the one or more processors are further configured to: A determination is made as to whether contact with a surface coupled to the fingerprint sensor has ceased.

15. A device for authentication, the device comprising: means for acquiring a first fingerprint image at an area on the touch-sensitive surface proximate to a first contact location and acquiring a second fingerprint image at an area on the touch-sensitive surface proximate to a second contact location; means for performing an authentication process based on said first fingerprint image; means for determining a difference between a characteristic of the second fingerprint image and a characteristic of the first fingerprint image; and Means for performing a second authentication process based on whether the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is greater than a threshold, and wherein the second authentication process is performed on the second fingerprint image or a fingerprint image obtained thereafter.

16. The apparatus of claim 15, wherein the characteristic of the second fingerprint image and the characteristic of the first fingerprint image are two-dimensional positions.

17. The apparatus of claim 15, wherein the characteristic of the second fingerprint image and the characteristic of the first fingerprint image are energy levels.

18. The apparatus of claim 15, wherein the characteristic of the second fingerprint image and the characteristic of the first fingerprint image are timestamps.

19. The apparatus of claim 15, wherein the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is based on a correlation function.

20. The apparatus of claim 15, further comprising: Means for determining the characteristic of the second fingerprint image and the characteristic of the first fingerprint image from among a set of characteristics based on a security level.

21. The apparatus of claim 15, further comprising: Means for determining whether contact with a surface of a touch-sensitive device has ceased.

22. A non-transitory computer readable medium having stored thereon software comprising instructions that, when executed by one or more processors, cause a device to perform one or more operations comprising: Acquiring a first fingerprint image at an area on the touch-sensitive surface proximate to a first contact location; performing an authentication process based on the first fingerprint image; acquiring a second fingerprint image at an area on the touch-sensitive surface proximate to a second contact location; determining a difference between a characteristic of the second fingerprint image and a characteristic of the first fingerprint image; and A second authentication process is performed based on whether the difference between the characteristics of the second fingerprint image and the characteristics of the first fingerprint image is greater than a threshold, and wherein the second authentication process is performed on the second fingerprint image or a fingerprint image obtained thereafter.

23. The non-transitory computer readable medium of claim 22, wherein the one or more operations further comprise: Determine whether contact with a surface of a touch-sensitive device has ceased.

Images