SYSTEMS AND METHODS FOR BIOMETRIC AUTHENTICATION

Abstract

An authentication screen, which prevents access to at least one application via the computer device, can be displayed on a computer device's screen. The computer device can scan a physical medium located externally and independently of the computer device to capture challenge data for a user from the physical medium, and the computer device can capture response data from the user. Upon a successful match between the challenge data and the response data, the authentication screen can be removed from the screen, and access to the at least one application can be granted. Once the user is granted access to the computer device, the computer device can identify the user and manage the challenge data, response data, SSO sessions, and / or personalized device configurations.

Description

RELATED REGISTRATIONS

[0001] The present application claims priority over the preliminary US application No. 63 / 461800 filed on April 25, 2023, and the US patent application No. 18 / 643000 filed on April 23, 2024, which are incorporated herein by reference in their entirety. BACKGROUND

[0002] In enterprise systems, mobile device deployment can pose a challenge for information technology (IT) administrators, especially when the devices are shared by multiple users, for example, for a day, a week, a month, etc. For instance, some shared mobile devices are programmed to lock users out (e.g., via a locked screen) after a certain period of inactivity. In one example, after a user is locked out, the shared mobile device might display a locked screen requiring the user to enter a passcode to unlock the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] The accompanying figures, in which the same reference numerals refer to identical or functionally similar elements in the individual views, are included in the specification together with the following detailed description and form a part thereof, serving to further illustrate embodiments of concepts that include the claimed invention and to explain various principles and advantages of these embodiments. Fig. Figure 1 illustrates an exemplary system for facilitating user registration according to embodiments of the present disclosure. Fig. Figure 2 illustrates an exemplary system for facilitating user authentication according to embodiments of the present disclosure. Fig. Figure 3 is a flowchart illustrating an exemplary registration process according to embodiments of the present disclosure. Fig. Figure 4 is a flowchart illustrating another exemplary registration process according to embodiments of the present disclosure. Fig. Figure 5 is a flowchart illustrating an exemplary authentication process according to embodiments of the present disclosure. Fig. Figure 6 is a flowchart illustrating another exemplary authentication process according to embodiments of the present disclosure. Fig. Figure 7 is a flowchart illustrating another exemplary authentication process according to embodiments of the present disclosure. Fig. Figure 8 is a flowchart illustrating another exemplary authentication process according to embodiments of the present disclosure. Fig. Figure 9 is a flowchart illustrating an exemplary process for managing user credentials and data on a computer device according to embodiments of the present disclosure.

[0004] Experts will recognize that elements in the figures are illustrated for the sake of simplicity and clarity and are not necessarily drawn to scale. For example, the dimensions of some of the elements in the figures may be exaggerated relative to other elements to help improve the understanding of embodiments of the present disclosure.

[0005] The components of embodiments of the present disclosure have been represented, where appropriate, by conventional symbols in the drawings, which show only those specific details relevant to understanding the embodiments of the present disclosure, so as not to obscure the disclosure with details that are obvious to persons skilled in the art who refer to the description herein. DETAILED DESCRIPTION

[0006] Locked screens on devices typically serve as a security measure to prevent unauthorized access to applications and / or data on the devices themselves, or to applications and / or data on other devices, such as servers with which the devices are configured to communicate. For example, if a device is lost or stolen, a locked screen can prevent others from accessing sensitive information on the device. Such locked screen features can help maintain the privacy and integrity of data on the device or on another device (such as a server with which the device can communicate). Locked screens on mobile devices typically require a user to provide response data, such as a passcode (e.g., a personal identification number (PIN), a password, a sequence of gestures, etc.).) and / or an image of the user's face. The entered response data can be compared to challenge data stored on the device. For example, to unlock the device, the entered passcode can be compared to the passcode stored on the device, and / or the image of the user's face can be compared to the image of the user's face stored on the device. The challenge data (e.g., the stored passcode and / or the user's image) is typically created using the device (e.g., during device deployment or configuration), where a user would enter the passcode and use the device to image the user's face, which is then stored on the device as the challenge data.For mobile devices using the Android operating system, the devices can, for example, enter a locked operating mode after being idle for a certain period of time and / or in response to user input. If a user wishes to operate the device after it has been locked, the locked screen can be presented to the user, who then requests the response data (e.g., the entered passcode or a live image of the user's face).

[0007] When a device is to be shared by multiple users, such as in an enterprise system, users typically use the same passcode to access the shared device. Deploying a shared device with a single passcode shared by users in enterprise systems often arises due to the difficulties of managing multiple passcodes for each user across multiple devices in the enterprise system, where there may be hundreds or thousands of shared devices and hundreds or thousands of users. Additionally, there is typically no mechanism on these shared devices that would allow them to use facial features of different users of the shared devices to gain access (e.g., facial recognition).Since these devices are typically programmed for a one-to-one relationship between a specific user and the device (preventing the device from storing facial features of different users), using facial imaging on a shared device can cause similar problems and issues to managing different users as using multiple passcodes for the shared device. Additional concerns can also arise from storing facial features of multiple users on a single device. For example, storing facial features on a shared device can raise privacy and / or security concerns and may require specific handling of such facial feature data.

[0008] Furthermore, the locked screens of shared mobile devices typically do not provide a way for the user to enter a user ID / username to inform the device which user is attempting to unlock it using the passcode or facial image. As a result, all end users of shared devices in the facility share the same passcode without requiring the user's identity to bypass the locked screen, which can create security vulnerabilities. For example, if one passcode is compromised, all devices in a facility using that passcode can be compromised.Since all users share the same passcode to unlock a shared device, without the need for a user ID / username to differentiate between users, there is no accountability or ability for the user to track which user did what with a device.

[0009] To overcome the problems and challenges associated with shared devices, such as in enterprise systems, embodiments of this disclosure can provide login and authentication processes that enable a temporary one-to-one mapping of each user to a shared device during user authentication based on challenge data obtained from a physical medium located outside of, separate from, and distinct from the shared device. As an example, embodiments of the login process can allow a user to create challenge data specific to that user. The challenge data can be created independently of the shared devices the user intends to use (e.g., there is no requirement for authentication provision, such as...).B. the provision of passcodes for shared devices).

[0010] The authentication process can create, deploy, and / or configure a physical medium, separate from the shared devices, containing the challenge data, a user identifier, and / or additional data or credentials. This physical medium can be used by the user when attempting to access a shared device. For example, some implementations of the authentication process allow a shared device to scan the physical medium to retrieve the challenge data for the user (e.g., the shared device does not require prior knowledge of the challenge data for the user before retrieving it from the physical medium).Once the challenge data is received from the physical medium, the shared device can compare it with response data captured from the user, for example, via a user interface or the device's biometric capture device. Using this approach, each user can have their own passcode, which they do not need to share with any other user, and / or use their biometric characteristics for authentication. Because each user has their own passcode and / or uses their own biometric characteristics, and also presents a physical medium containing the passcode and / or biometric data, the likelihood of the shared device's security being compromised is reduced.Even if the physical medium is shared by users, embodiments of the present disclosure may enable tracking of which user passcode has been compromised and / or denying access to certain applications for that user.

[0011] Once the user is authenticated, they can access the shared device, and the authenticated user's identity can be determined and used to track or log their use of the shared device. Additionally, after user authentication, the shared device can implement one or more processes to facilitate single sign-on (SSO) authentication for SSO-enabled applications and / or manage challenge data, response data, user identifier, and / or additional data or credentials.

[0012] As used herein, “challenge data” refers to data or credentials used by a device to authenticate a user against received “response data”, which, as used herein, refers to data or credentials provided by the user in response to an authentication challenge.

[0013] As used herein, "Single Sign-On" or "SSO" is an identification method, such as one using identity federation, that allows users to log in to multiple applications and websites with a single set of SSO credentials. Once an identity provider has verified the user's identity based on the user's SSO credentials, the identity provider can create and manage tokens / certificates that can be provided to requesting applications and / or services using the SSO identification method. The tokens / certificates can be used to establish an SSO session, which, for example, exists as long as the tokens / certificates are valid. In some cases, tokens / certificates can be refreshed to maintain an active SSO session.

[0014] According to embodiments of the present disclosure, a method is disclosed. The method includes displaying an authentication screen on a computer device display. The authentication screen prevents access to at least one application via the computer device. The method also includes scanning, by the computer device, a physical medium located outside and independently of the computer device to capture challenge data for a user from the physical medium; capturing, by the computer device, response data from the user; determining whether the response data matches the challenge data; and, in response to a successful match, removing the authentication screen from the display and granting access to the at least one application.According to embodiments of the present disclosure, a non-transitory, computer-readable medium comprising instructions is disclosed. The execution of the instructions by a processor causes the processor to carry out the method.

[0015] According to embodiments of the present disclosure, the method includes deleting the challenge data and the response data from the computer device after determining whether the response data matches the challenge data.

[0016] According to embodiments of the present disclosure, the method includes replaying the authentication screen after a lock screen event occurs; rescanning, by the computer device, the physical medium to recapture challenge data for the user from the physical medium; recapturing, by the computer device, response data from the user; determining whether the recaptured response data matches the recaptured challenge data; and, in response to another successful match, removing the authentication screen from the display and granting access to the at least one application.

[0017] According to embodiments of the present disclosure, the method includes deleting the response data from the computer device after determining whether the response data matches the challenge data; encrypting the challenge data; storing the encrypted challenge data in the computer device for a period of time; and deleting the challenge data when the period expires or is reset.

[0018] According to embodiments of the present disclosure, the method involves replaying the authentication screen after a lock screen event occurs; determining whether the encrypted challenge data is stored in the computer device; bypassing a physical medium scanning operation in response to determining that the encrypted challenge data is stored; re-capturing, by the computer device, response data from the user; determining whether the re-captured response data matches the challenge data; and, in response to a further successful match, removing the authentication screen from the display and granting access to the at least one application.

[0019] According to embodiments of the present disclosure, the challenge data corresponds to previously acquired biometric data for the user encoded on the physical medium, and the response data corresponds to live biometric data of the user.

[0020] According to embodiments of the present disclosure, the challenge data corresponds to a previously created passcode encoded on the physical medium, and the response data corresponds to a user-entered passcode received by the computer device via a user interface.

[0021] According to embodiments of the present disclosure, the challenge data corresponds to previously acquired biometric data for the user and a previously generated passcode encoded on the physical medium, and the response data corresponds to live biometric data of the user and a user-entered passcode received by the computer device via a user interface, and determining whether the response data matches the challenge data includes: determining whether at least one of (i) the live biometric data matches the previously acquired biometric data for the user encoded on the physical medium, or (ii) the user-entered passcode matches the previously generated passcode encoded on the physical medium.

[0022] According to embodiments of the present disclosure, the method includes disabling a lock screen function of the computer device; and executing, by the computer device, an authentication application that displays the authentication screen instead of the lock screen function, wherein the authentication application is implemented in a lock task mode.

[0023] According to embodiments of the present disclosure, a user identifier is captured from the physical medium in response to scanning the physical medium, and the method, in response to a successful match, further comprises: identifying the user who was authenticated via the authentication screen based on the user identifier; and linking operations performed by the computer device to the user identifier.

[0024] According to embodiments of the present disclosure, the method involves receiving individual filing credentials from the user in response to successful matching; and setting up a single filing session for the user with the individual filing credentials.

[0025] According to embodiments of the present disclosure, the computer device requires that the user provide the individual login credentials each time the authentication screen is displayed.

[0026] According to embodiments of the present disclosure, the method involves replaying the authentication screen in response to a lock screen event; maintaining the single login session for the user; in response to the authentication of a next user based on challenge and response data associated with the next user, determining whether the next user is the same as the user last authenticated to the computer device or a different user; in response to the next user being the same as the user, enabling the next user to use the single login session; and in response to the next user being the different user, terminating the single login session and requesting new single login credentials for the next user to establish a new single login session.

[0027] According to embodiments of the present disclosure, the next user is the user, a single login username is captured from the physical medium for the user in response to scanning the physical medium, and determining that the next user corresponds to the user involves comparing the single login username captured from the physical medium with a single login username associated with the single login session.

[0028] According to embodiments of the present disclosure, the method includes replaying the authentication screen in response to a lock screen event; maintaining a set of login sessions for a plurality of users of the computer device, the plurality of users including the user; in response to the authentication of a next user based on challenge data and response data associated with the next user, determining the identity of the next user; and determining whether the computer device maintains an active single login session for the next user based on the identity of the next user.In response to the determination that the active single logon session for the next user exists, selecting the active single logon session that corresponds to the identity of the next user and allowing the next user to use the active single logon session; and in response to the determination that the active single logon session for the next user does not exist, requesting new single logon credentials for the next user in order to establish a new single logon session.

[0029] According to embodiments of the present disclosure, the challenge data and a single login username for the next user are captured from a physical medium associated with the next user, the response data for the next user are captured from the user, the user's identity is determined based on the single login username, and determining whether the computer device maintains an active single login session for the next user includes comparing the single login username captured from the physical medium with a plurality of single login usernames associated with the individual login sessions in the set.

[0030] According to embodiments of the present disclosure, the method includes encrypting the individual filing credentials; storing the encrypted individual filing credentials; retrieving and decrypting the encrypting individual filing credentials in response to a request to establish a new individual filing session for the user; and using the individual filing credentials to establish the new individual filing session for the user.

[0031] According to embodiments of the present disclosure, scanning the physical medium involves imaging at least one encoded data form arranged on a substrate of the physical medium via an image capture device or a barcode scanning machine of the computer device.

[0032] According to embodiments of the present disclosure, scanning the physical medium involves querying at least one radio frequency label carried on a substrate of the physical medium.

[0033] According to embodiments of the present disclosure, the acquisition of response data includes the acquisition of live biometric data of the user via at least one of an image acquisition device, a fingerprint scanner, a retinal / iris scanner or a microphone of the computer device.

[0034] According to embodiments of the present disclosure, the method includes creating the challenge data for the user during a registration process; encrypting the challenge data; and transferring the encrypted challenge data to the physical medium by at least one of printing one or more coded data forms on the physical medium containing the challenge data, or encoding one or more radio frequency labels of the physical medium with the challenge data.

[0035] According to embodiments of the present disclosure, the method involves configuring the computer device based on device configuration data acquired from the physical medium or from a server based on a Universal Resource Locator acquired from the physical medium.

[0036] According to embodiments of the present disclosure, a computer device is disclosed. The computer device includes a display, data acquisition devices, a non-transitory, computer-readable medium configured to store instructions, and a processor. The processor is operationally coupled to the display and the plurality of acquisition devices.The processor is configured to execute the instructions to: display an authentication screen on the display, the authentication screen preventing access to at least one application; scan, via a first data acquisition device of the plurality of data acquisition devices, a physical medium located outside and independent of the computer device to capture challenge data for a user from the physical medium; capture response data from the user via the first data acquisition device or a second data acquisition device of the plurality of data acquisition devices; determine whether the response data matches the challenge data; and, in response to a successful match, remove the authentication screen from the display and grant access to the at least one application.

