Method and system for access control based on key-specific fingerprints

Abstract

The present invention relates to a method and system for key-specific fingerprint-based access control. Using a biometric sensor coupled to a touch screen, fingerprint data is collected from multiple virtual key regions of the touch screen. A virtual key region of the multiple virtual key regions includes an area of ​​the touch screen configured to display an input prompt and collect touch data in response to the input prompt. In response to determining that the fingerprint data has a similarity above a threshold level with stored fingerprint data associated with each of the virtual key regions and the sequence of the virtual key regions matches the stored key sequence, access to a protected resource is allowed.

Description

Technical Field

[0001] The present invention generally relates to a method, system and computer program product for fingerprint-based access control. More specifically, the present invention relates to a method, system and computer program product for key-specific fingerprint-based access control. Background Art

[0002] An access control system controls access to protected resources, limiting access to only authorized users. A protected resource may be software. For example, an access control system may allow access to some software functions only if a user enters a correct password or username and matching password. A protected resource may also be a physical facility, such as a building, a portion of a building, or a physical device that is accessible or usable only to a person who enters a code on a keypad, has an authorized fingerprint or other biometric data, or uses another access control method.

[0003] Mobile devices typically include a processor, memory, voice and data communication capabilities, and a touch screen. A touch screen is a display device that also accepts user input via touches or gestures on a specified portion of the display. In some devices, the touch screen or a portion of the touch screen also simulates a physical keyboard, where a marked portion of the display (also called a virtual key area) is marked with letters, numbers, or symbols that are input to the device when the portion is touched.

[0004] To prevent unauthorized use, mobile devices typically include a password function in which the user sequentially touches a set of virtual key areas to enter a password. If the user touches a sequence that matches a saved password, the user is allowed to access additional device functions. For example, when a single physical key included in a mobile device is pressed, the device displays a screen including a virtual numeric keypad and prompts the user to enter his or her numeric personal identification number (PIN). Only when the user enters the PIN correctly is more access granted than a set of basic notifications and emergency capabilities. Another mobile device has no physical keys and triggers a PIN entry prompt when the device detects that it has been picked up. Other mobile devices allow access via a password that includes letters, numbers, and symbols. Mobile devices typically have additional biometric access control features, such as using a dedicated fingerprint sensor or camera-based facial recognition capabilities.

[0005] Devices including processors, memory, voice and data communication capabilities, and touch screens are also used as access control devices to control access to physically protected resources. For example, an access control device can be configured to control a virtual keypad of a door lock, unlocking the door only when a preset code is entered on the virtual keypad. Summary of the invention

[0006] Illustrative embodiments provide a method, system, and computer program product. Embodiments include a method of collecting fingerprint data from multiple virtual key regions of the touch screen using a biometric sensor coupled to the touch screen, a virtual key region of the multiple virtual key regions including a region of the touch screen configured to display an input prompt and collect touch data in response to the input prompt. Embodiments allow access to a protected resource in response to determining that the fingerprint data has a similarity above a threshold level with stored fingerprint data associated with each of the virtual key regions and that a sequence of the virtual key regions matches a stored key sequence.

[0007] Embodiments include a computer usable program product comprising one or more computer readable storage devices and program instructions stored on at least one of the one or more storage devices.

[0008] Embodiments include a computer system comprising one or more processors, one or more computer-readable memories, one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Certain novel features which are believed to be characteristic of the invention are set forth in the appended claims. However, the invention itself, as well as its preferred mode of use, further objects and advantages, will be best understood by reference to the following detailed description of illustrative embodiments taken in conjunction with the accompanying drawings, in which:

[0010] Figure 1 depicts a block diagram of a network of data processing systems in which the illustrative embodiments may be implemented;

[0011] Figure 2 depicts a block diagram of a data processing system in which the illustrative embodiments may be implemented;

[0012] Figure 3 depicts a block diagram of an example configuration for key-specific fingerprint-based access control in accordance with an illustrative embodiment;

[0013] Figure 4 depicts a block diagram of an example configuration for key-specific fingerprint-based access control in accordance with an illustrative embodiment;

[0014] Figure 5 depicts a block diagram of an example configuration for key-specific fingerprint-based access control in accordance with an illustrative embodiment;

[0015] Figure 6 An example of key-specific fingerprint-based access control according to an illustrative embodiment is described;

[0016] Figure 7 A flowchart depicting an example process for key-specific fingerprint-based access control in accordance with an illustrative embodiment is described;

[0017] Figure 8 A cloud computing environment according to an embodiment of the present invention is described; and

[0018] Fig. 9 An abstract model layer according to an embodiment of the present invention is described. DETAILED DESCRIPTION

[0019] The illustrative embodiments recognize that access control systems often rely on an authorized user having a specific item (e.g., a physical key to a lock, a key card with a magnetic stripe for swiping for access or a chip that is read for access, or knowing a password) or being identified as an authorized user (e.g., having an identification card or biometric information). However, the reliance on possession of a specific item still creates security vulnerabilities. For example, an unauthorized user may observe an authorized user enter a correct password and then reuse the same password to gain access. Reliance on identification as an authorized user also creates security vulnerabilities. For example, a child may place a sleeping parent's finger on the device's fingerprint sensor to gain unauthorized access to the parent's mobile device. Therefore, by implementing access control based on both having a specific item and being identified as an authorized user, security can be improved.

[0020] However, the illustrative embodiments also recognize that the two-step access control process is inconvenient and time consuming. For example, requiring a user to place a finger on a dedicated fingerprint sensor and then enter a PIN using a touch screen takes approximately twice as long as performing only one of these steps, thus creating a poor user experience for users who access a mobile device hundreds of times a day. Therefore, the illustrative embodiments recognize that there is a need to merge access control based on both having a specific item and being identified as an authorized user into a single process.

[0021] The illustrative embodiments also recognize that in devices that currently allow access based on biometric access control (such as using a dedicated fingerprint sensor or camera-based facial recognition capabilities), these devices still require the user to enter a PIN or password, for example, at periodic intervals, or to access particularly protected device functions (such as updating the device's operating system). In addition, these devices suffer from the same security vulnerabilities discussed herein. Therefore, the illustrative embodiments recognize that in these devices, there is a need to improve security and simplify the access control process by merging biometric and password-based access control into a single process.