[0037] According to embodiments of the present disclosure, the processor is configured to delete the challenge data and the response data from the non-transitory computer-readable medium after determining whether the response data matches the challenge data.

[0038] According to embodiments of the present disclosure, the processor is configured to: display the authentication screen on the display after a lock screen event occurs; rescan the physical medium to re-capture challenge data for the user from the physical medium via the first data acquisition device; re-capture the response data from the user via the first or second data acquisition device; determine whether the re-captured response data matches the re-captured challenge data; and, in response to another successful match, remove the authentication screen from the display and grant access to the at least one application.

[0039] According to embodiments of the present disclosure, the processor is configured to delete the response data from the non-transitory computer-readable medium after determining whether the response data matches the challenge data; encrypt the challenge data; store the encrypted challenge data in the non-transitory computer-readable medium for a period of time; and delete the challenge data when the period expires or is reset.

[0040] According to embodiments of the present disclosure, the processor is configured to: display the authentication screen after a lock screen event occurs; determine whether the encrypted challenge data is stored in the non-transitory computer-readable medium; bypass a physical medium scanning operation in response to the determination that the encrypted challenge data is stored; re-capture the response data from the user via the first or second data capture device; determine whether the re-captured response data matches the challenge data stored in the non-transitory computer-readable medium; and, in response to a further successful match, remove the authentication screen from the display and grant access to the at least one application.

[0041] According to embodiments of the present disclosure, the challenge data corresponds to previously acquired biometric data for the user encoded on the physical medium, and the response data corresponds to live biometric data of the user.

[0042] According to embodiments of the present disclosure, the challenge data corresponds to a previously created passcode encoded on the physical medium, and the response data corresponds to a user-entered passcode received by the computer device via a user interface.

[0043] According to embodiments of the present disclosure, the challenge data corresponds to previously acquired biometric data for the user and a previously generated passcode encoded on the physical medium, and the response data corresponds to live biometric data of the user and a user-entered passcode received by the computer device via a user interface, and the processor is configured to determine whether the response data matches the challenge data based on a determination of whether at least one of (i) the live biometric data matches the previously acquired biometric data for the user encoded on the physical medium, or (ii) the user-entered passcode matches the previously generated passcode encoded on the physical medium.

[0044] According to embodiments of the present disclosure, the processor is configured to disable a lock screen function of the computer device; and to execute an authentication application that displays the authentication screen instead of the lock screen function, wherein the authentication application is implemented in a lock task mode.

[0045] According to embodiments of the present disclosure, a user identifier is captured from the physical medium in response to scanning the physical medium, and in response to a successful match, the processor is configured to: identify the user who has been authenticated via the authentication screen based on the user identifier; and associate operations performed by the computer device with the user identifier.

[0046] According to embodiments of the present disclosure, the processor is configured to receive individual login credentials from the user in response to a successful match; and to establish a single login session for the user with the individual login credentials.

[0047] According to embodiments of the present disclosure, the processor is configured to require the user to provide the individual login credentials each time the authentication screen is displayed.

[0048] According to embodiments of the present disclosure, the processor is configured to: replay the authentication screen in response to a lock screen event; maintain the single login session for the user; in response to the authentication of a next user based on challenge and response data associated with the next user, determine whether the next user is the same as the user last authenticated to the computer device or a different user; in response to the next user being the same as the user, allow the next user to use the single login session; and in response to the next user being the same as the other user, terminate the single login session and request new single login credentials for the next user to establish a new single login session.

[0049] According to embodiments of the present disclosure, the next user is the user, a single login username is captured from the physical medium for the user in response to scanning the physical medium, and determining that the next user corresponds to the user involves comparing the single login username captured from the physical medium with a single login username associated with the single login session.

[0050] According to embodiments of the present disclosure, the processor is configured to: replay the authentication screen in response to a lock screen event; maintain a set of login sessions for a plurality of users of the computer device, the plurality of users including the user; determine the identity of the next user in response to the authentication of a next user based on challenge data and response data associated with the next user; and determine whether the computer device maintains an active single login session for the next user based on the identity of the next user.In response to the determination that the active single logon session for the next user exists, select the active single logon session that corresponds to the identity of the next user and allow the next user to use the selected active single logon session; and in response to the determination that the active single logon session for the next user does not exist, request new single logon credentials for the next user in order to establish a new single logon session.

[0051] According to embodiments of the present disclosure, the challenge data and a single login username for the next user are captured from a physical medium associated with the next user, the response data for the next user are captured from the user, the user's identity is determined based on the single login username, and the processor is configured to determine whether an active single login session is maintained for the next user by comparing the single login username captured from the physical medium with a plurality of single login usernames associated with the individual login sessions in the set.

[0052] According to embodiments of the present disclosure, the processor is configured to encrypt the individual login credentials; to store the encrypted individual login credentials; to retrieve and decrypt the encrypting individual login credentials in response to a request to establish a new individual login session for the user; and to use the individual login credentials to establish the new individual login session for the user.

[0053] According to embodiments of the present disclosure, the first data acquisition device is an image acquisition device or a barcode scanning machine and the processor is configured to scan the physical medium by imaging at least one encoded data form arranged on a substrate of the physical medium via the image acquisition device or the barcode scanning machine.

[0054] According to embodiments of the present disclosure, the first data acquisition device is a radio frequency reader and the processor is configured to scan the physical medium by querying at least one radio frequency label borne by a substrate of the physical medium.

[0055] According to embodiments of the present disclosure, the first or second data acquisition device is a device consisting of an image acquisition device, a fingerprint scanner, a retinal / iris scanner or a microphone.

[0056] According to embodiments of the present disclosure, the processor is configured to: The processor is configured to create the challenge data for the user during a registration process, encrypt the challenge data, and transfer the encrypted challenge data to the physical medium by applying at least one of: printing one or more coded data forms onto the physical medium containing the challenge data, or encoding one or more radio frequency labels of the physical medium with the challenge data.

[0057] According to embodiments of the present disclosure, the processor is configured to configure the computer device based on device configuration data acquired from the physical medium or from a server based on a Universal Resource Locator acquired from the physical medium.

[0058] Fig. Figure 1 illustrates an exemplary system 100 according to embodiments of the present disclosure. As in Fig. As shown in Figure 1, the system 100 can include a computer device 110, a server 120, and / or a database 130, which can be operationally coupled to one another via a network 140. The computer device 110 and the server 120 can execute instructions or code to implement processes according to embodiments of the present disclosure. In one example, the devices 110 can be a mobile computing device, such as a mobile phone, a tablet, and / or handheld barcode readers, or they can be a laptop, computer desk, or workstation. The network 140 can be implemented as the Internet, an intranet, a virtual private network (VPN), a wide area network (WAN), a local area network (LAN), a cellular network, a mesh or ad-hoc network, and / or another suitable network. The device 110 can communicate with the server 120 and the database 130 via the network 140.

[0059] The computer device 110 can include a processor 112 and a non-transient computer-readable medium, e.g., a memory / storage 114 (e.g., random-access memory (RAM), read-only memory (ROM), programmable ROM, erasable programmable ROM, electrically erasable programmable ROM, magnetic storage drive, optical storage drive, solid-state drive, flash drive, any combination of the foregoing, etc.) that stores instructions or executable code. The processor 112 includes, for example, one or more microprocessors, central processing units (CPUs), graphics processing units (GPUs), microcontrollers, controllers, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), and / or any suitable type of logic circuitry.The processor 112 can be programmed to execute the instructions or code stored in the memory 114 to implement at least part of a registration process. The computer device 110 can communicate with an input device 150 (e.g., mouse, keyboard, touch-sensitive display, etc.); a biometric capture device 152 (e.g., an image capture device (e.g., a camera), a handprint / fingerprint scanner, a retinal / iris scanner, and / or a microphone); a printer 154; and / or an RF encoder 156. In some embodiments, the input device 150, the biometric capture device(s) 152, the printer 154, and / or the RF encoder 156 can be integrated into the computer device 110. In some embodiments, the printer 154 and the RF encoder 156 can be integrated. In some embodiments, the system can be free of the printer 154 or the RF encoder 156.In some embodiments, the input device 150, the biometric detection device 152, the printer 154 and / or the RF encoder 156 can communicate with the device 110 via the network 140.

[0060] The Server 120 can include a Processor 122 and a non-transient computer-readable medium, e.g., a Memory / Storage 124 (e.g., Random Access Memory (RAM), Read-Only Memory (ROM), Programmable ROM, Erasable Programmable ROM, Electrically Erasable Programmable ROM, Magnetic Storage Drive, Optical Storage Drive, Solid State Drive, Flash Drive, any combination of the foregoing, etc.). The Processor 122 includes, for example, one or more microprocessors, central processing units (CPUs), graphics processing units (GPUs), microcontrollers, controllers, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), and / or any suitable type of logic circuitry.The processor 122 can be programmed to execute instructions or code stored in memory 214 to implement at least part of a login process. The device 110 can communicate with the server 120 to request that the server 120 perform one or more operations. The server 120 can execute computer- or machine-readable instructions or code to perform the operations and processes described herein. The server 120 can transmit responses to the device 110 and / or output information or data associated with the response from the server 120 through one or more I / O devices, such as a display and / or a speaker.The Server 120 can implement enterprise service software, which may include, for example, RESTful (Representational State Transfer) API services, message queue services, and event services. These can be provided by various platforms or specifications, such as the J2EE specification, which is implemented by any of the Oracle WebLogic Server platforms, the JBoss platform, or the IBM WebSphere platform, etc. Other technologies or platforms, such as Ruby on Rails, Microsoft .NET, or similar, can also be used.

[0061] Database 130 can be a data archive that stores data which can be used by computer device 110 and / or the server. For example, the database can store user IDs associated with end users in an enterprise system and can associate information with these user IDs, such as device usage data, user-specific device configuration data, user-specific permissions for using devices and applications, device deployment data, employment information, scheduling information, and / or any other information.

[0062] A logon application 102 can be stored on the computer device 110 and / or the server 120 (e.g., in memory 114 and / or 124). The logon application 102 can be executed by the processor 112 of the computer device 110 and / or the processor 122 of the server to implement embodiments of a logon process. In some embodiments, the logon application 102 can be stored on the computer device 110 and not on the server 120, so that the computer device 110 is configured to implement the logon process. In some embodiments, the logon application 102 can be stored on the server and not on the computer device 110, so that the computer device 110 is configured to implement the logon process.In some embodiments, the registration application 102 can be distributed between the computer device 110 and the server 120, such that the computer device 110 implements at least part of the registration process and the server 120 implements at least part of the registration process.

[0063] In an exemplary operation of system 100, the logon application can be executed by the computer device 110 and / or the server 120 to perform a logon process (e.g., as in exemplary logon processes from Fig. 3 and Fig. 4) to implement in order to create, provide and / or configure a physical medium 162 for a user 158 that contains user information which is subsequently accessed by a computer device (e.g. the one in Fig. The computer device 210 shown in Figure 2 can be used to authenticate the user, identify the user, configure the computer device upon user authentication, and / or establish a single sign-on (SSO) session for the user. For example, the login application 102 can be executed to provide a user interface through which the user 158 can enter information, such as a user ID, challenge data (e.g., a passcode), device configuration parameter values, SSO credentials (e.g., an SSO username), and / or other information, via the input device 150. The user interface provided by the login application 102 can also allow the user 158 to provide challenge data in the form of biometric characteristics, which are captured for the user 158 via the biometric capture device 152.As an example, the image capture device can capture images of a user's face, and one or more facial features can be extracted from the image using one or more existing image processing and / or object and / or face recognition techniques and / or algorithms that can be used by the Processor 212. As another example, the image capture device can capture images of a user's palm, and one or more palm features can be extracted from the image using one or more existing image processing and / or object and / or palm print recognition techniques and / or algorithms that can be used by the Processor 212.

[0064] Once the challenge data (e.g., passcode and biometric characteristics), user ID, device configuration data, and / or SSO username for user 158 are received from computer device 110 and / or server 120, computer device 110 and / or server 120 can encrypt the challenge data (e.g., passcode and biometric characteristics), user ID, device configuration data, and / or SSO username. In one embodiment, the user's SSO username may not be obtained during the login process and / or may not be included in the encrypted data. In another embodiment, the device configuration data may not be obtained during the login process and / or may not be included in the encrypted data. In another embodiment, the user ID may be created by the user.In one embodiment, the user ID is assigned to the user. In another embodiment, the user ID and / or device configuration data can be stored in a data archive, such as database 130.

[0065] In some embodiments, the data (e.g., including biometric data, passcode, user ID, SSO username, and / or device configuration data) to be transferred to the physical medium can be encrypted (e.g., digitally signed) using the company's certificate. For example, an authorized person (e.g., an administrator) of the company can provide the company's private key from a secure location for use during the login process, and computer device 110 or server 120 can encrypt the data using the company's certificate's private key to produce the encrypted data.

[0066] In some embodiments, a user can interface with a device configuration interface of computer device 110 or another device (e.g., one of the devices 210) during an embodiment of the login process. The device configuration interface can be recorded while the user specifies the device configuration data via the user interface. The recorded device configuration interface, which can be uploaded to a cloud service over the network 140, can provide a unique Universal Resource Locator (URL) from the recorded interface and can be associated with a tenant identifier. In a non-restrictive example, server 120 and / or database 130 can be configured to implement the cloud service.The unique URL and tenant identifier can be transferred to the physical medium along with the user ID, passcode, and / or SSO username to complete the login process. After a user logs in to a computer device (e.g., one of the devices listed in the system), the user's login credentials can be transferred to the physical medium. Fig. 2 computer devices shown 210) have been authenticated, the computer device on which the user is authenticated can retrieve the recorded interface of the user who enters the device configuration data using the unique URL and / or the tenant identifier, and can use key and touch injection to configure the device based on the device configuration data entered into the recorded interface.

[0067] The computer device 110 and / or the server 120 can transfer the encrypted data to the physical medium 162, making the physical medium user-specific. For example, the physical medium 162 can include a substrate 164, and the computer device 110 and / or the server 120 can control the printer 154 to print one or more encoded data forms 166 onto the substrate, encoding the encrypted data in the one or more data forms. Alternatively, the physical medium 162 can include one or more RF labels 168 on or embedded in the substrate 164, and the computer device 110 and / or the server 120 can control the RF encoder 156 to encode the encrypted data in the one or more RF labels 168.As another example, the computer device 110 and / or the server 120 can control the printer 154 to print at least part of the encrypted data in the one or more data forms 166, and can control the RF encoder 156 to encode at least part of the encrypted data in the one or more RF labels 168. In one example, the one or more data forms can be linear or one-dimensional (1D) barcodes, matrix codes, or two-dimensional (2D) barcodes, a combination of 1D and 2D barcodes (or stacked barcode), and / or any other symbologies. In another example, the one or more RF labels 168 can be radio frequency identification (RFID) labels, near field communication (NFC) labels, or a combination of RFID and NFC labels.In some embodiments, the size of the encrypted data may allow the encrypted data to be encoded into a single data form 166 and / or a single RF label 168. In some embodiments, the size of the encrypted data may exceed the size limits of a single data form and / or a single RF label. For such embodiments, the encrypted data may be encoded into multiple data forms 166 and / or multiple RF labels 168. Once the encrypted data is encoded in the one or more data forms 166 and / or in the one or more RF labels 168, the user 158 may use the physical medium 162 to facilitate the authentication of the user 162 with one or more computer devices, for example, as described herein.

[0068] While an example system configuration in Fig. As illustrated in point 1, one or more of the devices or elements that are in Fig. The system configurations illustrated in 1 can be combined, split, rearranged, omitted, eliminated, and / or implemented in any other way. Furthermore, the exemplary system configuration shown in 1 can be combined, split, rearranged, omitted, eliminated, and / or implemented in any other way. Fig. Figure 1 illustrates one or more aspects in addition to or instead of those that are in Fig. 1 are illustrated, include and / or may include more than one of any or all of the illustrated aspects.

[0069] Fig. Figure 2 illustrates an exemplary system 200 according to embodiments of the present disclosure. As in Fig. As shown in Figure 2, the system can include 100 computer devices 210 (individual computer device 210-1, 210-2, 210-3), a server 220, and / or a database 130, which can be interconnected via the network 140. The computer devices 210 and the server 220 can execute instructions or code to implement processes according to embodiments of this disclosure. In one example, the computer devices 210 can be mobile computing devices, such as mobile phones, tablets, handheld barcode scanners, and / or other mobile computing devices; or they can be a laptop, a computer desk, or a workstation. The system 200 can be implemented in an enterprise environment, and the computer devices 210 can be deployed for operation in a particular plant or plants, with the computer devices 210 being able to be shared by multiple users.Network 140 can be implemented as the Internet, an intranet, a virtual private network (VPN), a wide area network (WAN), a local area network (LAN), a cellular network, a mesh or ad-hoc network, and / or another suitable network. The computer devices 210 can communicate with the server 220 and the database 130 via network 140.

[0070] Each of the computer devices 210 can include a processor 212 and a non-transient computer-readable medium, e.g., a memory / memory 214 (e.g., random-access memory (RAM), read-only memory (ROM), programmable ROM, erasable programmable ROM, electrically erasable programmable ROM, magnetic storage drive, optical storage drive, solid-state drive, flash drive, any combination of the foregoing, etc.) that stores instructions or executable code. The processor 212 includes, for example, one or more microprocessors, central processing units (CPUs), graphics processing units (GPUs), microcontrollers, controllers, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), and / or any suitable type of logic circuitry.The processor 212 can be programmed to execute the instructions or code stored in the memory 214 to implement at least part of an authentication process. In some embodiments, the computer device 110 ( Fig. 1) be configured in the same way as computer device 210 so that an authentication application can be run by computer device 110 to implement at least part of the authentication process.

[0071] Each of the computer devices 210 may also include input / output (I / O) devices 250, which may include, for example, a display 252 (including, for example, a touchscreen display); one or more biometric sensing devices, such as an image sensing device 254 (e.g., a camera), a handprint / fingerprint scanner 256, a retinal / iris scanner 258, a microphone 260; loudspeakers 262; a barcode scanning machine 264 (e.g., a laser-based, linear imager-based, or array / 2D area imager-based barcode scanning engine); an RF reader 266, buttons / actuators 266; and / or a keyboard 268. A user can operate, manipulate and / or control the display 252, the keys 266 and / or the keyboard 268, and the processor 202 can execute one or more instructions or code in response to the input.For example, the processor 212 can control the display to reproduce an authentication screen, can control the image capture device 254 to image a user's face 158, image a user's palm and / or image the one or more data forms 166 on the physical medium 162; the handprint / fingerprint scanner 256 captures a handprint / fingerprint of the user 158, the retina / iris scanner 258 captures an image of the user's retina / iris 158, the microphone 260 captures a user's voice 158, the speakers 262 output audible information to the user, the barcode scanning engine 264 captures the characters 166 and / or the RF reader 266 queries the one or more RF tags 168 of the physical medium.In some embodiments, the image capture device 254 can be configured to image one or more data forms 166, and the computer devices 210 can be free of the barcode scanning machine 264. In such embodiments, the processor 212 can be configured to decode the one or more encoded data forms 166. In some embodiments, the computer devices 210 can be free of the handprint / fingerprint scanner 256 and / or the retinal / iris scanner 258. While the image capture device 254 and the microphone 260 have been identified as biometric capture devices, the image capture device 254 and the microphone 260 can additionally or alternatively be used to capture information and / or data that is not related to biometric data.

[0072] Each of the computer devices 210 can also include any number and / or type(s) of wired and / or wireless communication interface(s) 270, which facilitates communication with the other devices over the network 140. The communication interface 270 can operate according to any suitable interface(s), protocol(s), signal(s), connector(s), etc., such as a TCP / IP interface, a Wi-Fi™ interface (according to the IEEE 802.11 standard family), a cellular interface (e.g.,using GSM, GPRS, CDMA, GPRS, 2G / GSM, 3G, 4G / LTE, EDGE, 5G), an Ethernet transceiver, a Universal Serial Bus (USB) interface, a Bluetooth® interface, a Near Field Communication (NFC) interface, an infrared transceiver, a satellite network radio, a cable modem, a Digital Subscriber Line (DSL) modem, a dial-up modem, or any other suitable communication protocol or standard. In this example, communication interface 270 may include a radio frequency communication interface configured for wireless communication with the network (e.g., via the access points and / or base stations).

[0073] The Server 220 can include a Processor 222 and a non-transient, computer-readable medium, such as a Memory / Storage 224 (e.g., Random Access Memory (RAM), Read-Only Memory (ROM), Programmable ROM, Erasable Programmable ROM, Electrically Erasable Programmable ROM, Magnetic Storage Drive, Optical Storage Drive, Solid State Drive, Flash Drive, any combination of the foregoing, etc.) that stores instructions or executable code. The Processor 222 includes, for example, one or more microprocessors, central processing units (CPUs), graphics processing units (GPUs), microcontrollers, controllers, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), and / or any suitable type of logic circuitry.The processor 222 can be programmed to execute instructions or code stored in the memory 224 to implement at least part of an authentication process. The computer devices 210 can communicate with the server 220 to request that the server 220 perform one or more operations. The server 220 can execute instructions or executable code to perform the operations and processes described herein. The server 220 can transmit responses to the computer devices 210, and the device 210 can output information or data associated with the response from the server 220 through one or more of the I / O devices 250, such as the display 252 and / or the speakers 262.The Server 220 can implement enterprise service software, which may include, for example, RESTful (Representational State Transfer) API services, message queue services, and event services, provided by various platforms or specifications, such as the J2EE specification, implemented by any of the Oracle WebLogic Server platforms, the JBoss platform, or the IBM WebSphere platform, etc. Other technologies or platforms, such as Ruby on Rails, Microsoft .NET, or similar, can also be used. In some implementations, the Server 120 (in . Fig. (shown in 1) be configured to implement the operations and processes of server 220, so that server 120 can be configured for login processes and / or authentication processes.

[0074] An authentication application 202 can be stored on the computer devices 210 and / or the server 220 (e.g., in memory 214 and / or 224). The authentication application 202 can be executed by the processor 212 of the computer devices 210 and / or the processor 222 of the server 220 to implement embodiments of an authentication process. In some embodiments, the authentication application 202 can be stored on the computer devices 210 and not on the server 220, so that the computer devices 210 are configured to implement the authentication process. In other embodiments, the authentication application 202 can be stored on the server 220 and not on the computer devices 210, so that the server 220 is configured to implement the authentication process.In some embodiments, the authentication application 202 can be distributed between the computer devices 210 and the server 220, so that each of the computer devices 210 can implement at least part of the authentication process and the server 220 can implement at least part of the authentication process.

[0075] In one example, which can be used in combination with any other examples or combinations of examples described herein, the data (e.g., including biometric data, passcode, user ID, SSO username, and / or device configuration data) for a user (e.g., user 158) to be transferred to a physical medium (e.g., physical medium 162) can be encrypted (e.g., digitally signed) with the company's certificate as part of an embodiment of a login process. As an example, an authorized person (e.g., an administrator) of the company can provide the company's private key from a secure location to be used during the login process, and the computer device 110 or server 120 (in Fig. (as shown in Figure 1) can encrypt the data using the private key of the company's certificate to generate the encrypted data. Computer devices 210 can be provided to contain the public key of the company's certificate. When the physical medium 162 is scanned by one of the computer devices 210 (e.g., computer device 210-1), computer device 210-1, which scanned the physical medium 162, receives the encrypted data and attempts to decrypt it using the public key of the certificate provided in computer device 210-1. If the certificate can decrypt the encrypted data and provide valid decrypted data, then computer device 210-1 can determine that the encrypted data was created and signed by the same company.If the decryption process using the certificate's public key fails, the computer device 210-1 can determine that the encrypted data does not belong to the company.

[0076] In one example, which can be used in combination with any other examples or combinations of examples described herein, a lock screen function of computer devices 210 can be disabled, thus bypassing the lock screen function of computer devices 210. For computer devices using the Android mobile operating system, for example, the Android Keyguard lock screen can be set to "none". Instead, an authentication screen can be displayed as the lock screen in response to the execution of the authentication application 202. Alternatively, the authentication application can be integrated into the computer device's operating system, allowing the lock screen function to be configured to implement the authentication screen and facilitate the authentication process of the authentication application.The authentication screen can prevent users from proceeding without being authenticated by the computer device. For example, on computer devices using the Android mobile operating system, the authentication application can run in lock-task mode with the authentication screen as an overlay window located on a homepage and / or any other application. The authentication screen can also prevent users from leaving the authentication screen until they are authenticated. For example, a home key, recent key, back key, and notification bar pulldown are locked for a computer device using the Android operating system, preventing a user from leaving the authentication screen by any other means.The lock-up task mode can lock the computer device into a single application (e.g., the authentication application 202), preventing users from accessing other applications, features, and / or data on or through the computer device until the user is authenticated. Once authenticated, the user passes the authentication screen and gains access to the computer device (e.g., the Android Device Launcher for Android-based computer devices). This allows users to share the same device, as their response data (e.g., live biometric data and / or passcode) is compared to the challenge data stored on an external source, such as a physical medium like physical medium 162.

[0077] In one example, which can be used in combination with any other examples or combinations of examples described herein, an embodiment of application 102 (in Fig. (shown in Figure 1) is executed to implement a login process that can create a one-to-one mapping between a user (e.g., User 158) and a passcode. A user ID and passcode can be encoded, encrypted, and transferred to a physical medium (e.g., physical medium 162). One of the computer devices 210 (e.g., computer device 210-1), which executes an embodiment of the authentication application, can implement an authentication process that can scan physical medium 162 and request that User 158 enter a passcode. If the entered passcode matches, User 158 is authenticated and granted access to computer device 210-1.Since each user has their own passcode, there is no need to share their passcode with any other users, and separate passcode provisioning for each computer device 210 is not required. User 158's use of computer device 210-1 can be tracked based on the identity of user 158 logging into computer device 210-1, as each user can be identified by the unique identifier retrieved from physical medium 162. Because each user has their own passcode and must scan their own physical medium with computer devices 210, the likelihood of compromising the security of computer devices 210 and the enterprise system 200 in general is reduced.Even if the passcode is compromised, the passcode used to authenticate the user can be traced to determine which user's passcode has been compromised, and entry can be denied for that user.

[0078] In one example, which can be used in combination with any other examples or combinations of examples described herein, an embodiment of application 102 (in Fig. (1 shown) to implement a login process that can create a one-to-one mapping between a user identifier and biometric data for the user. The user identifier and the biometric data can be encoded, encrypted, and transferred to a physical medium (e.g., the physical medium 162). As an example, the user identifier and the biometric data can be encrypted using a certificate for the company (e.g., the user's employer) so that, after decrypting the encrypted data, it can be determined whether the user is from (or employed by) the company. According to embodiments of the present disclosure, one of the computer devices 210 (e.g.,Computer device 210-1) provides an embodiment of the authentication application 202 to implement an authentication process that scans the physical medium 162 and captures live biometric data of the user 158, for example, by starting the camera preview of an image capture device (e.g., image capture device 254) to capture facial biometrics. The facial biometrics in the live camera preview should match the biometric vectors from the physical medium 162. If a match is found, the user 158 is granted access to the computer device 210-1. No separate biometric data provision to the computer device 210-1 is required because biometric data is encoded on the physical medium 162.While facial features are one example of biometric data, the biometric data may include other biometric data described herein or a combination thereof, and may utilize other biometric data acquisition devices or a combination of biometric acquisition devices. The user identifier can be obtained from the physical medium 162 when scanned to authenticate the user, and the user identifier can track which user has logged on to the computer device 210-1. The configuration of the computer device 210-1 can be determined based on the profile associated with the user identifier, and the computer device 210-1 can be configured accordingly. Based on the user identifier, the computer device 210-1 or another device (e.g.,Server 220) authorizes the user 158 to access certain applications based on an access level associated with their user ID. According to embodiments of the present disclosure, a login process can create a one-to-one mapping between a user and biometric data for the user, and a passcode and biometric data, the passcode, or both the biometric data and the passcode may be required for authentication by the computer device 210.

[0079] In one example, which can be used in combination with any other examples or combinations of examples described herein, the authentication application 202 can be executed by the computer device 210-1 and / or the server 220 to perform an authentication process (e.g., such exemplary authentication processes of the Fig. 5-9) to implement in order to authenticate a user of computer device 210-1. While the authentication process is described with reference to computer device 210-1, computer devices 210-2 and 210-3 may operate in a similar or identical manner to computer device 210-1 when a user attempts to be authenticated for computer devices 210-2 and 210-3. The authentication application 202 can be executed to display an authentication screen on the display 252 of the computer device 210-1, which locks the user out of the computer device 210-1 and prevents the user 158 from accessing at least one application on the computer device 210-1 or any other device (e.g., the server 220), and / or prevents users from accessing data stored on the computer device 210-1 and / or on any other device (e.g., the server 220).stored on the server 220 and / or the database 130. When locked, the computer device 210-1 can allow users to access certain applications, functions, parameters, and data stored on the computer device 210-1. In some embodiments, for example, the authentication screen can allow users to view notifications, control audio playback, capture images, operate a flashlight function, initiate an emergency call, and / or check the time or date without requiring users to first authenticate themselves to the computer device 210-1 in order to unlock it. The authentication screen can be displayed on the display 252 when the computer device 210-1 experiences a lock screen event.Some examples of lock screen events may include turning on the device, allowing the device to remain idle for a certain period of time, and / or receiving input for the user to turn off the display or put the device into sleep mode.