[0022] The illustrative embodiments recognize that currently available tools or solutions do not address these needs or provide adequate solutions to these needs.The illustrative embodiments used to describe the present invention generally address and solve the above-mentioned problems and other problems related to access control based on key-specific fingerprints.

[0023] Embodiments may be implemented as a software application.An application implementing an embodiment may be configured as a modification to an access control system, a separate application operating in conjunction with an existing access control system, a stand-alone application, or some combination thereof.

[0024] Specifically, some illustrative embodiments provide a method that collects biometric data from a plurality of virtual key regions of a touch screen and determines whether the biometric data has a similarity above a threshold level with stored biometric data associated with each of the virtual key regions and whether the sequence of the virtual key regions matches the stored key sequence. If both are true, the method allows access to a protected resource; otherwise, the method blocks access to the protected resource.

[0025] One embodiment uses a biometric sensor coupled to a touch screen. The display component of the touch screen displays one or more virtual key areas, each of which is marked with letters, numbers, or symbols, which are input to the device when the data collection surface of the touch screen is touched, and a second surface of the touch screen parallel to the data collection surface is coupled to a biometric sensor configured to collect fingerprint data. Optical fingerprint sensors that collect fingerprint data using light reflected from a user's finger, using photocapacitive technology, and using ultrasonic technology are currently known. Additional fingerprint data collection technologies are also possible and expected within the scope of the present invention. Therefore, when the user's finger contacts the data collection surface of the touch screen, the biometric sensor collects fingerprint data of the user's finger. In addition, the touch screen collects touch data, and the processor executing software parses the touch data into data of a single virtual key area touched by the user's finger during fingerprint collection. In one embodiment, the user's finger touching the data collection surface triggers fingerprint data collection. In another embodiment, parsing the touch data into data of a single virtual key area triggers fingerprint data collection.

[0026] Another embodiment uses a set of biometric sensors configured to collect fingerprint data, each biometric sensor coupled to a surface parallel to the data collection surface of the touch screen. Another embodiment uses a set of biometric sensors, each sensor coupled to a physical key of a keypad. Thus, when a user's finger contacts the data collection surface of the touch screen or a physical key, the biometric sensor collects fingerprint data of the user's finger. Likewise, data is collected regarding which touch screen or physical key the user's finger touched during fingerprint collection.

[0027] Another embodiment uses a biometric sensor configured to collect biometric data that is not fingerprint data. Some non-limiting examples of non-fingerprint biometric data include a portion of the surface of a user's hand or foot, a portion of a different area of ​​a user's skin, and scan data of the iris or retina. Additionally, the biometric data need not be human.

[0028] One embodiment prompts the user to enter a desired password or PIN during the configuration phase. The user enters the password by typing it on a physical key or a virtual key area of ​​a touch screen, using the desired finger for each key. As the user touches each key (physical or virtual) with a specific finger during the entry of the desired password, the embodiment collects both fingerprint and key data for each touch. Because the fingerprint of each finger of the user is different, the resulting stored password includes data on which finger is used to type which key. Therefore, an exemplary desired PIN entered by the user into a set of virtual key areas marked as a numeric keypad may be a sequence of 1 (typed with the third finger of the left hand), 2 (typed with the second finger of the left hand), 3 (typed with the index finger of the left hand), and 0 (typed with the thumb of the left hand). Another exemplary desired PIN entered by the user into a set of virtual key areas marked as a numeric keypad may be a sequence of 2 (typed with the second finger of the left hand), 3 (typed with the index finger of the left hand), 5 (typed with the second finger of the left hand), and 6 (typed with the index finger of the left hand). Another exemplary desired password that a user enters into a set of virtual keys in an area labeled a QWERTY alphanumeric keyboard may be the sequence a (typed with the fourth finger of the left hand), s (typed with the third finger of the left hand), d (typed with the second finger of the left hand), and f (typed with the index finger of the left hand).

[0029] One embodiment rejects a user's desired password if the password, finger input sequence, or combination of passwords or finger input sequences is included in a list of passwords that are considered too obvious to be used for access control. Another embodiment rejects a user's desired password if the password, finger input sequence, or combination of passwords or finger input sequences has been used by other users more than a predetermined threshold number of times, indicating that the password is too obvious or may be too easy to guess by others for access control. For example, since PINs 1234 or 0000 are typically default PINs, they may be included in the list of PINs to be rejected. As another example, the sequence asdf typed with four fingers of the left hand may be rejected because fifty other users have used the sequence (perhaps because it is easy to type).

[0030] During the configuration phase, another embodiment prompts the user to enter a desired password or PIN. The user enters the password by typing it on a physical key or a virtual key area of ​​the touch screen. This embodiment does not require the use of the desired finger for each key during the configuration phase, but rather determines a finger usage pattern for the password. Specifically, during multiple password entry to access a protected resource, as part of the user's normal use, the embodiment collects fingerprint and key data for each touch. While allowing the user to access the protected resource (if the password entered is correct), the embodiment also stores the fingerprint data of each finger used to type which key. One embodiment determines that the user has used the same finger (i.e., the collected fingerprint data have a similarity to each other above a threshold level) to type a specific key (physical or virtual) more than a threshold number of times as a usage pattern. Another embodiment determines that the user has used the same finger (i.e., the collected fingerprint data have a similarity to each other above a threshold level) to type a specific key in more than a threshold percentage of all password entries as a usage pattern. Once the embodiment determines the usage pattern, the embodiment switches to requiring a specific, consistent finger to be used for the corresponding virtual key. One embodiment switches to requiring a specific finger only upon user confirmation. Another embodiment switches to requiring a specific finger without requiring user confirmation. Thus, one example user may set her PIN to 1230. Then, when the user uses that PIN, the collected data shows that in over ninety percent of the user-entered PINs, the user enters the PIN as 1 (entered with the third finger of the left hand), 2 (entered with the second finger of the left hand), 3 (entered with the index finger of the left hand), and 0 (entered with the thumb of the left hand). As a result, with the user's consent, the embodiment switches to requiring that the user enter the PIN using a specific finger for each number in the sequence.

[0031] An embodiment stores the specific fingerprint as the fingerprint data for the specific finger. Non-limiting examples of the specific fingerprint include a first fingerprint collected, a most recent fingerprint collected when the embodiment determines that there is a usage pattern, and a randomly selected fingerprint selected from the collected fingerprint data for the fingerprint and virtual key combination. Another embodiment stores a composite of the collected fingerprint data for the fingerprint and virtual key combination as the fingerprint data for the specific finger.

[0032] Next, once a particular finger with corresponding fingerprint data has been associated with a particular physical key or virtual key area, either by configuration or via a usage pattern, an embodiment prompts the user to enter his or her password or PIN by typing the password using the configured finger for each key. As the user touches each key with the particular finger during entry of the required password, the embodiment collects both fingerprint and key data for each touch. If the embodiment determines that the collected fingerprint data has a similarity above a threshold level to the user's stored fingerprint data associated with each key, and determines that the key sequence matches the user's stored key sequence, the embodiment allows access to the protected resource. On the other hand, if the embodiment determines that the collected fingerprint data does not have a similarity above a threshold level to the user's stored fingerprint data associated with each key in the stored sequence, the embodiment blocks access to the protected resource.

[0033] In the art related to biometric-based access control systems, the access control system described herein is not available in currently available methods. When implemented as an execution on a device or data processing system, the method of the embodiments described herein includes: a substantial advancement in the functionality of the device or data processing system in terms of collecting biometric data from multiple virtual key areas of a touch screen; and determining whether the biometric data has a similarity above a threshold level with the stored biometric data associated with each virtual key area, and determining whether the virtual key area sequence matches the stored key sequence. If both are true, the method allows access to a protected resource; otherwise, the method blocks access to the protected resource.

[0034] Merely by way of example, the illustrative embodiments are described with respect to specific types of biometric data, touch data, passwords, sequences, virtual key regions, thresholds, sensors, measurements, devices, data processing systems, environments, components, and applications. Any particular representation of these and other similar artifacts is not intended to limit the invention. Any suitable representation of these and other similar artifacts may be selected within the scope of the illustrative embodiments.

[0035] Furthermore, the illustrative embodiments may be implemented for any type of data, data source, or access to a data source over a data network. Any type of data storage device may provide data to embodiments of the present invention locally at a data processing system or over a data network within the scope of the present invention. Where embodiments are described using a mobile device, any type of data storage device suitable for use with the mobile device may provide data to such embodiments locally at the mobile device or over a data network within the scope of the illustrative embodiments.

[0036] Illustrative embodiments are described using specific codes, designs, architectures, protocols, layouts, schematic diagrams, and tools, which are examples only, rather than limitations on the illustrative embodiments. In addition, for clarity of description, specific software, tools, and data processing environments are used in some instances to describe the illustrative embodiments only as examples. The illustrative embodiments can be used in conjunction with other structures, systems, applications, or architectures of comparable or similar purposes. For example, within the scope of the present invention, other comparable mobile devices, structures, systems, applications, or their architectures can be used in conjunction with such embodiments of the present invention. The illustrative embodiments can be implemented with hardware, software, or a combination thereof.

[0037] The examples in this disclosure are only for clear description, rather than limiting the illustrative embodiments. Additional data, operations, actions, tasks, activities, and manipulations can be imagined from this disclosure, and these additional data, operations, actions, tasks, activities, and manipulations can be imagined within the scope of the illustrative embodiments.

[0038] Any advantages listed herein are merely examples and are not intended to limit the illustrative embodiments. Additional or different advantages may be achieved through specific illustrative embodiments. In addition, specific illustrative embodiments may have some, all, or none of the advantages listed above.

[0039] It should be understood that although the present disclosure includes a detailed description about cloud computing, the implementation of the technical solutions recorded therein is not limited to a cloud computing environment, but can be implemented in combination with any other type of computing environment now known or later developed.

[0040] Cloud computing is a service delivery model for convenient, on-demand network access to a shared pool of configurable computing resources. Configurable computing resources are resources that can be quickly deployed and released with minimal management cost or interaction with the service provider, such as networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0041] Features are as follows:

[0042] On-demand self-service: Cloud consumers can unilaterally and automatically deploy computing capabilities such as server time and network storage on demand without human interaction with the service provider.

[0043] Broad network access: Computing power can be accessed over the network through standard mechanisms that facilitate the use of the cloud through different types of thin-client or thick-client platforms (e.g., mobile phones, laptops, personal digital assistants (PDAs)).

[0044] Resource pool: The computing resources of the provider are grouped into resource pools and serve multiple consumers through a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated on demand. Generally, consumers cannot control or even know the exact location of the provided resources, but can specify the location (such as country, state or data center) at a higher level of abstraction, so it is location-independent.

[0045] Rapid elasticity: The ability to quickly and elastically (sometimes automatically) deploy computing power to scale up quickly, and quickly release it to scale down quickly. To consumers, the computing power available for deployment often appears to be unlimited, and any amount of computing power can be accessed at any time.

[0046] Measurable services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0047] The business model is as follows:

[0048] Software as a Service (SaaS): The capability provided to consumers is to use the provider's applications running on a cloud infrastructure. Applications can be accessed from a variety of client devices through a thin client interface such as a web browser (e.g., web-based email). Aside from limited user-specific application configuration settings, consumers neither manage nor control the underlying cloud infrastructure including networks, servers, operating systems, storage, or even individual application capabilities.

[0049] Platform as a Service (PaaS): The capability provided to consumers is to deploy applications created or acquired by consumers on the cloud infrastructure, which are created using programming languages ​​and tools supported by the provider. Consumers neither manage nor control the underlying cloud infrastructure including networks, servers, operating systems or storage, but have control over the applications they deploy and may also have control over the configuration of the application hosting environment.

[0050] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, network, and other basic computing resources on which consumers can deploy and run arbitrary software including operating systems and applications. Consumers neither manage nor control the underlying cloud infrastructure, but have control over the operating system, storage, and applications they deploy, and may have limited control over selected network components (such as host firewalls).

[0051] The deployment model is as follows:

[0052] Private Cloud: Cloud infrastructure is run solely for an organization. The cloud infrastructure can be managed by the organization or a third party and can exist inside or outside the organization.

[0053] Community Cloud: A cloud infrastructure is shared by several organizations and supports a specific community with common interests (e.g., mission, security requirements, policies, and compliance considerations). A community cloud can be managed by multiple organizations within the community or by a third party and can exist inside or outside the community.

[0054] Public cloud: Cloud infrastructure is provided to the public or to large industry groups and is owned by an organization that sells cloud services.

[0055] Hybrid cloud: A cloud infrastructure consisting of two or more clouds (private, community or public) in a deployment model that remain distinct entities but are bound together by standardized or proprietary technologies (such as cloud burst sharing for load balancing between clouds) that enable data and application portability.