[0080] In a non-restrictive example, which can be used in combination with any other examples or combinations of examples described herein to be authenticated to the device (e.g., the computer device 210-1), the authentication screen may require the user 158 to scan the physical medium 162 containing the challenge data to be used by the authentication application 202 when evaluating response data provided by the user 158. As an example, the device may capture the challenge data from the physical medium 162 by mapping the one or more data forms 166 on the physical medium 162 using the barcode scanning engine 264 or the image capture device 254, and / or by querying the one or more RF labels 168 of the physical medium 162 using the RF reader 266.As an example, the processor 212 can control the image capture system 254 to capture images of encoded characters, such as barcodes, and can use the captured images to recognize and / or decode the encoded characters present in the images. Once the challenge data is received from the computer device 210-1, the authentication screen can request that the user provide response data to the computer device 210-1. As an example, the authentication screen can request that the user capture 158 live biometric data with the computer device 210-1, such as using one or more of the biometric capture devices described herein, and extract live biometric features from the biometric data. As an example, the processor 212 can control the image capture system 254 to capture images of the user's face.The Processor 212 can process images of the user's face and extract live facial features from the images. One or more existing image processing and / or object and / or face recognition techniques and / or algorithms can be used by the Processor 212 to extract facial features from the images of the user's face. While facial features are one example of biometric data, the biometric data can include other biometric data described herein or a combination thereof, and can utilize other biometric data acquisition devices or a combination of biometric acquisition devices. The response data in the form of the live biometric feature(s) can be compared with the challenge data in the form of the biometric feature(s) retrieved from the physical medium.If there is a match between the challenge and response data, the user 158 can be authenticated to the device 210-1, the authentication screen can be removed, and the user can access applications and / or data that the user could not access when the authentication screen was displayed. If not, authentication may fail, or fallback authentication may be attempted. For example, if biometric authentication fails, the authentication screen may request additional response data requiring the user 158 to enter a passcode via the display 252 (e.g., a virtual keyboard or keyboard displayed on the display 252), a physical keyboard 268, the microphone 260, or another I / O device.The response data, in the form of the passcode entered by user 258, can be compared with the challenge data, in the form of the passcode retrieved from physical medium 162. If the response data, in the form of the passcode entered by the user, matches the passcode from physical medium 162, user 158 can be authenticated to the device, the authentication screen can be removed, and the user can access applications and / or data that were previously inaccessible when the authentication screen was displayed. In some embodiments, the user may be required to complete a two-factor authentication screen, which requires successful authentication using both biometric data and passcodes.Using this approach, each user can be authenticated to the device based on user-specific data, and each user can have their own authentication data / credentials to authenticate on one or more computer devices in the System 200.

[0081] Once the user has been authenticated, the computer device can use the user identifier contained in the one or more data forms 166 and / or the one or more RF labels 168 to identify the user and track the user's use of the computer device 210-1, which can be stored in a log on the computer device 210-1 and / or in the database 130. For embodiments in which device configuration data is contained in the one or more data forms 166 and / or the one or more RF labels 168, the computer device 210-1 can automatically configure the computer device 210-1 with the device configuration data.For embodiments in which device configuration data is stored by the server 220 and / or the database 130, the computer device 210-1 can communicate with the server 220 and / or the database 130 to retrieve the device configuration data, whereupon the processor 212 can automatically configure the computer device 210-1 with the device configuration data. The computer device 210-1 can also manage the data retrieved from the physical medium and provided by the user, for example, by deleting such data after authentication is successful or fails, or after a configurable period. Further exemplary authentication processes are described herein with reference to the [reference to be added]. Fig. Described in sections 5-9.

[0082] Once users have been authenticated on one of the computer devices 210, embodiments of the present disclosures can facilitate and manage single sign-on sessions for the users. For the shared computer devices (e.g., computer device 210), which can be used by multiple users, the users can use their single sign-on (SSO) credentials to establish an SSO session and gain access to specific applications once the users are authenticated and have gained access to the devices. The mapping between SSO sessions and the users' biometric data and / or each user's passcode for accessing the device is typically not possible in conventional systems. Therefore, enterprise systems typically cannot guarantee that users logging in via their biometric data are using their own SSO session.As an example, in one use case, a first user is authenticated by the computer device and then provides the SSO credentials (SSO username and password) to establish an SSO session for the first user. If the same user locks the computer device and subsequently attempts to unlock it, for example, using the first user's biometric data or the shared passcode, the first user would typically have to re-enter the first user's SSO credentials.To avoid this problem, in some embodiments of the present disclosure, the computer devices 210 can be programmed and / or configured such that the first user maintains access to the first user's SSO session without requiring the first user to re-enter the first user's SSO username and password, even after the computer devices 210 need to be unlocked again. Alternatively or additionally, the computer device can encrypt and store the first user's SSO credentials, and these can be retrieved and used to establish a new SSO session for the first user when the first user is the next user to use the device. If a second user attempts to access the same computer device (e.g.,To unlock the computer device 210-1, which the first user previously used and in which the first user's SSO session is active (and / or the first user's SSO credentials are stored), using the second user's biometric data (e.g.), the computer device 210-1 terminates the first user's SSO session (and / or deletes the first user's SSO credentials) and the computer device 210-1 prompts the second user to enter the second user's SSO credentials (e.g., the SSO username and password) to establish a new SSO session assigned to the second user.

[0083] To achieve this SSO session management, embodiments of the login application can be executed to implement a login process that can encode and encrypt a user's biometric data (and / or passcode) and an SSO username, and transfer the encrypted data to the physical medium (e.g., physical medium 162). The user's SSO password cannot be included in the encoded and encrypted data. One embodiment of the login process can create a one-to-one mapping between the user's biometric data and the user's SSO username. For example, when the first user (e.g., user 158) attempts to unlock one of the computer devices 210 (e.g., computer device 210-1) for the first time using physical medium 162 and provide live biometric data, there might not be an active SSO session on computer device 210-1.In response to the determination that no active SSO session exists, computer device 210-1 can prompt the first user 158 to enter the first user's SSO credentials (e.g., the SSO username and password) to establish an SSO session associated with the first user 158. As a non-restrictive example, a Google Custom Chrome tab using the oauth2 library can be implemented using a web view of the authentication application 202, which can detect that there is no active SSO session on computer device 210-1. A user interface (e.g., an SSO login screen) can be rendered on the display 252 of computer device 210-1 using the web view, with the user interface prompting the first user 158 to enter the first user's SSO login credentials.

[0084] In some embodiments, an SSO login screen displayed in a web view instance can be recorded while the user specifies their SSO login credentials. The recorded SSO login credentials and / or the user's challenge data can be retained in a web view instance of an SSO session established for the user. In a non-restrictive example, after a user is authenticated on a computer device (e.g., one of computer devices 210), the computer device (e.g., one of computer devices 210) can retrieve the recorded SSO login credentials used, which can be implemented in an SSO login screen to establish a new SSO session for the user. Alternatively, if the computer device maintains an SSO session for the user, for example,in a web view, SSO login credentials (e.g., the SSO username captured from the physical medium) and / or live biometric data are used to identify the web view instance associated with the user by comparing the SSO login credentials captured from the physical medium with the SSO login credentials held in the web view instance, and / or by comparing the live biometric data with the biometric data held in the web view instance.

[0085] Once the first user (158) has established the first user's SSO session, user 158 can access and use applications that utilize SSO with the established SSO session without having to provide SSO credentials again. If the first user locks computer device 210-1 and the first user (158) is the next user to unlock computer device 210-1 (e.g., after a few minutes), the first user (158) can use computer device 210-1 to scan the first user's physical medium 162 and re-capture the first user's live biometric data to authenticate user 158.The computer device 210-1 can determine that the first user 158 is the same user who was previously authenticated, and the SSO username of the first user obtained from the physical medium 162 can be used to determine whether the first user 158 has an active SSO session on the computer device 210-1 (e.g., by comparing the SSO username obtained from the physical medium 162 with the SSO username of the active SSO session), which is maintained, for example, in a web view.If the SSO usernames match, computer device 210-1 can determine that the user who unlocked computer device 210-1 and the user whose SSO session is active on computer device 210-1 are the same user. In response, computer device 210-1 can grant the first user 158 access to the currently active SSO session associated with the first user 158 without requiring the first user to re-enter the first user's SSO username and password. Alternatively, computer device 210-1 can use SSO credentials encrypted and stored by the computer device to initiate a new SSO session for the user. However, if the first user stops using computer device 210-1 and the computer device 210-1 is locked, and a second user is authenticated by computer device 210-1 (e.g.,(By scanning the physical medium and providing live biometric data associated with the second user), computer device 210-1 can determine that the second user's SSO username obtained from the second user's physical medium does not match the SSO username associated with the current active SSO session on computer device 210-1, maintained, for example, by a web view. Based on this mismatch between the SSO username obtained from the second user's physical medium and the SSO username associated with the SSO session on computer device 210-1, maintained, for example, by a web view, computer device 210-1 determines that another user (e.g., the second user) has unlocked computer device 210-1. In response to the determination that another user (e.g.,Once the second user has been authenticated, computer device 210-1 terminates the current active SSO session (which is assigned to the first user, for example) in computer device 210-1 and displays the SSO login screen on the computer device's display to prompt the second user to enter the second user's SSO login credentials in order to establish an active SSO session assigned to the second user.

[0086] In some embodiments, instead of terminating a user's (e.g., the first user's) SSO session when another user (e.g., the second user) unlocks one of the computer devices (e.g., computer device 210-1), computer device 210-1 can maintain the SSO sessions for the users and manage access to the SSO sessions based on which user authenticated computer device 210-1 (which user unlocks it). Using this approach, multiple users can share the same computer device without requiring the user to re-enter their SSO username and password each time the computer device is unlocked. For example, multiple SSO sessions can be supported in web views, with each web view instance corresponding to an SSO session for a specific user.Each web view instance can also hold the biometric data of the specific user (captured from the physical medium), which will be used to subsequently authenticate the user when the authentication screen is displayed. For example, in some embodiments, the biometric data of a user (e.g., user 158), obtained from a physical medium (e.g., physical medium 162) and compared with live biometric data captured by computer device 210-1, can be used by computer device 210-1 to identify which user has been authenticated. Once the user has been identified, computer device 210-1 can automatically grant the identified user access to the SSO session associated with that user.For example, the SSO session associated with the authenticated user can be accessed. To achieve this SSO session management, one embodiment of the login application can implement a login process that can encode and encrypt a user's biometric data (and / or passcode) and SSO username on a physical medium. The user's SSO password can be excluded from the encoded and encrypted data. One embodiment of the login process can create a one-to-one mapping between the user's biometric data (and / or passcode) and the user's SSO username. When the first user (e.g., user 158) attempts to log in to one of the computer devices 210 (e.g., computer device 210-1) for the first time using the physical medium (e.g.,To unlock the physical medium (162) of the first user and provide live biometric data of the first user (158), there may be no active SSO session in the computer device (210-1) (maintained, for example, in a web view instance). In response to the determination that no active SSO session exists, the computer device (210-1) may prompt the first user (158) to enter the first user's SSO credentials (e.g., the SSO username and password) to establish an SSO session associated with the first user (158) (maintained, for example, in a new web view instance). This SSO login screen may only be presented once in a lifetime for this user to log in to this computer device (or until the computer device is reset to factory default settings).For subsequent logins, the user is not required to re-enter their SSO credentials. Once authenticated, the user is granted access to the user's SSO session after the first login and gains access to SSO-enabled applications without having to re-enter their SSO username and / or password. As a non-restrictive example, this approach can be used to maintain multiple concurrent SSO sessions across Web View instances using Google Custom Chrome Tabs. Each SSO session is associated with a user identity obtained from its respective physical medium and based on the user's authentication through the computer device (e.g., tablet).Once the computer device 210-1 is authenticated, the computer device 210-1 retrieves the respective SSO session for that identified user and provides the identified access to the SSO session. The SSO sessions can be kept active for users by periodically updating their access tokens (e.g., via refresh tokens).If the computer device 210-1 is locked after the first user has used it, and the second user is authenticated by the computer device 210-1 (unlocking the computer device) using the second user's biometric data (or passcode), the computer device 210-1 can identify the second user as another user whose SSO session is active on the computer device 210-1. The second user will then be presented with the SSO login screen for the first time when the second user is authenticated by the device, after which the SSO session can be maintained for the second user. This will also be the case the next time either the first or the second user is authenticated by the computer device 210-1 (e.g.,(Unlocking the device), the computer device 210-1 can determine the identity of the user as the first user or the second user and can grant the identified user access to the identified user's SSO session.

[0087] While an example system configuration in Fig. As illustrated in point 2, one or more of the devices or elements that are in Fig. The system configurations illustrated in 2 can be combined, split, rearranged, omitted, eliminated, and / or implemented in any other way. Furthermore, the exemplary system configuration shown in Fig. 2 illustrates one or more aspects in addition to or instead of those that are in Fig. 2 are illustrated, include and / or may include more than one of any or all of the illustrated aspects.

[0088] Fig. Figure 3 is a flowchart illustrating an exemplary registration process 300 according to embodiments of the present disclosure. The registration process 300 can be implemented to prepare physical media containing the authentication data for use by an authentication process when an authentication screen is displayed on the screen of a device (e.g., one of the devices 110 described in Fig. The registration process 300 can be implemented using one or more of the devices 110, the servers 120, and / or the databases 130. In one example, the registration process 300, or at least part of it, can be implemented by the first device 110-1 of the devices 110 shown in Figure 1. Fig. The processes shown in Figure 1 can be executed. In one example, the registration process 300, or at least part of it, can be executed by the server 120 based on data received from the first device 110-1. In another example, the execution of the registration process 300 can take place between the first device 110-1 and the server 120, which is shown in Figure 1. Fig. As shown in 1, they will be distributed.

[0089] In process 302, a processor (e.g., of device 110 or server 120) can access a biometric scanning device (e.g., the biometric scanning device 152, which is located in Fig. (as shown in Figure 1) to control a device to capture a user's biometric data. For example, the biometric capture device could be an image capture device, and the biometric data captured by the biometric capture device could include images of the user's face; the biometric capture device could be a handprint / fingerprint scanner, and the biometric data captured by the handprint / fingerprint scanner could be a handprint / fingerprint of the user; the biometric capture device could be a retinal / iris scanner, and the biometric data captured by the retinal / iris scanner could be images of the user's retina / iris; the capture device could be a microphone, and the biometric data captured by the microphone could be a user's voice; and / or the biometric capture device could be another device.which is configured to collect biometric data, where the biometric data can be any biometric data that can be used to identify the user. In Operation 304, the processor (e.g., of computer device 110) or another processor (e.g., of server 120) can extract biometric features from the collected biometric data. As an example, if the biometric data includes images of the user's face, the processor or the other processor can run facial recognition algorithms to extract facial features of the user that can be used to identify the user. As another example, if the biometric data includes a handprint / fingerprint of the user, the processor or the other processor can run handprint / fingerprint recognition algorithms to extract facial features of the user that can be used to identify the user.to identify the user. As another example, if the biometric data includes an image of the user's retina / iris, the processor or another processor can execute retinal / iris recognition algorithms to extract retinal / iris features of the user that can be used to identify the user. As another example, if the biometric data includes the user's voice, the processor or another processor can execute voice recognition algorithms to extract voice features of the user that can be used to identify the user.