[0056] The cloud computing environment is service-oriented, with characteristics centered on statelessness, low coupling, modularity, and semantic interoperability. The core of cloud computing is the infrastructure that includes a network of interconnected nodes.

[0057] With reference to the accompanying drawings, and with particular reference to Figure 1 and 2 , these figures are exemplary diagrams of data processing environments in which illustrative embodiments may be implemented. Figure 1 and 2 This is merely an example and is not intended to assert or imply any limitation with regard to the environments in which different embodiments may be implemented. Specific implementations may make many modifications to the depicted environment based on the following description.

[0058] Figure 1 A block diagram of a network of data processing systems in which the illustrative embodiments may be implemented is depicted. Data processing environment 100 is a network of computers in which the illustrative embodiments may be implemented. Data processing environment 100 includes network 102. Network 102 is a medium for providing communication links between various devices and computers connected together within data processing environment 100. Network 102 may include connections such as wired, wireless communication links, or fiber optic cables.

[0059] Client or server are merely example roles for specific data processing systems connected to network 102 and are not intended to exclude other configurations or roles for these data processing systems. Server 104 and server 106 are coupled to network 102 along with memory 108. Software applications may be executed on any computer in data processing environment 100. Clients 110, 112, and 114 are also coupled to network 102. Data processing systems such as servers 104 or 106 or clients 110, 112, or 114 may contain data and may have software applications or software tools executed thereon.

[0060] This is for example purposes only and does not imply any limitation on such architecture. Figure 1 Specific components that can be used in example implementations of the embodiments are depicted. For example, servers 104 and 106 and clients 110, 112, 114 are depicted as servers and clients, only as examples, and not to imply limitations on client-server architectures. As another example, one embodiment can be distributed across several data processing systems and data networks as shown, while within the scope of the illustrative embodiments, another embodiment can be implemented on a single data processing system. Data processing systems 104, 106, 110, 112, and 114 also represent example nodes in clusters, partitions, and other configurations suitable for implementing the embodiments.

[0061] Device 132 is an example of a device described herein. For example, device 132 may take the form of a smartphone, a tablet computer, a laptop computer, a fixed or portable form of client 110, a wearable computing device, or any other suitable device. Figure 1 Any software application executed in another data processing system in may be configured to execute in device 132 in a similar manner. Figure 1 Any data or information stored or generated in another data processing system in the device 132 may be configured to be stored or generated in a similar manner in the device 132. The device 132 includes a touch screen 134 configured to collect touch data and a biometric sensor 136 configured to collect biometric data. The client 112 also includes a biometric sensor 138 coupled to a physical keyboard portion of the client 112. The clients 110 and 114 and the servers 104 and 106 may also be configured to include biometric sensors (not shown).

[0062] The application 105 implements the embodiments described herein. The application 105 is executed in any of the servers 104 and 106, the clients 110, 112 and 114, and the device 132.

[0063] Servers 104 and 106, storage 108, clients 110, 112, and 114, and device 132 may be coupled to network 102 using wired connections, wireless communication protocols, or other suitable data connections. Clients 110, 112, and 114 may be, for example, personal computers or network computers.

[0064] In the depicted example, server 104 may provide data, such as boot files, operating system images, and applications to clients 110, 112, and 114. In this example, clients 110, 112, and 114 may be clients to server 104. Clients 110, 112, 114, or some combination thereof, may include their own data, boot files, operating system images, and applications. Data processing environment 100 may include additional servers, clients, and other devices not shown.

[0065] In the described example, data processing environment 100 can be the Internet. Network 102 can represent a collection of networks and gateways that use transmission control protocol / Internet protocol (TCP / IP) and other protocols to communicate with each other. At the core of the Internet is the backbone of data communication links between master nodes or host computers, including thousands of commercial, government, educational and other computer systems that route data and messages. Of course, data processing environment 100 can also be implemented as many different types of networks, such as intranets, local area networks (LANs) or wide area networks (WANs). Figure 1 This is intended as an example and not as an architectural limitation to the different illustrative embodiments.

[0066] Among other uses, data processing environment 100 can be used to implement a client-server environment in which exemplary embodiments can be implemented. The client-server environment enables software applications and data to be distributed on a network so that applications work by using the interactivity between a client data processing system and a server data processing system. Data processing environment 100 can also adopt a service-oriented architecture in which interoperable software components distributed on a network can be packaged together as consistent business applications. Data processing environment 100 can also take the form of a cloud, and adopt a cloud computing model of service delivery to realize convenient on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services), which can be quickly supplied and released with minimal management costs or minimal interaction with service providers.

[0067] refer to Figure 2 , which depicts a block diagram of a data processing system in which the illustrative embodiments may be implemented. Data processing system 200 is an example of a computer, such as Figure 1Servers 104 and 106, or clients 110, 112, and 114, or another type of device, in which computer usable program code or instructions implementing the processes may be provided for exemplary embodiments.

[0068] Data processing system 200 also represents a data processing system or configuration thereof, such as Figure 1 The data processing system 132 in the embodiment of the present invention may contain computer usable program code or instructions that implement the processes of the illustrative embodiments. The data processing system 200 is described as a computer only as an example and is not limited thereto. Without departing from the general description of the operation and function of the data processing system 200 described herein, the computer may be used in a manner such as Figure 1 Implementation of device 132 in the form of other devices may modify data processing system 200 , such as by adding a touch interface, and even removing certain depicted components from data processing system 200 .

[0069] In the depicted example, data processing system 200 employs a hub architecture including north bridge and memory controller hub (NB / MCH) 202 and south bridge and input / output (I / O) controller hub (SB / ICH) 204. Processing unit 206, main memory 208, and graphics processor 210 are coupled to north bridge and memory controller hub (NB / MCH) 202. Processing unit 206 may include one or more processors and may be implemented using one or more heterogeneous processor systems. Processing unit 206 may be a multi-core processor. In a particular implementation, graphics processor 210 may be coupled to NB / MCH 202 via an accelerated graphics port (AGP).

[0070] In the depicted example, a local area network (LAN) adapter 212 is coupled to the south bridge and I / O controller hub (SB / ICH) 204. An audio adapter 216, a keyboard and mouse adapter 220, a modem 222, a read-only memory (ROM) 224, a universal serial bus (USB) and other ports 232, and a PCI / PCIe device 234 are coupled to the south bridge and I / O controller hub 204 via bus 238. A hard disk drive (HDD) or solid-state drive (SSD) 226 and a CD-ROM 230 are coupled to the south bridge and I / O controller hub 204 via bus 240. PCI / PCIe devices 234 may include, for example, Ethernet adapters, add-in cards, and PC cards for notebook computers. PCI uses a card bus controller, while PCIe does not. ROM 224 may be, for example, a flash binary input / output system (BIOS). Hard disk drive 226 and CD-ROM 230 may use, for example, an integrated drive electronics (IDE), a serial advanced technology attachment (SATA) interface, or variations such as external SATA (eSATA) and micro SATA (mSATA). Super I / O (SIO) device 236 may be coupled to south bridge and I / O controller hub (SB / ICH) 204 via bus 238.

[0071] Memories such as main memory 208, ROM 224, or flash memory (not shown) are some examples of computer usable storage devices. Hard disk drives or solid state drives 226, CD-ROM 230, and other similarly available devices are some examples of computer usable storage devices that include computer usable storage media.

[0072] An operating system runs on processing unit 206. The operating system coordinates and provides Figure 2 The operating system may be a commercially available operating system for any type of computing platform, including but not limited to server systems, personal computers, and mobile devices. Object-oriented or other types of programming systems may operate with the operating system and provide calls to the operating system from programs or applications executing on data processing system 200.

[0073] for operating systems, object-oriented programming systems, and such Figure 1The instructions for an application or program in application 105 are located on a storage device, such as in the form of code 226A on hard drive 226, and may be loaded into at least one of one or more memories, such as main memory 208, for execution by processing unit 206. The processes of the illustrative embodiments may be performed by processing unit 206 using computer-implemented instructions, which may be located in a memory, such as main memory 208, read-only memory 224, or in one or more peripheral devices.

[0074] In addition, in one case, code 226A can be downloaded from remote system 201B via network 201A, where similar code 201C is stored on storage device 201D. In another case, code 226A can be downloaded to remote system 201B via network 201A, where the downloaded code 201C is stored on storage device 201D.

[0075] Figure 1-2 The hardware in can vary depending on the implementation. Figure 1-2 In addition to the hardware described in Figure 1-2 Instead of the hardware described in the foregoing, other internal hardware or peripheral devices such as flash memory, equivalent non-volatile memory, or optical disk drives may be used. In addition, the processes of the illustrative embodiments may be applied to a multi-processor data processing system.

[0076] In some illustrative examples, data processing system 200 may be a personal digital assistant (PDA), which is typically configured with flash memory to provide non-volatile memory for storing operating system files and / or user-generated data. The bus system may include one or more buses, such as a system bus, an I / O bus, and a PCI bus. Of course, the bus system may be implemented using any type of communication structure or architecture that provides data transfer between different components or devices attached to the structure or architecture.

[0077] The communication unit may include one or more devices for sending and receiving data, such as a modem or a network adapter. A memory may be, for example, main memory 208 or a cache, such as that found in north bridge and memory controller hub 202. A processing unit may include one or more processors or CPUs.

[0078] Figure 1-2 The examples described in and above are not meant to imply architectural limitations.For example, data processing system 200 may be a tablet computer, laptop computer, or telephone device in addition to taking the form of a mobile or wearable device.

[0079] Where a computer or data processing system is depicted as a virtual machine, virtual appliance, or virtual component, the virtual machine, virtual appliance, or virtual component uses virtualized representations of some or all of the components depicted in data processing system 200 to operate in the manner of data processing system 200. For example, in the virtual machine, virtual appliance, or virtual component, processing unit 206 is represented as a virtualized instance of all or some number of hardware processing units 206 available in the host data processing system, main memory 208 is represented as a virtualized instance of all or some portion of main memory 208 available in the host data processing system, and disk 226 is represented as a virtualized instance of all or some portion of disk 226 available in the host data processing system. In this case, the host data processing system is represented by data processing system 200.

[0080] refer to Figure 3 , which depicts a block diagram of an example configuration for key-specific fingerprint-based access control in accordance with an illustrative embodiment. Application 300 is Figure 1 An example of application 105, and in Figure 1 Executed in any one of the servers 104 and 106, clients 110, 112 and 114, and device 132.

[0081] The data collection module 310 collects biometric data and key data. One embodiment of the module 310 uses a biometric sensor coupled to a touch screen. The display component of the touch screen displays one or more virtual key areas, each of which is marked with letters, numbers, or symbols that are input to the device when the data collection surface of the touch screen is touched, and a second surface of the touch screen parallel to the data collection surface is coupled to a biometric sensor configured to collect fingerprint data. Therefore, when the user's finger contacts the data collection surface of the touch screen, the biometric sensor collects fingerprint data of the user's finger. In addition, the touch screen collects touch data, and the processor executing the software parses the touch data into data of a single virtual key area touched by the user's finger during fingerprint collection. In one embodiment of the module 310, the user's finger touching the data collection surface triggers the fingerprint data collection. In another embodiment of the module 310, parsing the touch data into data of a single virtual key area triggers the fingerprint data collection.

[0082] Another embodiment of module 310 uses a set of biometric sensors configured to collect fingerprint data, each sensor coupled to a surface parallel to the data collection surface of the touch screen. Another embodiment of module 310 uses a set of biometric sensors, each sensor coupled to a physical key of a keypad. Thus, when a user's finger contacts the data collection surface of the touch screen or a physical key, the biometric sensor collects fingerprint data of the user's finger. In addition, data is collected regarding which touch screen or physical key the user's finger touched during fingerprint collection.

[0083] Another embodiment of module 310 uses a biometric sensor configured to collect biometric data that is not fingerprint data. Some non-limiting examples of non-fingerprint biometric data include a portion of the surface of a user's hand or foot, a portion of a different area of ​​a user's skin, and scan data of the iris or retina. In addition, the biometric data does not have to be human.