[0090] In operation 306, the processor or the other processor can receive additional user information (e.g., as input from the user) that can be used by the authentication process to authenticate and / or identify the user. For example, the additional user information received by the processor or the other processor could include a user ID associated with the user, which can be used to identify the user, and / or a user-specific passcode, which can be used in the authentication process to authenticate the user in addition to or instead of biometric data, or can be used to authenticate the user if user authentication using biometric data fails.The biometric data or characteristics and the passcode can be challenge data. The user ID can be created by the user or assigned to the user, for example, by an administrator. In one example, the user ID can be stored in database 130 so that when a user is authenticated via the authentication process, their use of the device can be tracked and attributed to the user.

[0091] In Operation 308, the processor (e.g., of computer device 110) or the other processor (e.g., of server 120) can receive device configuration data from the user. The device configuration data can include, for example, parameters and parameter values ​​that can be configured on the device. As a non-restrictive example, parameters and parameter values ​​for accessibility parameters can be received, such as display brightness, speaker volume, icon size, magnification function, touch-and-hold function, talk-back function, text-to-speech function, live captioning function, and / or other parameters.

[0092] In operation 310, the processor (e.g., of computer device 110) or the other processor (e.g., of server 120) can receive a single sign-on (SSO) username from the user. A user's SSO username can be used with the user's SSO password to establish an authenticated SSO session with an SSO service or identity provider, allowing the user to use one set of login credentials to log in to and access multiple SSO-enabled applications.

[0093] In Operation 312, the extracted biometric features, additional user information (e.g., user ID and user-specific passcode), device configuration data, and / or SSO username can be encrypted by the processor or the other processor to produce encrypted data. In Operation 314, the encrypted data can be transferred to a physical medium. For example, the physical medium can be a substrate, and the encrypted data can be transferred to the substrate by printing one or more coded data forms (e.g., one-dimensional barcodes, two-dimensional barcodes, or other symbologies) onto the substrate. Another example is that the physical medium can be a substrate bearing one or more radio frequency tags (e.g.,A radio-frequency identification (RFID) tag or a near-field communication (NFC) tag is included, and the encrypted data can be encoded into one or more radio-frequency tags using a radio-frequency encoder. In another example, the encrypted data can be transferred to the physical medium by printing one or more encoded data forms onto the physical medium and encoding a radio-frequency tag with the encrypted data. Once the encrypted data is transferred to the physical medium, the physical medium can be used by one or more computer devices (e.g., computer device 210) when attempting to authenticate the user if the locked screen interface has locked the device.Depending on the size of the encrypted data being transferred to the physical medium, a single data form or radio frequency label may be insufficient to contain all the encrypted data. In such scenarios, the encrypted data may be split across two or more data forms and / or two or more radio frequency labels. During Operation 316, the processor or other processor may erase the biometric data and / or features, additional user information (such as the user ID and user-specific passcode), device configuration data, and / or the SSO username for the storage (such as storage 114) to avoid storing user-sensitive data.

[0094] Although Fig. Three exemplary operations of registration process 300 illustrate that the registration process can include more or fewer operations and / or the operations can be performed in different sequences or combinations. For example, in one embodiment, registration process 300 may be free of operations 308 and / or 310, so that the encrypted data includes the biometric data and the additional user data, but not the device configuration data and / or the SSO username.

[0095] Fig. Figure 4 is a flowchart illustrating another exemplary registration process 400 according to embodiments of the present disclosure. The registration process 400 can be implemented to prepare physical media containing the authentication data for use by an authentication process when an authentication screen is displayed on the screen of a computer device (e.g., the computer device 110, which is described in Fig. The registration process 400 can be performed using the device, a server (e.g., server 120, which is in Fig. 1 is shown) and / or a database (e.g., database 130, which is in Fig. (as shown in Figure 1) can be implemented. In one example, the registration process 400, or at least a part of it, can be executed by the computer device. In another example, the registration process 400, or at least a part of it, can be executed by the server based on data received from the computer device. In yet another example, the execution of the registration process 400 can be distributed between the computer device and the server.

[0096] In operation 402, a processor (e.g., of device 110 or server 120) can access a biometric scanning device (e.g., the biometric scanning device 152, which is located in Fig. (as shown in Figure 1) to control a device to capture a user's biometric data. For example, the biometric capture device could be an image capture device, and the biometric data captured by the biometric capture device could include images of the user's face; the biometric capture device could be a handprint / fingerprint scanner, and the biometric data captured by the handprint / fingerprint scanner could be a handprint / fingerprint of the user; the biometric capture device could be a retinal / iris scanner, and the biometric data captured by the retinal / iris scanner could be images of the user's retina / iris; the capture device could be a microphone, and the biometric data captured by the microphone could be a user's voice; and / or the biometric capture device could be another device.which is configured to collect biometric data, where the biometric data can be any biometric data that can be used to identify the user. In Operation 404, the processor (e.g., of Device 110) or another processor (e.g., of Server 120) can extract biometric features from the collected biometric data. As an example, if the biometric data includes images of the user's face, the processor or the other processor can run facial recognition algorithms to extract facial features of the user that can be used to identify the user. As another example, if the biometric data includes a handprint / fingerprint of the user, the processor or the other processor can run handprint / fingerprint recognition algorithms to extract facial features of the user that can be used to identify the user.to identify the user. As another example, if the biometric data includes an image of the user's retina / iris, the processor or another processor can execute retinal / iris recognition algorithms to extract retinal / iris features of the user that can be used to identify the user. As another example, if the biometric data includes the user's voice, the processor or another processor can execute voice recognition algorithms to extract voice features of the user that can be used to identify the user.

[0097] In operation 406, the processor or the other processor can receive additional user information (e.g., as input from the user) that can be used by the authentication process to authenticate and / or identify the user. For example, the additional user information received by the processor or the other processor could include a user ID associated with the user, which can be used to identify the user, and / or a user-specific passcode, which can be used in the authentication process to authenticate the user in addition to or instead of biometric data, or can be used to authenticate the user if user authentication using biometric data fails.The biometric data and / or characteristics and the passcode can constitute challenge data. The user ID can be created by the user or assigned to the user, for example, by an administrator. In one example, the user ID can be stored in database 130 so that when a user is authenticated via the authentication process, their use of the device can be tracked and attributed to them.

[0098] In operation 408, the processor (e.g., of computer device 110) or the other processor (e.g., of server 120) can receive a single sign-on (SSO) username from the user. A user's SSO username can be used with an SSO password to establish an authenticated SSO session with an SSO service or identity provider, allowing the user to use one set of login credentials to sign in to and access multiple SSO-enabled applications.

[0099] In operation 410, the processor (e.g., of device 110) or the other processor (e.g., of server 120) can receive device configuration data from the user. This device configuration data can include, for example, parameters and parameter values ​​that can be configured on the device. As a non-restrictive example, parameters and parameter values ​​for accessibility parameters can be received, such as display brightness, speaker volume, icon size, magnification function, touch-and-hold function, talk-back function, text-to-speech function, live captioning function, and / or other parameters.

[0100] In operation 412, the user ID and device configuration data can be stored in a data archive (e.g., such as database 130, which is located in Fig. (as shown in Figure 1) are stored. When the user is authenticated by a device via an authentication process, the device can retrieve the device configuration data from the data archive using the user identifier retrieved from the physical medium and can configure the device according to the retrieved device configuration data.

[0101] In some embodiments, during an embodiment of the login process 400, a user can interface with a device configuration interface of the computer device (e.g., device 110) or another device (e.g., one of the devices 210). The device configuration interface can be recorded while the user specifies the device configuration data via the user interface. The recorded device configuration interface, which can be uploaded and stored to a cloud service over the network 140, and a unique Universal Resource Locator (URL) for the uploaded and stored recorded interface can be provided and can be associated with a tenant identifier. In a non-restrictive example, the server 120 and / or the database 130 can be configured to implement the cloud service.The unique URL and tenant identifier can be transferred to the physical medium along with the user ID, passcode, and / or SSO username to complete the login process. After a user has been authenticated on a computer device (e.g., one of the 210 computer devices), the computer device (e.g., one of the 210 computer devices) can retrieve the recorded interface of the user, who enters the device configuration data using the unique URL and tenant identifier, and can use key and touch injection to configure the computer device (e.g., one of the 210 computer devices) based on the device configuration data entered into the recorded interface.

[0102] In Operation 414, the extracted biometric features, the additional user information (e.g., the user ID and / or user-specific passcode), and / or the SSO username can be encrypted by the processor or the other processor to produce encrypted data. In Operation 416, the encrypted data can be transferred to a physical medium (e.g., as one or more barcodes on the substrate or as data stored in one or more radio frequency tags), as described herein. Once the encrypted data is transferred to the physical medium, the physical medium can be used to access a shared computing device (e.g., such as the one described in Fig. 2. Computer device 210 shown) when an attempt is made to authenticate the user, for example, if the shared computer device has been locked and the authentication screen is being displayed on a screen of the shared computer device. During operation 418, the processor (e.g., of device 110) or the other processor (e.g., of server 120) may delete the biometric features, additional user information (e.g., user ID and user-specific passcode), device configuration data, and / or SSO username from memory (e.g., memory 114) to avoid storing user-sensitive data.

[0103] Although Fig. Four exemplary operations of registration process 400 illustrate that the registration process can include more or fewer operations and / or the operations can be performed in different sequences or combinations. For example, in one embodiment, registration process 400 may be free of operations 408, 410, and / or 412, so that no device configuration data is received and the encrypted data includes the biometric data and the additional user data, but not the SSO username.

[0104] Fig. Figure 5 is a flowchart illustrating an exemplary authentication process 500 according to embodiments of the present disclosure. In process 502, an authentication screen can be displayed on the screen of a computer device (e.g., the computer device 210-1, 210-2, or 210-3). The authentication screen can present a user with a locked screen that prevents users from accessing at least one application on the computer device or on another device (e.g., the server 220) with which the computer device is configured to communicate, and / or can prevent users from accessing sensitive data stored on the computer device or the other device. In one example, the authentication screen can allow a user to scan a physical medium (e.g., the physical medium 162) containing encrypted data.As described herein, the encrypted data may include challenge data, such as biometric characteristics and / or a user-specific passcode that must be met before a user can be authenticated and granted access to the computer device (e.g., access to certain applications and / or data), user identification data that can be used to determine a user's identity, such as a user ID, SSO username, device configuration data for personalized configuration of the device, and / or other information.

[0105] In Operation 504, the computer device (e.g., the computer device 210-1, 210-2, or 210-3) can scan / read the encrypted data from the physical medium, and in Operation 506, the computer device decrypts the encrypted data. For example, the data acquisition device can be an image acquisition device (e.g., the image acquisition device 254) or a barcode scanning machine (e.g., the barcode scanning machine 260) that can be controlled automatically by a processor (e.g., the processor 212) of the computer device and / or in response to user input (e.g., receiving a selection from a physical or virtual button). The image acquisition device or barcode scanning machine can map an encoded data form (e.g., one or more data forms 166) onto the physical medium that encodes the encrypted data. As another example, the data acquisition device can be a radio frequency reader (e.g.,The radio frequency reader (266) can be controlled by the processor of the computer device to automatically query an RF label (e.g., one or more RF labels 168) of the physical medium with a radio frequency signal and / or in response to input from the user (e.g., receiving a selection from a physical or virtual button). The radio frequency label can respond to the query by outputting the encrypted data to the radio frequency reader.

[0106] In Operation 508, the computer device performs a primary authentication challenge using an initial subset of the challenge data received from the physical medium. For example, a message may appear on the authentication screen requesting the user to provide response data matching the initial subset of challenge data. The primary authentication challenge may require a first factor for authentication. For example, the challenge data received from the physical medium may include one or more biometric features, and the response data received from the user may include live biometric data and / or user features captured by the device (e.g.,via a biometric capture device, such as an image capture device, a microphone, a handprint / fingerprint scanner, a retinal scanner, or another biometric capture device. For example, the live biometric data may include one or more images of the user's face, and one or more live biometric features may be facial features extracted from the image(s). The one or more live biometric features can be compared to the one or more biometric features from the physical medium to determine if there is a match.

[0107] If the user's response to the challenge data is successful (at operation 510), process 500 proceeds to operation 512, where authentication is successful. If the user's response to the challenge data is unsuccessful, process 500 may proceed to operation 514, where a secondary authentication challenge may be performed using a second subset of the challenge data from the physical medium. The secondary authentication challenge may require a second factor for authentication. For example, the second subset of the challenge data may include a user-specific passcode, and the secondary authentication challenge may prompt the user to provide a response to the secondary challenge, such as entering a passcode.If the user's response to the secondary authentication challenge is unsuccessful (at operation 516), authentication fails, the challenge data captured from the physical medium is deleted, and process 500 can return to operation 502 to display the authentication screen. If the response to the secondary challenge data is successful (at operation 516), the computer device successfully authenticates the user at operation 512. Using this approach, the user is authenticated against challenge data obtained from the physical medium, which the computer device may capture, for example, at the time of authentication. Prior to capturing the challenge data from the physical medium during authentication process 500, the computer device may not be aware of the challenge data.

[0108] If the computer device successfully authenticates the user at Operation 512, the computer device removes the authentication screen at Operation 518 to grant the user access to the computer device (e.g., to at least one application and / or data that the user could not access when the authentication screen was displayed). At Operation 520, the computer device (e.g., computer device 210-1, 210-2, or 210-3) or another device (e.g., server 120) in communication with the computer device may track the use of the computer device and associate the use of the computer device with the user of the computer device based on the user identifier captured from the physical medium. The use of the device and the association of the use with the user may be recorded in a log and / or a data archive (e.g., database 130, which is located in Fig. (as shown in 1) are stored. In operation 522, the computer device can delete the challenge data received from the physical medium and the response data received from the user. In operation 524, the computer device can determine whether a screen lock event has occurred. If not, process 600 can repeat operation 524.

[0109] Although Fig. Five exemplary operations of authentication process 500 are illustrated. The authentication process can include more or fewer operations, and / or the operations can be performed in different sequences or combinations. As an example, while process 500 has been illustrated with a primary authentication challenge and a secondary authentication challenge, embodiments of the present disclosure can include more or fewer authentication challenges (a single authentication challenge out of three or more). For embodiments that include a single authentication challenge, the challenge can be based on biometric data, a passcode, or another authentication factor.As another example, while the primary authentication challenge has been described as using biometric data and the secondary authentication challenge as using a passcode, embodiments of the present disclosure may use the passcode for the primary authentication challenge or another authentication factor, and may use the biometric data for the secondary authentication challenge or another authentication factor. As another example, while the secondary authentication challenge is initiated when the primary authentication challenge fails, embodiments of the present disclosure may require that both the primary and secondary authentication challenges succeed before the user is authenticated.