[0084] Configuration module 320 prompts the user to enter a desired password or PIN. The user enters the password by typing it on a physical key or a virtual key area of ​​a touch screen, using the desired finger for each key. As the user touches each key (physical or virtual) with a particular finger during the entry of the desired password, module 310 collects both fingerprint and key data for each touch. Because the fingerprint of each finger of the user is different, the resulting stored password includes data on which finger was used to type which key. If the password, finger input sequence, or combination of password or finger input sequence is included in a list of passwords that are considered too obvious to be used for access control, one embodiment of module 320 rejects the user's desired password. If the password, finger input sequence, or combination of password or finger input sequence has been used by other users for more than a predetermined threshold number of times, thereby indicating that the password is too obvious or may be too easy to be guessed by others for access control, another embodiment of module 320 rejects the user's desired password.

[0085] Another embodiment of module 320 prompts the user to enter a desired password or PIN. The user enters the password by typing it on a physical key or a virtual key area of ​​a touch screen. This embodiment of module 320 does not require the use of the desired finger for each key during the configuration phase, but determines the finger usage pattern for the password. In particular, during multiple password inputs to access protected resources, as part of the user's normal use, module 310 collects both fingerprint and key data for each touch. While allowing the user to access the protected resource (if the password entered is correct), module 320 also stores the fingerprint data of each finger used to type which key. One embodiment of module 320 determines that the user has used the same finger (i.e., the collected fingerprint data have a similarity above a threshold level to each other) to type a specific key (physical or virtual) more than a threshold number of times as a usage pattern. Another embodiment of module 320 determines that the user has used the same finger (i.e., the collected fingerprint data have a similarity above a threshold level to each other) to type a specific key in more than a threshold percentage of all password inputs as a usage pattern. Once module 320 determines the usage pattern, application 300 switches to requiring specific, consistent fingers to be used for corresponding virtual keys.

[0086] Module 320 stores the specific fingerprint as fingerprint data for the specific finger, such as the first fingerprint collected, the most recent fingerprint collected when the usage pattern is determined, and a randomly selected fingerprint selected from the collected fingerprint data for the fingerprint and virtual key combination. Another embodiment of module 320 stores a composite of the collected fingerprint data for the fingerprint and virtual key combination as fingerprint data for the specific finger.

[0087] Next, once a particular finger with corresponding fingerprint data has been associated with a particular physical key or virtual key area by configuration or via a usage pattern, the authentication module 330 prompts the user to enter his or her password or PIN by typing the password using the configured finger for each key. As the user touches each key with the particular finger during entry of the required password, the module 310 collects both fingerprint and key data for each touch. If the module 330 determines that the collected fingerprint data has a similarity above a threshold level with the user's stored fingerprint data associated with each key, and determines that the key sequence matches the user's stored key sequence, the module 330 allows access to the protected resource. On the other hand, if the module 330 determines that the collected fingerprint data does not have a similarity above a threshold level with the user's stored fingerprint data associated with each key in the stored sequence, the module 330 blocks access to the protected resource.

[0088] refer to Figure 4 , which depicts a block diagram of an example configuration for key-specific fingerprint-based access control in accordance with an illustrative embodiment. In particular, Figure 4 Describes Figure 3 More details of module 310 in .

[0089] When one embodiment of module 310 uses a biometric sensor coupled to a touch screen, the display component of the touch screen displays one or more virtual key areas, each of which is marked with letters, numbers, or symbols that are input to the device when the data collection surface of the touch screen is touched. A second surface of the touch screen parallel to the data collection surface is coupled to a biometric sensor configured to collect fingerprint data. Therefore, when a user's finger contacts the data collection surface of the touch screen, the fingerprint collection module 410 collects fingerprint data of the user's finger. In addition, the virtual key area module 420 collects touch data and parses the touch data into data for a single virtual key area touched by the user's finger during fingerprint collection. In one embodiment of module 420, the user's finger touching the data collection surface triggers fingerprint data collection. In another embodiment of module 420, parsing the touch data into data for a single virtual key area triggers fingerprint data collection.

[0090] refer to Figure 5 , which depicts a block diagram of an example configuration for key-specific fingerprint-based access control in accordance with an illustrative embodiment. In particular, Figure 5 Describes Figure 3 More details of module 320 in .

[0091] The setup module 520 prompts the user to enter a desired password or PIN. The user enters a password by typing it on a physical key or a virtual key area of ​​a touch screen, using the desired finger for each key. Because the fingerprint of each finger of the user is different, the resulting stored password includes data on which finger was used to type which key. If the password, finger input sequence, or combination of password or finger input sequence is included in a list of passwords that are considered too obvious to be used for access control, one embodiment of the module 520 rejects the user's desired password. If the password, finger input sequence, or combination of password or finger input sequence has been used by other users for more than a predetermined threshold number of times, indicating that the password is too obvious or may be too easy to be guessed by others for access control, another embodiment of the module 520 rejects the user's desired password.

[0092] The learning module 510 determines the finger usage pattern of the password. In particular, during multiple password inputs to access protected resources, as part of normal user use, the module 510 collects both fingerprint and key data for each touch. While allowing the user to access the protected resource (if the password entered is correct), the module 510 also stores the fingerprint data of each finger used to type which key. One embodiment of the module 510 determines that the user has used the same finger (i.e., the collected fingerprint data have a similarity to each other above a threshold level) to type a specific key (physical or virtual) more than a threshold number of times as a usage pattern. Another embodiment of the module 510 determines that the user has used the same finger (i.e., the collected fingerprint data have a similarity to each other above a threshold level) to type a specific key in more than a threshold percentage of all password inputs as a usage pattern. Once the module 510 determines the usage pattern, the application 300 switches to requiring a specific, consistent finger to be used for the corresponding virtual key.

[0093] refer to Figure 6 , which depicts an example of key-specific fingerprint-based access control according to an illustrative embodiment. This example can be used Figure 3 The device 132 and the touch screen 134 are connected to the application 300 in the embodiment of the present invention. Figure 1 The device 132 and the touch screen 134 are the same.

[0094] Device 132 uses a biometric sensor (not shown) coupled to touch screen 134. The display component of touch screen 134 displays one or more virtual key areas, each of which is labeled with a letter, number, or symbol that is input to device 132 when the data collection surface of the touch screen is touched. A second surface of touch screen 134, parallel to the data collection surface, is coupled to a biometric sensor configured to collect fingerprint data. Thus, when a user's finger contacts the data collection surface of touch screen 134, the biometric sensor collects fingerprint data of the user's finger. In addition, touch screen 134 collects the touch data, and a processor executing software parses the touch data into data for a single virtual key area touched by the user's finger during fingerprint collection. Thus, as depicted, the user enters his or her PIN by touching virtual key area 611 with finger 602, thereby typing "1", touching virtual key area 612 with finger 604, thereby typing "2", touching virtual key area 613 with finger 606, thereby typing "3", and touching virtual key area 610 with finger 608, thereby typing "0". If the application 300 determines that the collected fingerprint data has a similarity above a threshold level with the user's stored fingerprint data associated with each key, and determines that the key sequence "1230" matches the user's stored key sequence, the application 300 allows access to the protected resource. On the other hand, if the application 300 determines that the collected fingerprint data does not have a similarity above a threshold level with the user's stored fingerprint data associated with each key in the stored sequence, the embodiment blocks access to the protected resource.