[0110] Fig. Figure 6 is a flowchart illustrating an exemplary authentication process 600 according to embodiments of the present disclosure. In process 602, an authentication screen can be displayed on the screen of a device (e.g., devices 210-1, 210-2, or 210-3). The authentication screen can present a user with a locked screen that prevents users from accessing at least one application on the computer device or on another device (e.g., server 220) with which the computer device is configured to communicate, and / or can prevent users from accessing sensitive data stored on the computer device or the other device. In one example, the authentication screen can allow a user to scan a physical medium (e.g., physical medium 162) containing encrypted data.As described herein, the encrypted data may include challenge data, such as biometric characteristics and / or a user-specific passcode that must be met before a user can be authenticated and granted access to the computer device (e.g., access to specific applications and / or data); user identification data that can be used to establish the user's identity, such as a user ID, SSO username; device configuration data for personalized configuration of the computer device; and / or other information. In Operation 604, the computer device may scan the encrypted data from the physical medium using a data acquisition device, and the computer device's processor may decrypt the encrypted data. As an example, the data acquisition device may be an image acquisition device (e.g., a camera).The image capture device 254) or a barcode scanning machine (e.g., the barcode scanning machine 264) can be controlled by a processor (e.g., the processor 212) of the computer device automatically and / or in response to user input (e.g., receiving a selection from a physical or virtual button). The image capture device or the barcode scanning machine can map an encoded data form onto the physical medium that encodes the encrypted data. As another example, the data capture device can be a radio frequency reader (e.g., the radio frequency reader 266) that can be controlled by the processor of the computer device to automatically query a radio frequency label on the physical medium with a radio frequency signal and / or in response to user input (e.g., receiving a selection from a physical or virtual button).The radio frequency tag can respond to the query by outputting the encrypted data to the radio frequency reader. In Operation 606, live biometric data of the user can be captured by the computer device (e.g., via a biometric capture device such as the image capture device 254, a handprint / fingerprint scanner 256, a retinal / iris scanner 258, a microphone 260, or another biometric capture device). In one example, the biometric capture device can image the user's face. In Operation 608, the computer device's processor extracts a live biometric feature from the captured live biometric data, and in Operation 610, the extracted live feature is compared to the biometric feature captured from the physical medium.In one example, the biometric capture device can image a user's face as the live biometric data, and one or more of the user's facial features can be extracted from the image. Using this approach, the user's live biometric feature(s) are authenticated against biometric features from the physical medium, both of which can be captured by the computer device at the time of authentication. Prior to capturing the encrypted biometric feature(s) from the physical medium during the authentication process, the computer device is unaware of the user's biometric feature(s).If there is a match between the biometric feature captured from the physical medium and the live biometric feature (at step 612), the computer device's processor successfully authenticates the user at step 614. If there is no match (at step 612), the computer device's processor can compare a passcode received from the user with the user-specific passcode contained in the encrypted data from the physical medium at step 616. The passcode entered by the user is authenticated against the user-specific passcode from the physical medium, both of which can be captured by the computer device at the time of authentication.Before capturing the encrypted user-specific passcode from the physical medium during authentication process 600, the computer device is unaware of the user's user-specific passcode. If there is a match between the entered passcode and the user-specific passcode (during process 618), the computer device's processor successfully authenticates the user during process 614. If there is no match between the entered passcode and the user-specific passcode (during process 618), the computer device's processor cannot authenticate the user during process 620 and deletes the encrypted and decrypted data (e.g., the biometric feature(s), passcode, user ID, SSO username, device configuration data, etc.).), which are captured from the physical medium, the live biometric data and the extracted user feature(s) captured by the biometric capture device, and any information entered by the user for authentication at operation 622 (e.g., the passcode entered by the user), after which process 600 can return to operation 602 to display the authentication screen. In some embodiments, process 600 can be configured to skip operations 616 and 618, so that in response to a biometric feature mismatch with the live biometric feature at operation 612, the process proceeds to operation 620, where authentication fails.In some embodiments, the authentication process can exclude biometric authentication, so that the passcode entered by the user is compared with the user-specific passcode without capturing and / or comparing biometric data or features of the user. In some embodiments, the sequence of operations of the authentication process 600 can first attempt to authenticate the user using the passcode entered by the user and the user-specific passcode, and if this authentication fails, the process can attempt to authenticate the user based on the live biometric feature(s) captured using the biometric capture device and the biometric feature(s) captured from the physical medium.

[0111] If the computer device successfully authenticates the user at operation 614, the computer device's processor removes the authentication screen at operation 624 to grant the user access to the device (e.g., to at least one application and / or data that the user could not access when the authentication screen was displayed). At operation 626, the computer device or another device (e.g., server 120) in communication with the computer device may track the computer device's usage and associate the computer device's usage with the computer device's user based on the user identifier contained in the encrypted data captured from the physical medium. The computer device usage and the association of that usage with the user may be recorded in a log and / or data archive (e.g., database 130, which is located in Fig. 1 is shown) will be saved.

[0112] In Operation 628, the computer device's processor can configure the device based on device configuration data obtained from the physical medium or from a remote device (such as Server 120 or 220), if available. For example, the computer device can retrieve a recorded device configuration interface from the user who inputs the device configuration data. This data can be retrieved by the computer device based on a unique Universal Resource Locator (URL) and a tenant identifier obtained from the physical medium. After retrieving the recorded interface, the computer device can use key and touch injection to configure the computer device based on the device configuration data entered into the recorded interface.

[0113] In process 630, the computer device processor can determine whether an active SSO session exists on the computer device (for example, one maintained in a web view instance). If so, process 600 proceeds to process 632, in which the computer device processor determines whether the authenticated user is the same user associated with the active SSO session. As an example, the computer device processor can compare the SSO username obtained from the physical medium with the SSO username of the existing SSO session on the computer device to determine whether the authenticated user is the same user for whom an SSO session exists.As another example, if the biometric data previously captured from the physical medium is held in the web view instance, the biometric data can be compared with the live biometric data to determine that the SSO session corresponds to the authenticated user. If it does not, process 600 proceeds to operation 638, where the processor requests and receives SSO credentials from the user. If an existing SSO session exists (at operation 630) and the computer device determines that the authenticated user is the same user as the existing SSO session (at operation 632), the computer device's processor can allow the user to use the existing SSO session associated with that user (at operation 634).If the user is not the same one who was authenticated the last time the authentication screen was displayed (Operation 632), the computer device processor can terminate the previous user's SSO session (if one exists) in Operation 636. Process 600 can then proceed to Operation 638, where the computer device can receive new individual login credentials from the authenticated user. The computer device can then use these credentials to establish an SSO session for the user (e.g., via a web view instance that provides an SSO login screen). In Operation 640, the computer device processor deletes the encrypted and decrypted data (e.g., the biometric attribute(s), passcode, user ID, data configuration device, etc.).), which are captured from the physical medium, the biometric live data and the extracted user characteristic(s) captured by the biometric capture device, and / or any information entered by the user for authentication (e.g. the passcode entered by the user).

[0114] In process 642, the computer device's processor can determine whether a screen lock event has occurred. If not, process 600 can repeat process 642. If it is determined that a screen lock event has occurred, process 600 can return to process 602 to display the authentication screen on the computer device's display to lock users from the computer device.

[0115] Although Fig. Six exemplary operations of the authentication process 600 illustrate that the authentication process may include more or fewer operations and / or the operations may be carried out in different sequences or combinations.

[0116] Fig. Figure 7 is a flowchart illustrating an exemplary authentication process 700 according to embodiments of the present disclosure. In process 702, an authentication screen can be displayed on the screen of a device (e.g., devices 210-1, 210-2, or 210-3). The authentication screen can present a user with a locked screen that prevents users from accessing at least one application on the computer device or on another device (e.g., server 220) with which the computer device is configured to communicate, and / or can prevent users from accessing sensitive data stored on the computer device or the other device. In one example, the authentication screen can allow a user to scan a physical medium (e.g., physical medium 162) containing encrypted data.As described herein, the encrypted data may include challenge data, such as biometric characteristics and / or a user-specific passcode that must be met before a user can be authenticated and granted access to the computer device (e.g., access to specific applications and / or data); user identification data that can be used to establish the user's identity, such as a user ID, SSO username; device configuration data for personalized configuration of the computer device; and / or other information. In Operation 704, the computer device may scan the encrypted data from the physical medium using a data acquisition device, and the computer device's processor may decrypt the encrypted data. As an example, the data acquisition device may be an image acquisition device (e.g., a camera).The image capture device 254) or a barcode scanning machine (e.g., the barcode scanning machine 264) can be controlled by a processor (e.g., the processor 212) of the computer device automatically and / or in response to user input (e.g., receiving a selection from a physical or virtual button). The image capture device or the barcode scanning machine can map an encoded data form onto the physical medium that encodes the encrypted data. As another example, the data capture device can be a radio frequency reader (e.g., the radio frequency reader 266) that can be controlled by the processor of the computer device to automatically query a radio frequency label on the physical medium with a radio frequency signal and / or in response to user input (e.g., receiving a selection from a physical or virtual button).The radio frequency tag can respond to the query by outputting the encrypted data to the radio frequency reader. In Operation 706, live biometric data of the user can be captured by the computer device (e.g., via a biometric capture device such as the image capture device 254, a handprint / fingerprint scanner 256, a retinal / iris scanner 258, a microphone 260, or another biometric capture device). In one example, the biometric capture device can image the user's face. In Operation 708, the computer device's processor extracts a live biometric feature from the captured live biometric data, and in Operation 710, the extracted live feature is compared to the biometric feature captured from the physical medium.In one example, the biometric capture device can image a user's face as the live biometric data, and one or more of the user's facial features can be extracted from the image. Using this approach, the user's live biometric feature(s) are authenticated against biometric features from the physical medium, both of which can be captured by the computer device at the time of authentication. Prior to capturing the encrypted biometric feature(s) from the physical medium during the authentication process, the computer device is unaware of the user's biometric feature(s).If there is a match between the biometric feature captured from the physical medium and the live biometric feature (at step 712), the computer device's processor successfully authenticates the user at step 714. If there is no match (at step 712), the computer device's processor can compare a passcode received from the user with the user-specific passcode contained in the encrypted data from the physical medium at step 716. The passcode entered by the user is authenticated against the user-specific passcode from the physical medium, both of which can be captured by the computer device at the time of authentication.Prior to capturing the encrypted user-specific passcode from the physical medium during authentication process 700, the computer device is unaware of the user's user-specific passcode. If there is a match between the entered passcode and the user-specific passcode (during process 718), the computer device's processor successfully authenticates the user during process 714. If there is no match between the entered passcode and the user-specific passcode (during process 718), the computer device's processor cannot authenticate the user during process 720 and deletes the encrypted and decrypted data (e.g., the biometric feature(s), passcode, user ID, SSO username, data configuration device, etc.).), which are captured from the physical medium, the live biometric data and the extracted user feature(s) captured by the biometric capture device, and any information entered by the user for authentication at operation 722 (e.g., the passcode entered by the user), after which process 700 can return to operation 702 to display the authentication screen. In some embodiments, process 700 can be configured to skip operations 716 and 718, so that in response to a biometric feature mismatch with the live biometric feature at operation 712, the process proceeds to operation 720, where authentication fails.In some embodiments, the authentication process can exclude biometric authentication, so that the passcode entered by the user is compared with the user-specific passcode without capturing and / or comparing biometric data or features of the user. In some embodiments, the sequence of operations of the authentication process 700 can first attempt to authenticate the user using the passcode entered by the user and the user-specific passcode, and if this authentication fails, the process can attempt to authenticate the user based on the live biometric feature(s) captured using the biometric capture device and the biometric feature(s) captured from the physical medium.

[0117] If the computer device successfully authenticates the user at operation 714, the computer device's processor removes the authentication screen at operation 724 to grant the user access to the device (e.g., to at least one application and / or data that the user could not access when the authentication screen was displayed). At operation 726, the computer device or another device (e.g., server 120) in communication with the computer device may track the computer device's usage and associate that usage with the computer device's user based on the user identifier contained in the encrypted data captured from the physical medium. The computer device usage and its association with the user may be recorded in a log and / or data archive (e.g., database 130, which is located in Fig. 1 is shown) will be saved.

[0118] In Operation 728, the computer device's processor can configure the device based on device configuration data obtained from the physical medium or from a remote device (such as Server 120 or 220), if available. For example, the computer device can retrieve a recorded device configuration interface from the user who inputs the device configuration data. This data can be retrieved by the computer device based on a unique Universal Resource Locator (URL) and a tenant identifier obtained from the physical medium. After retrieving the recorded interface, the computer device can use key and touch injection to configure the computer device based on the device configuration data entered into the recorded interface.

[0119] In process 730, the computer device processor can determine that the user has an existing SSO session on the computer device. For example, the computer device processor can compare the SSO username obtained from the physical medium with the SSO usernames of existing SSO sessions on the computer device to determine if the user has an existing SSO session. If the user has an existing SSO session, process 700 proceeds to process 732, in which the computer device processor selects the SSO session associated with the user from a set of existing SSO sessions for users of the computer device and allows the user to use the corresponding SSO session. The SSO sessions in the set can be maintained as active for the users, for example, by periodically updating their access tokens.If no SSO session exists for the user (e.g., because the user has not previously established an SSO session with the computer device or for other reasons), process 700 proceeds to operation 734, in which the processor requests and receives SSO credentials from the user and the computer device establishes an SSO session for the user. In operation 736, the computer device processor adds the new SSO session from the user to the set of existing SSO sessions for users of the computer device. In operation 738, the computer device processor deletes the encrypted and decrypted data (e.g., the biometric attribute(s), passcode, user ID, data configuration device, etc.).), which are captured from the physical medium, the biometric live data and the extracted user characteristic(s) captured by the biometric capture device, and / or any information entered by the user for authentication (e.g. the passcode entered by the user).

[0120] During process 740, the computer device's processor can determine whether a screen lock event has occurred. If not, process 700 can repeat process 740. If it is determined that a screen lock event has occurred, process 700 can return to process 702 to display the authentication screen on the computer device's display to lock users from the computer device.

[0121] Although Fig. Seven exemplary operations of the authentication process 700 illustrate that the authentication process may include more or fewer operations and / or the operations may be carried out in different sequences or combinations.

[0122] Fig. Figure 8 is a flowchart illustrating an exemplary authentication process 800 according to embodiments of the present disclosure. Fig. Figure 9 is a flowchart illustrating an example process 900, which runs in parallel to the authentication process 800. Fig. 8 can be implemented. With reference to Fig. 9. The device can be configured to implement a timer or a configurable period during which challenge data (biometric data and a user-specific passcode obtained from a physical medium) for a user can be stored in memory. After a timer expires or is reset, or after a configurable period expires or is reset, the device can delete the stored challenge data. As a non-restrictive example, the timer or configurable period could correspond to shifts in a work schedule at a plant where the device is used (for example, 8-hour shifts during a day). During Operation 902, the device determines whether the configurable period has expired or been reset. If it has not, the process repeats Operation 902.If this is the case, the device deletes the challenge data from the device at operation 904 and starts a new period at operation 906, after which process 900 returns to operation 902.

[0123] With reference to Fig. 8. During operation 802, an authentication screen may be displayed on the screen of a computer device (e.g., computer device 210-1, 210-2, or 210-3). The authentication screen may present a user with a locked screen that prevents users from accessing at least one application on the computer device or on another device (e.g., server 220) with which the computer device is configured to communicate, and / or may prevent users from accessing sensitive data stored on the computer device or on another device (e.g., server 220). For example, the computer device's operating system or firmware may include a lock screen functionality configured to implement the authentication screen.In one example, the operating system's lock screen functionality of the computer device may be disabled, and the authentication screen may be an application installed on the computer device, for example, during a deployment process in an enterprise system. In another example, the authentication screen may allow a user to scan a physical medium (e.g., physical medium 162) containing encrypted data. As described herein, the encrypted data may include challenge data, such as biometric characteristics and / or a user-specific passcode, which must be met before a user is authenticated and granted access to the computer device (e.g., physical medium 162).Access to certain applications and / or data) may be provided, user identification data that can be used to determine the user's identity, such as a user ID, SSO login credentials for establishing an SSO session, device configuration data for personalized configuration of the computer device, and / or other information. Operation 804 may capture live biometric data of the user from the computer device (for example, via a biometric capture device, such as the image capture device 254, a fingerprint scanner 256, a retinal scanner 258, a microphone 260, or another biometric capture device). In an example, the biometric capture device could be an image capture device that captures a picture of the user's face.In Operation 806, the computer device's processor extracts a live biometric feature from the captured live biometric data. For example, the biometric capture device might image a user's face as the live biometric data, and one or more of the user's facial features could be extracted from the image. In Operation 808, the computer device's processor determines whether challenge data, one or more biometric features, were previously stored by the computer device. For example, the computer device's processor might be programmed to store the biometric feature(s) obtained from a physical medium for the last user authenticated by the computer device.The stored biometric feature(s) of the last authenticated user can be stored for a configurable period according to . Fig. 9. The stored biometric feature(s) are deleted from the computer device when the period expires or is reset. If the computer device has a stored biometric feature, the computer device's processor compares the stored biometric feature with the captured live biometric feature during Operation 810. If the computer device's processor determines that the stored biometric feature matches the captured live biometric feature (during Operation 812), the user is successfully authenticated and granted access to the computer device during Operation 814.

[0124] If no match is found (at Operation 812), the computer device processor may, at Operation 816, delete the previously stored biometric feature(s) and, at Operation 818, scan a physical medium assigned to the user to capture biometric data, including a biometric feature, from the physical medium. Likewise, if the computer device processor determines that no stored biometric features are present on the computer device (at Operation 808), Operation 800 may proceed to Operation 818. For example, the computer device may scan / read the encrypted data from the physical medium and decrypt the encrypted data. For example, the data capture device may be an image capture device (e.g., Image Capture Device 254) or a barcode scanning machine (e.g., Barcode Scanning Machine 264) operated by a processor (e.g.,The processor 212) of the computer device can be controlled automatically and / or in response to user input (e.g., receiving a selection from a physical or virtual button). The image capture device or barcode scanning machine can map an encoded data form onto the physical medium that encodes the encrypted data. As another example, the data capture device can be a radio frequency reader (e.g., the RF reader 266) that can be controlled by the device's processor to query a radio frequency label on the physical medium with a radio frequency signal automatically and / or in response to user input (e.g., receiving a selection from a physical or virtual button). The radio frequency label can respond to the query by outputting the encoded data to the radio frequency reader.In process 820, the live biometric feature is compared with the biometric feature captured from the physical medium. If there is no match (in process 822), process 800 proceeds to process 824, where authentication fails. If the user is not authenticated (in process 822), process 800 may return to process 802. If there is a match between the biometric feature captured from the physical medium and the live biometric feature (in process 822), the computer device's processor successfully authenticates the user and stores the biometric feature obtained from the physical medium on the computer device in process 826.In some embodiments, if no match is found (in process 822), the computer device may compare a passcode received from the user with the user-specific passcode contained in the data obtained from the physical medium, as described herein, before authentication fails (e.g., as in ). Fig. 6 and Fig. (described in section 7). In process 828, the computer device's processor can reset the time period, if one exists, which terminates the process. Fig. 9 can trigger to delete the stored biometric feature(s) and start a new period. In process 814, the user may be granted access to the computer device. Once the user is granted access to the computer device, process 800, in some embodiments, may provide the setup of an SSO session for the user in a manner described herein (e.g., as in Fig. 6 and / or Fig. 7 described).

[0125] In Operation 830, the computer device's processor can configure the device based on device configuration data obtained from the physical medium or from a remote device (such as Server 120 or 220), if available. For example, the computer device can retrieve a recorded device configuration interface from the user who inputs the device configuration data. This data can be retrieved by the computer device based on a unique Universal Resource Locator (URL) and a tenant identifier obtained from the physical medium. After retrieving the recorded interface, the computer device can use key and touch injection to configure the computer device based on the device configuration data entered into the recorded interface.

[0126] In operation 832, the computer device or another device (e.g., server 120) in communication with the computer device can track the device's usage and associate that usage with the computer device's user based on the user identifier contained in the encrypted data captured from the physical medium. The computer device usage and its association with the user can be recorded in a log and / or data archive (e.g., database 130, which is located in Fig. 2 is shown) to be saved.

[0127] In process 834, the computer device's processor can determine whether a screen lock event has occurred. If not, process 800 can repeat process 832. If it is determined that a screen lock event has occurred, process 800 can return to process 802 to display the authentication screen on the computer device's display in order to lock users from the computer device.

[0128] In some embodiments, process 800 may be free of process 828, so that the current period continues until it expires, before the stored biometric feature(s) are retrieved from the computer device via process 900. Fig. 9 is / will be deleted. As an example, a first user may have previously been authenticated by the device, and the first user's biometric feature(s) may be stored by the device for an initial period (e.g., an 8-hour period). Some time later (e.g., 4 hours later) during the initial period, the first user may stop using the computer device, triggering a screen lock event (e.g., because the device was idle for a certain period). While some time remains during the initial period (e.g., 4 hours remain), a second user may be authenticated by the computer device. Process 800 may store the second user's biometric feature for the remainder of the initial configurable period, and when the initial configurable period expires (e.g.,(after 4 hours), the stored biometric feature(s) of the second user can be deleted from the computer device, so that the next time the authentication screen is displayed after the first period has expired, the second user would have to scan the physical medium to be authenticated because the computer device no longer stores the user's biometric feature(s).

[0129] Although Fig. 8 exemplary processes of the authentication process 800 are illustrated and Fig. 9 illustrates an exemplary timing process that runs parallel to Fig. 8. When operating, the authentication process and / or the timing process may involve more or fewer operations and / or the operations may be carried out in different sequences or combinations.

[0130] The following examples, which can be used in combination with any other examples or combinations of examples described herein, are not limiting and are provided for illustrative purposes.

[0131] Example 1. Comprehensive procedure: Displaying an authentication screen on a computer device display, wherein the authentication screen prevents access to at least one application via the computer device; Scanning, by the computer device, of a physical medium located outside and independent of the computer device to capture challenge data for a user from the physical medium; Capture, by the computer device, response data from the user; Determine whether the response data matches the challenge data; and In response to a successful match, the authentication screen is removed from the display and access to at least one application is granted.

[0132] Example 2. The procedure according to Example 1, further comprising deleting the challenge data and the response data from the computer device after determining whether the response data matches the challenge data.

[0133] Example 3. Procedure according to one of Examples 1-2, further comprising: Play the authentication screen after a lock screen event occurs; Rescanning, by the computer device, of the physical medium to recapture challenge data for the user from the physical medium; recapture, by the computer device, of response data from the user; Determine whether the re-collected response data matches the re-collected challenge data; and In response to another successful match, the authentication screen is removed from the display and access to at least one application is granted.

[0134] Example 4. Procedure according to one of Examples 1 and 3, further comprising: Deleting the response data from the computer device after determining whether the response data matches the challenge data; Encrypting the challenge data; Storing the encrypted challenge data in the computer device for a period of time; and Delete challenge data when the time period expires or is reset.

[0135] Example 5. Procedure according to one of Examples 1 and 3-4, further comprising: Play the authentication screen after a lock screen event occurs; Determine whether the encrypted challenge data is stored in the computer device; bypass a physical medium scanning operation in response to the determination that the encrypted challenge data is stored; re-capture, by the computer device, response data from the user; Determine whether the recaptured response data matches the challenge data; and In response to another successful match, the authentication screen is removed from the display and access to at least one application is granted.

[0136] Example 6. Procedure according to one of Examples 1-5, wherein the challenge data corresponds to previously captured biometric data for the user encoded on the physical medium, and the response data corresponds to live biometric data of the user.

[0137] Example 7. Method according to any of Examples 1-5, wherein the challenge data corresponds to a previously created passcode encoded on the physical medium, and the response data corresponds to a user-entered passcode received by the computer device via a user interface.

[0138] Example 8. A method according to any of Examples 1-7, wherein the challenge data corresponds to previously captured biometric data for the user and a previously generated passcode encoded on the physical medium, and the response data corresponds to live biometric data of the user and a user-entered passcode received by the computer device via a user interface, and the determination of whether the response data matches the challenge data comprises: Determine whether at least one of (i) the live biometric data matches the previously captured biometric data for the user encoded on the physical medium, or (ii) the user-entered passcode matches the previously generated passcode encoded on the physical medium.

[0139] Example 9. Procedure according to one of Examples 1-8, further comprising: Disabling a lock screen function of the computer device; and Execution, by the computer device, of an authentication application that displays the authentication screen instead of the lock screen function, wherein the authentication application is implemented in a lock task mode.

[0140] Example 10. Method according to any of Examples 1-9, wherein a user identifier is captured from the physical medium in response to scanning the physical medium, and the method in response to successful matching further comprises: Identifying the user who was authenticated via the authentication screen, based on the user ID; and Linking operations performed by the computer device with the user ID.

[0141] Example 11. Procedure according to one of Examples 1-10, further comprising: Receiving individual login credentials from the user in response to successful matching; and Setting up a single login session for the user with the individual login credentials.

[0142] Example 12. Procedure according to Example 11, wherein the processor requires the user to provide each login credential every time the authentication screen is displayed.

[0143] Example 13. Procedure according to Example 11, further comprising: Displaying the authentication screen in response to a lock screen event; Maintaining the individual login session for the user; In response to the authentication of a next user based on challenge data and response data associated with the next user, determine whether the next user is the same as the user who was last authenticated to the computer device or another user; In response to the fact that the next user matches the user, allow the next user to use the single login session; and In response to the fact that the next user is the same as the other user, the individual login session is terminated and new individual login credentials are requested for the next user in order to establish a new individual login session.

[0144] Example 14. Procedure according to Example 13, wherein the next user is the user, a single login username is captured from the physical medium for the user in response to scanning the physical medium, and determining that the next user is the user involves comparing the single login username captured from the physical medium with a single login username associated with the single login session.

[0145] Example 15. Procedure according to Example 11, further comprising: Displaying the authentication screen in response to a lock screen event; maintaining a set of login sessions for a multitude of users of the computer device, the multitude of users including the user; In response to the authentication of a next user based on challenge data and response data associated with the next user, determine the identity of the next user; determine whether the computer device maintains an active single login session for the next user based on the next user's identity; in response to determining that the active single login session exists for the next user, selecting the active single login session that corresponds to the identity of the next user, and allowing the next user to use the active single login session; and In response to the determination that the active single login session does not exist for the next user, request new single login credentials for the next user to establish a new single login session.

[0146] Example 16. Method according to Example 15, wherein the challenge data and a single login username for the next user are captured from a physical medium associated with the next user, the response data for the next user are captured from the user, the identity of the user is determined based on the single login username, and determining whether the computer device maintains an active single login session for the next user includes comparing the single login username captured from the physical medium with a plurality of single login usernames associated with the individual login sessions in the set.

[0147] Example 17. Procedure according to one of Examples 11 and 13-16, further comprising: Encrypting the individual login credentials; Storing the encrypted individual login credentials; Retrieving and decrypting the encrypting individual login credentials in response to a request to establish a new individual login session for the user; and Use the individual login credentials to set up the new individual login session for the user.

[0148] Example 18. Method according to one of Examples 1-17, comprising scanning the physical medium: Image representation of at least one coded data form arranged on a substrate of the physical medium, via an image capture device or a barcode scanning machine of the computer device.

[0149] Example 19. Method according to one of Examples 1-18, comprising scanning the physical medium: Queries of at least one radio frequency label carried on a substrate of the physical medium.

[0150] Example 20. Method according to any of Examples 1-19, wherein the capture of response data comprises the capture of live biometric data of the user via at least one of an image capture device, a fingerprint scanner, a retinal / iris scanner or a microphone of the computer device.

[0151] Example 21. Procedure according to one of Examples 1-20, further comprising: Creating challenge data for the user during a login process; Encrypting the challenge data; and Transferring the encrypted challenge data to the physical medium by at least one of printing one or more coded data forms onto the physical medium containing the challenge data, or encoding one or more radio frequency labels of the physical medium with the challenge data.

[0152] Example 22. Procedure according to one of Examples 1-21, further comprising: Configuring the computer device based on device configuration data acquired from the physical medium or from a server based on a Universal Resource Locator acquired from the physical medium.

[0153] Example 23. Computer device, comprising: an advertisement; a variety of data acquisition devices; a non-transitory, computer-readable medium configured to store instructions; a processor that is operationally coupled with the display and the multitude of sensing devices, wherein the processor is configured to execute the instructions for: Displaying an authentication screen on the display, where the authentication screen prevents access to at least one application via the processor; Scanning, via a first data acquisition device of the plurality of data acquisition devices, of a physical medium located outside and independent of the computer device to capture challenge data for a user from the physical medium; Capturing response data from the user via the first data acquisition device or a second data acquisition device of the plurality of data acquisition devices; Determine whether the response data matches the challenge data; and In response to a successful match, the authentication screen is removed from the display and access to at least one application is granted.

[0154] Example 24. Computer device according to Example 23, wherein the processor is configured to delete the challenge data and the response data from the non-transitory computer-readable medium after determining whether the response data matches the challenge data.

[0155] Example 25. Computer device according to one of Examples 23-24, wherein the processor is configured to: Displaying the authentication screen on the screen after a lock screen event occurs; rescanning the physical medium to recapture challenge data for the user from the physical medium via the initial data acquisition device; Re-capturing the response data from the user via the first or second data capture device; Determine whether the re-collected response data matches the re-collected challenge data; and In response to another successful match, the authentication screen is removed from the display and access to at least one application is granted.

[0156] Example 26. Computer device according to one of Examples 23 and 25, wherein the processor is configured to: Deleting the response data from the non-transitory computer-readable medium after determining whether the response data matches the challenge data; Encrypting the challenge data; Storing the encrypted challenge data in the non-transitory, machine-readable medium for a period of time; and Delete challenge data when the time period expires or is reset.