[0095] refer to Figure 7 , which depicts a flow chart of an example process for access control based on key-specific fingerprints according to an illustrative embodiment. Process 700 may be performed at Figure 3 The application 300 is implemented in the embodiment.

[0096] In box 702, the application uses a biometric sensor coupled to a touch screen to collect fingerprint data from multiple key areas of the touch screen. In box 704, the application determines whether the collected biometric data has a similarity higher than a threshold level with the stored biometric data associated with the same key area. If so (the "yes" path of block 704), then in block 706, the application determines whether the sequence of the key area matches the stored key sequence. If so (the "yes" path of block 706), then in block 708, the application allows access to protected resources. Otherwise (the "no" path of blocks 704 and 706), in block 710, the application blocks access to protected resources. Then the application ends.

[0097] Reference now Figure 8, which shows an exemplary cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which a local computing device used by a cloud computing consumer can communicate, and the local computing device can be, for example, a personal digital assistant (PDA) or a mobile phone 54A, a desktop computer 54B, a laptop computer 54C and / or an automobile computer system 54N. The cloud computing nodes 10 can communicate with each other. The cloud computing nodes 10 can be physically or virtually grouped in one or more networks including but not limited to the private cloud, community cloud, public cloud or hybrid cloud or a combination thereof as described above (not shown in the figure). In this way, cloud consumers can request infrastructure as a service (IaaS), platform as a service (PaaS) and / or software as a service (SaaS) provided by the cloud computing environment 50 without maintaining resources on local computing devices. It should be understood that the various types of computing devices 54A-N shown are merely schematic, and the cloud computing nodes 10 and the cloud computing environment 50 can communicate with any type of computing device (for example, using a web browser) on any type of network and / or any type of network addressable connection.

[0098] Reference now Fig. 9 , which shows a cloud computing environment 50 ( Figure 8 ) provides a set of functional abstraction layers. First of all, it should be understood that the components, layers and functions shown are only exemplary and the embodiments of the present invention are not limited thereto. Fig. 9 As shown, the following layers and corresponding functions are provided:

[0099] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: host 61; server 62 based on RISC (Reduced Instruction Set Computer) architecture; server 63; blade server 64; storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0100] The virtualization layer 70 provides an abstraction layer that can provide examples of the following virtual entities: virtual servers 71; virtual storage 72; virtual networks 73, including virtual private networks; virtual applications and operating systems 74; and virtual clients 75.

[0101] In one example, the management layer 80 may provide the following functions: Resource provisioning function 81: Provide dynamic acquisition of computing resources and other resources for performing tasks in a cloud computing environment; Metering and pricing function 82: Track the cost of resource usage within the cloud computing environment and provide bills and invoices for this purpose. In one example, these resources may include application software licenses. Security function: Provide identity authentication for cloud consumers and tasks, and provide protection for data and other resources. User portal function 83: Provide access to the cloud computing environment for consumers and system administrators. Service level management function 84: Provide allocation and management of cloud computing resources to meet the required service levels. Service level agreement (SLA) planning and fulfillment function 85: Provide pre-arrangement and provision for future demand for cloud computing resources predicted according to the SLA.

[0102] The workload layer 90 provides examples of functions that can utilize the cloud computing environment. Examples of workloads and functions that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom teaching provision 93; data analysis processing 94; transaction processing 95; and application selection based on cumulative vulnerability risk assessment 96.

[0103] Thus, in the illustrative embodiments, a computer-implemented method, system or apparatus, and computer program product are provided for access control and other related features, functions, or operations based on key-specific fingerprints. Where embodiments or portions thereof are described with respect to a type of device, the computer-implemented method, system or apparatus, computer program product, or portions thereof, is adapted or configured for use with a suitable and comparable representation of that type of device.

[0104] Where embodiments are described as being implemented in an application, delivery of the application in a Software as a Service (SaaS) model is contemplated within the scope of the illustrative embodiments. In the SaaS model, the ability to implement the application of the embodiments is provided to users by executing the application in a cloud infrastructure. Users can access the application using a variety of client devices through a thin client interface such as a web browser (e.g., web-based email) or other lightweight client applications. Users do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, or storage of the cloud infrastructure. In some cases, users may not even manage or control the capabilities of the SaaS application. In some other cases, a SaaS implementation of the application may allow for limited possible exceptions to user-specific application configuration settings.

[0105] The present invention may be a system, method and / or computer program product of any possible integrated technical detail level. The computer program product may include a computer-readable storage medium (or media) storing computer-readable program instructions, which are used to cause a processor to perform aspects of the present invention.

[0106] A computer-readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following items: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device (such as a punch card or a raised structure in a groove with instructions recorded thereon), and any suitable combination of the foregoing items. As used herein, a computer-readable storage medium should not be interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., an optical pulse by an optical cable), or an electrical signal transmitted by a wire.

[0107] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0108] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of integrated circuits, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and procedural programming languages, such as "C" programming language or similar programming languages. The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer, partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network (including a local area network (LAN) or a wide area network (WAN)), or can be connected to an external computer (for example, by using the Internet of an Internet service provider). In some embodiments, an electronic circuit (including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA)) can execute a computer-readable program instruction to personalize the electronic circuit by utilizing the state information of the computer-readable program instructions, so as to perform aspects of the present invention.

[0109] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each box of the flowchart and / or block diagram and the combination of boxes in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0110] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions are executed via the processor of the computer or other programmable data processing device, creating a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that can guide a computer, a programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium storing the instructions includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0111] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0112] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to different embodiments of the present invention.In this regard, each box in the flow chart or block diagram can represent a part of a module, segment or instruction, which includes one or more executable instructions for realizing the logical function of the specification.In some alternative embodiments, the function marked in the box may not occur in the order marked in the figure.For example, the two boxes shown in succession can actually be performed substantially at the same time, or these boxes can sometimes be performed in reverse order, depending on the function involved.It will also be noted that each box in the block diagram and / or flow chart and the combination of the boxes in the block diagram and / or flow chart can be realized by a system based on special-purpose hardware, and the system based on special-purpose hardware performs a specified function or action or performs a combination of special-purpose hardware and computer instructions.