[0157] Example 27. Computer device according to one of Examples 23 and 25-26, wherein the processor is configured to: Play the authentication screen after a lock screen event occurs; Determine whether the encrypted challenge data is stored in the non-transitory, machine-readable medium; Bypassing the process of scanning the physical medium in response to the determination that the encrypted challenge data is stored; Re-capturing the response data from the user via the first or second data capture device; Determine whether the recaptured response data matches the challenge data stored in the non-transitory computer-readable medium; and In response to another successful match, the authentication screen is removed from the display and access to at least one application is granted.

[0158] Example 28. Computer device according to one of Examples 23-27, wherein the challenge data correspond to previously acquired biometric data for the user encoded on the physical medium, and the response data correspond to live biometric data of the user.

[0159] Example 29. Computer device according to any of Examples 23-27, wherein the challenge data corresponds to a previously created passcode encoded on the physical medium, and the response data corresponds to a user-entered passcode received by the computer device via a user interface.

[0160] Example 30. Computer device according to any of Examples 23-29, wherein the challenge data corresponds to previously captured biometric data for the user and a previously generated passcode encoded on the physical medium, and the response data corresponds to live biometric data of the user and a user-entered passcode received by the computer device via a user interface, and the processor is configured to determine whether the response data matches the challenge data based on a determination of whether at least one of (i) the live biometric data matches the previously captured biometric data for the user encoded on the physical medium, or (ii) the user-entered passcode matches the previously generated passcode encoded on the physical medium.

[0161] Example 31. Computer device according to one of Examples 23-30, wherein the processor is configured to: Disabling a lock screen function of the computer device; and Running an authentication application that displays the authentication screen instead of the lock screen function, where the authentication application is implemented in a lock task mode.

[0162] Example 32. Computer device according to any of Examples 23-31, wherein a user identifier is captured from the physical medium in response to scanning the physical medium, and the processor is configured in response to the successful match to: Identifying the user who was authenticated via the authentication screen, based on the user ID; and Linking operations performed by the computer device with the user ID.

[0163] Example 33. Computer device according to one of Examples 23-32, wherein the processor is configured to: Receiving individual login credentials from the user in response to successful matching; and Setting up a single login session for the user with the individual login credentials.

[0164] Example 34. Computer device according to Example 33, wherein the processor is configured to require the user to provide each login credential each time the authentication screen is displayed.

[0165] Example 35. Computer device according to Example 33, wherein the processor is configured to: Displaying the authentication screen in response to a lock screen event; maintaining the individual login session for the user; In response to the authentication of a next user based on challenge data and response data associated with the next user, determine whether the next user is the same as the user who was last authenticated to the computer device or another user; In response to the fact that the next user matches the user, allow the next user to use the single login session; and In response to the fact that the next user is the same as the other user, the individual login session is terminated and new individual login credentials are requested for the next user in order to establish a new individual login session.

[0166] Example 36. Computer device according to Example 35, wherein the next user is the user, a single login username is captured from the physical medium for the user in response to scanning the physical medium, and determining that the next user is the user involves comparing the single login username captured from the physical medium with a single login username associated with the single login session.

[0167] Example 37. Computer device according to Example 33, wherein the processor is configured to: Displaying the authentication screen in response to a lock screen event; maintaining a set of login sessions for a multitude of users of the computer device, the multitude of users including the user; In response to the authentication of a next user based on challenge data and response data associated with the next user, determine the identity of the next user; determine whether the computer device maintains an active single login session for the next user based on the next user's identity; in response to determining that the active single login session exists for the next user, selecting the active single login session that corresponds to the identity of the next user, and allowing the next user to use the selected active single login session; and In response to the determination that the active single login session does not exist for the next user, request new single login credentials for the next user to establish a new single login session.

[0168] Example 38. Computer device according to Example 37, wherein the challenge data and a single login username for the next user are captured from a physical medium associated with the next user, the response data for the next user are captured from the user, the identity of the user is determined based on the single login username, and wherein the processor is configured to determine whether an active single login session is maintained for the next user by comparing the single login username captured from the physical medium with a plurality of single login usernames associated with the individual login sessions in the set.

[0169] Example 39. Computer device according to one of Examples 33 and 35-38, wherein the processor is configured to: Encrypting the individual login credentials; Storing the encrypted individual login credentials; Retrieving and decrypting the encrypting individual login credentials in response to a request to establish a new individual login session for the user; and Use the individual login credentials to set up the new individual login session for the user.

[0170] Example 40. Computer device according to any of Examples 23-39, wherein the first data acquisition device is an image acquisition device or a barcode scanning machine and the processor is configured to scan the physical medium by imaging at least one encoded data form arranged on a substrate of the physical medium via the image acquisition device or the barcode scanning machine.

[0171] Example 41. Computer apparatus according to any of Examples 23-40, wherein the first data acquisition device is a radio frequency reader and the processor is configured to scan the physical medium by querying at least one radio frequency label borne by a substrate of the physical medium.

[0172] Example 42. Computer device according to any of Examples 23-41, wherein the first or second data acquisition device is an image acquisition device, a fingerprint scanner, a retinal / iris scanner or a microphone.

[0173] Example 43. Computer device according to one of Examples 23-42, wherein the processor is configured to: Creating challenge data for the user during a login process; Encrypting the challenge data; and Transferring the encrypted challenge data to the physical medium by at least one of printing one or more coded data forms onto the physical medium containing the challenge data, or encoding one or more radio frequency labels of the physical medium with the challenge data.

[0174] Example 44. Computer device according to one of Examples 23-43, wherein the processor is configured to: Configuring the computer device based on device configuration data acquired from the physical medium or from a server based on a Universal Resource Locator acquired from the physical medium.

[0175] Example 45. Non-transitory computer-readable medium comprising instructions, wherein the execution of the instructions by a processing device causes the processing device to: Displaying an authentication screen on the display, where the authentication screen prevents access to at least one application via the processor; Scanning, via a first data acquisition device of the plurality of data acquisition devices, of a physical medium located outside and independent of the computer device to capture challenge data for a user from the physical medium; Capturing response data from the user via the first data acquisition device or a second data acquisition device of the plurality of data acquisition devices; Determine whether the response data matches the challenge data; and In response to a successful match, the authentication screen is removed from the display and access to at least one application is granted.

[0176] The foregoing description refers to diagrams in the accompanying drawings. Alternative implementations of the example depicted in the diagrams include one or more additional or alternative elements, processes, and / or devices. Additionally or alternatively, one or more of the exemplary elements in the diagram may be combined, split, rearranged, or omitted.

[0177] Specific embodiments have been described in the preceding specification. However, a person skilled in the art will recognize that various modifications and changes can be made without departing from the scope of the invention, as set forth in the following claims. Accordingly, the specification and the figures are to be considered illustrative rather than limiting, and all such modifications are to be included within the scope of the present teachings. In addition, the described embodiments / examples / implementations should not be interpreted as mutually exclusive and should instead be understood as potentially combinable, where such combinations are in any way permissive.In other words, any feature disclosed in any one of the above embodiments / examples / implementations may be included in any one of the other above embodiments / examples / implementations.

[0178] The benefits, advantages, problem solutions, and any element(s) that may lead to or enhance a benefit, advantage, or solution shall not be construed as critical, necessary, or essential features or elements of any claim or all claims. The claimed invention is defined exclusively by the attached claims, including all amendments made during the pendency of this application and all equivalents of these claims, as granted.

[0179] Furthermore, in this document, relational expressions such as first and second, top and bottom, and the like may be used solely to distinguish one entity or action from another, without necessarily requiring or implying any actual relationship or order of such entities or actions. The expressions "includes," "comprising," "has," "exhibiting," "include," "containing," "including," "containing," or any other variation thereof are intended to cover non-exclusive inclusion, such that a process, procedure, article, or device that includes, has, includes, or contains a list of elements may not only include those elements but may also include other elements not expressly listed or inherent in such process, procedure, article, or device. An element that "includes," "has," or "includes"The phrase "...a", "includes ...a", or "contains ...a" preceding a statement does not, without further limitations, exclude the existence of additional identical elements in the process, method, article, or apparatus that includes, has, incorporates, or contains the element. The terms "a" and "a" are defined as one or more unless expressly stated otherwise herein. The terms "essentially", "generally", "approximately", "about", or any other version thereof are defined in a manner that would be closely understood by a person skilled in the art, and in one non-restrictive embodiment, the term is defined as being within 10%, in another embodiment within 5%, in another embodiment within 1%, and in yet another embodiment within 0.5%.The term "coupled," as used herein, is defined as connected, although not necessarily directly and not necessarily mechanically. A device or structure that is "configured" in a particular way is configured at least in that way, but may also be configured in ways not listed.

[0180] The summary of disclosure is provided to enable the reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it is not intended to interpret or limit the scope or meaning of the claims. Additionally, it is clear from the preceding detailed description that various features in different embodiments have been summarized for the purpose of simplifying the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments require more features than are expressly stated in each claim. Rather, as the following claims reflect, an inventive subject matter may be contained in fewer than all the features of any single disclosed embodiment.Therefore, the following claims are hereby included in the detailed description, with each claim standing alone as a separately claimed subject matter. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] US 63 / 461800

[0001] US 18 / 643.000

[0001]

Claims

[1] Procedure, encompassing: Displaying an authentication screen on a computer device display, wherein the authentication screen prevents access to at least one application via the computer device; Scanning, by the computer device, of a physical medium located outside of and independent from the computer device, in order to capture challenge data for a user from the physical medium; Capture, by the computer device, response data from the user; Determine whether the response data matches the challenge data; and In response to a successful match, the authentication screen is removed from the display and access to at least one application is granted. [2] Method according to claim 1, further comprising: Deleting the challenge data and the response data from the computer device after determining whether the response data matches the challenge data; Play the authentication screen after a lock screen event occurs; Rescanning, by the computer device, of the physical medium to recapture challenge data for the user from the physical medium; recapture, by the computer device, of response data from the user; Determine whether the re-collected response data matches the re-collected challenge data; and In response to another successful match, the authentication screen is removed from the display and access to at least one application is granted. [3] Method according to claim 1, further comprising: Encrypting the challenge data; Storing the encrypted challenge data in the computer device for a period of time; and Delete challenge data when the time period expires or is reset. [4] The method of claim 3, further comprising: Play the authentication screen after a lock screen event occurs; Determine whether the encrypted challenge data is stored on the computer device; Bypassing the process of scanning the physical medium in response to the determination that the encrypted challenge data is stored; recapture, by the computer device, of response data from the user; Determine whether the recaptured response data matches the challenge data; and In response to another successful match, the authentication screen is removed from the display and access to at least one application is granted. [5] The method of claim 1, wherein the challenge data corresponds to previously acquired biometric data for the user and a previously generated passcode encoded on the physical medium, and the response data corresponds to live biometric data of the user and a user-entered passcode received by the computer device via a user interface, and comprising determining whether the response data matches the challenge data: Determine whether at least one of (i) the live biometric data matches the previously captured biometric data for the user encoded on the physical medium, or (ii) the user-entered passcode matches the previously generated passcode encoded on the physical medium. [6] Method according to claim 1, wherein a user identifier is captured from the physical medium in response to scanning the physical medium, and the method further comprises, in response to successful matching: Identifying the user who was authenticated via the authentication screen, based on the user ID; and Linking operations performed by the computer device with the user ID. [7] Method according to claim 1, further comprising: Receiving individual login credentials from the user in response to successful matching; and Setting up a single login session for the user with the individual login credentials. [8] Method according to claim 7, wherein the processor requires the user to provide the individual login credentials each time the authentication screen is displayed. [9] The method of claim 7, further comprising: Displaying the authentication screen in response to a lock screen event; Maintaining the individual login session for the user; In response to the authentication of a next user based on challenge data and response data associated with the next user, determine whether the next user is the same as the user who was last authenticated to the computer device or another user; In response to the fact that the next user matches the user, allow the next user to use the single login session; and In response to the fact that the next user is the same as the other user, the individual login session is terminated and new individual login credentials are requested for the next user in order to establish a new individual login session. [10] Method according to claim 9, wherein the next user is the user, a single login username is captured from the physical medium for the user in response to scanning the physical medium, and determining that the next user corresponds to the user comprises comparing the single login username captured from the physical medium with a single login username associated with the single login session. [11] The method of claim 7, further comprising: Displaying the authentication screen in response to a lock screen event; Maintaining a set of login sessions for a multitude of users of the computer device, wherein the multitude of users includes the user; In response to the authentication of a next user based on challenge data and response data associated with the next user, determining the identity of the next user; Determine whether the computer device maintains an active single login session for the next user, based on the identity of the next user; in response to determining that the active single login session exists for the next user, selecting the active single login session that corresponds to the identity of the next user, and allowing the next user to use the active single login session; and In response to the determination that the active single login session does not exist for the next user, request new single login credentials for the next user to establish a new single login session. [12] Method according to claim 11, wherein the challenge data and a single login username for the next user are captured from a physical medium associated with the next user, the response data for the next user are captured from the user, the identity of the user is determined based on the single login username, and determining whether the computer device maintains an active single login session for the next user comprises comparing the single login username captured from the physical medium with a plurality of single login usernames associated with the individual login sessions in the set. [13] Method according to claim 7, further comprising: Encrypting the individual login credentials; Storing the encrypted individual login credentials; Retrieving and decrypting the encrypting individual login credentials in response to a request to establish a new individual login session for the user; and Use the individual login credentials to set up the new individual login session for the user. [14] Method according to claim 1, wherein the scanning of the physical medium comprises at least one of: Representing at least one coded data form arranged on a substrate of the physical medium via an image capture device or a barcode scanning machine of the computer device; or Queries of at least one radio frequency label carried on a substrate of the physical medium. [15] Method according to claim 1, further comprising: Creating challenge data for the user during a login process; Encrypting the challenge data; and Transferring the encrypted challenge data to the physical medium by at least one of printing one or more coded data forms onto the physical medium containing the challenge data, or encoding one or more radio frequency labels of the physical medium with the challenge data. [16] The method of claim 1, further comprising: Configuring the computer device based on device configuration data acquired from the physical medium or from a server based on a Universal Resource Locator acquired from the physical medium. [17] Computer device comprising: an advertisement; a variety of data acquisition devices; a non-transitory, computer-readable medium configured to store instructions; a processor that is operationally coupled with the display and the multitude of sensing devices, wherein the processor is configured to execute the instructions for: Displaying an authentication screen on the screen, where the authentication screen prevents access to at least one application via the processor; Scanning, via a first data acquisition device of the plurality of data acquisition devices, of a physical medium that is outside the computer device and is independent of it, to capture challenge data for a user from the physical medium; Capturing response data from the user via the first data acquisition device or a second data acquisition device of the plurality of data acquisition devices; Determine whether the response data matches the challenge data; and In response to a successful match, the authentication screen is removed from the display and access to at least one application is granted.

Images