Claims

1. A computer-implemented method comprising: In a configuration phase, using a biometric sensor coupled to the touch screen, collecting first fingerprint data of a first user from a plurality of virtual key areas of the touch screen during multiple password entry periods, the multiple password entry periods allowing access to a protected resource, the virtual key areas of the plurality of virtual key areas including an area of ​​the touch screen configured to display an input prompt and collect touch data in response to the input prompt; In the configuration stage, determining a finger input sequence used in multiple password inputs by analyzing the first fingerprint data, the finger input sequence comprising a sequence in which a specific finger is used in a specific virtual key area for more than a threshold number of times when entering a password to access a protected resource; in the configuration phase, in response to determining that the finger input sequence has been configured for accessing the protected resource by a plurality of users other than the first user less than a threshold number of times, enabling a requirement to use the finger input sequence during password entry, the enabling of the requirement to use the finger input sequence during password entry causing an exit from the configuration phase, the enabling of the requirement to use the finger input sequence during password entry designating the finger input sequence as a required finger input sequence; After the configuration phase, collecting second fingerprint data from a plurality of virtual key regions of the touch screen using a biometric sensor coupled to the touch screen; as well as In response to determining that the finger input sequence used in the second fingerprint data has a similarity above a threshold level with the finger input sequence used in the stored first fingerprint data associated with each of the virtual key areas and the sequence of the virtual key areas matches the stored key sequence, access to the protected resource is allowed.

2. The computer-implemented method of claim 1 , further comprising: In response to determining that the fingerprint data does not have a similarity above a threshold level to the stored fingerprint data associated with each of the virtual key regions, access to the protected resource is blocked.

3. The computer-implemented method of claim 1 , further comprising: using the biometric sensor, collecting a training fingerprint data set from a set of virtual key areas of the touch screen, each member of the training fingerprint data set being associated with a virtual key area of ​​the set of virtual key areas; as well as In response to determining that members of a subset of the training fingerprint data set associated with a particular virtual key region have a similarity to each other above a threshold level, storing the subset as the stored fingerprint data, wherein the stored fingerprint data is associated with the particular virtual key region.

4. The computer-implemented method of claim 3, wherein: The subset includes members of the training fingerprint dataset.

5. The computer-implemented method of claim 3, wherein: The subset includes a composite of multiple members of the training fingerprint dataset.

6. The computer-implemented method of claim 1 , wherein: The collecting is triggered by detecting the touch data within the virtual key area.

7. The computer-implemented method of claim 1 , wherein: The biometric sensor is coupled to a first surface of the touch screen, and the virtual key area includes a portion of a second surface of the touch screen configured to display the input prompt and collect the touch data.

8. A computer program product for access control based on key-specific fingerprints, the computer program product comprising: Program instructions stored on one or more computer-readable storage media, the program instructions comprising: program instructions for collecting, during a configuration phase, first fingerprint data of a first user from a plurality of virtual key areas of the touch screen during multiple password entry periods, the multiple password entry periods allowing access to protected resources, using a biometric sensor coupled to the touch screen, the virtual key areas of the plurality of virtual key areas including an area of ​​the touch screen configured to display an input prompt and collect touch data in response to the input prompt; Program instructions for determining, during a configuration phase, a finger input sequence used in a multiple password entry by analyzing the first fingerprint data, the finger input sequence comprising a sequence of using a specific finger in a specific virtual key area more than a threshold number of times when entering a password to access a protected resource; program instructions for enabling a requirement to use the finger input sequence during password entry in response to determining that the finger input sequence has been configured for access to the protected resource by a plurality of users other than the first user less than a threshold number of times during the configuration phase, the program instructions enabling the requirement to use the finger input sequence during password entry causing an exit from the configuration phase, the program instructions enabling the requirement to use the finger input sequence during password entry designating the finger input sequence as a required finger input sequence; Program instructions for collecting second fingerprint data from a plurality of virtual key regions of the touch screen using a biometric sensor coupled to the touch screen after the configuration phase; and Program instructions for allowing access to a protected resource in response to determining that a finger input sequence used in the second fingerprint data has a similarity above a threshold level to a finger input sequence used in the stored first fingerprint data associated with each of the virtual key areas and that the sequence of the virtual key areas matches the stored key sequences.

9. The computer program product of claim 8, further comprising: Program instructions for blocking access to the protected resource in response to determining that the fingerprint data does not have a similarity above a threshold level to stored fingerprint data associated with each of the virtual key regions.

10. The computer program product of claim 8, further comprising: program instructions for collecting a training fingerprint data set from a set of virtual key areas of the touch screen using the biometric sensor, each member of the training fingerprint data set being associated with a virtual key area of ​​the set of virtual key areas; as well as Program instructions for, in response to determining that members of a subset of the training fingerprint data set associated with a particular virtual key region have a similarity to one another above a threshold level, storing the subset as the stored fingerprint data, wherein the stored fingerprint data is associated with the particular virtual key region.

11. The computer program product according to claim 10, wherein: The subset includes members of the training fingerprint dataset.

12. The computer program product of claim 10, wherein: The subset includes a composite of multiple members of the training fingerprint dataset.

13. The computer program product of claim 8, wherein: The stored program instructions are stored in at least one of one or more storage media of the local data processing system and wherein the stored program instructions are transmitted from the remote data processing system over the network.

14. The computer program product of claim 8, wherein: The stored program instructions are stored in at least one of the one or more storage media of the server data processing system, and wherein the stored program instructions are downloaded over a network to a remote data processing system for use in a computer-readable storage device associated with the remote data processing system.

15. The computer program product of claim 8, wherein: The computer program product is provided as a service in a cloud environment.

16. A computer system comprising one or more processors, one or more computer-readable memories, one or more computer-readable storage devices, and program instructions stored on at least one storage device of the one or more storage devices for execution by at least one processor of the one or more processors via at least one memory of the one or more memories, the stored program instructions including program instructions for respectively executing the steps of the method according to any one of claims 1 to 7.

Images