EP2083399A1 - Procédé, système et dispositif mobile utilisant une authentification améliorée de l'utilisateur - Google Patents

Procédé, système et dispositif mobile utilisant une authentification améliorée de l'utilisateur Download PDF

Info

Publication number
EP2083399A1
EP2083399A1 EP08150681A EP08150681A EP2083399A1 EP 2083399 A1 EP2083399 A1 EP 2083399A1 EP 08150681 A EP08150681 A EP 08150681A EP 08150681 A EP08150681 A EP 08150681A EP 2083399 A1 EP2083399 A1 EP 2083399A1
Authority
EP
European Patent Office
Prior art keywords
authenticator
authentication
authenticators
computing device
user
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
EP08150681A
Other languages
German (de)
English (en)
Other versions
EP2083399B1 (fr
Inventor
Neil Adams
Richard Sibley
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
BlackBerry Ltd
Original Assignee
Research in Motion Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Research in Motion Ltd filed Critical Research in Motion Ltd
Priority to EP08150681.8A priority Critical patent/EP2083399B1/fr
Priority to CA2647309A priority patent/CA2647309C/fr
Publication of EP2083399A1 publication Critical patent/EP2083399A1/fr
Application granted granted Critical
Publication of EP2083399B1 publication Critical patent/EP2083399B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/30—Individual registration on entry or exit not involving the use of a pass
    • G07C9/32—Individual registration on entry or exit not involving the use of a pass in combination with an identity check
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/20—Individual registration on entry or exit involving the use of a pass
    • G07C9/22—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C2209/00—Indexing scheme relating to groups G07C9/00 - G07C9/38
    • G07C2209/14—With a sequence of inputs of different identification information

Definitions

  • the described embodiments relate to methods, systems and mobile devices employing enhanced user authentication.
  • the described embodiments enable configuration of the mobile device for use of multiple different authenticators consecutively to allow authorized access to the mobile device.
  • authentication of a user for access to the mobile device or computing device is an important part of securing the device against unauthorized access to potentially sensitive data.
  • Some existing computer operating systems allow installation of multiple authenticators on the computer system so that, when a user is authenticating the user's authority to access the computer, the user can choose one of the installed authenticators to perform the authentication and thereby gain access to the computer system. In such operating systems, each time the user wishes to authenticate itself to the computer system, the user can choose a different authenticator from among the installed authenticators.
  • a method for user authentication for a computing device comprising: enabling receipt of input in relation to selection of a plurality of authenticators for consecutive use by the computing device to authenticate access to the computing device or data stored therein; and storing reference information identifying a selected plurality of authenticators in a memory of the computing device.
  • a method of user authentication for a computing device comprising: determining that user authentication is required to be performed in relation to the computing device or data stored therein; retrieving from a memory of the computing device reference information identifying a plurality of authenticators for consecutive use to perform the user authentication; performing a first authentication using a first authenticator of the plurality of authenticators; performing a next authentication using a next authenticator of the plurality of authenticators if the first authentication is successful; and allowing access to the computing device or data stored therein if the next authentication is successful.
  • FIG. 1 is a block diagram of a system for authenticating a user
  • FIG. 2 is a block diagram of a mobile device for use in the system of FIG. 1 ;
  • FIG. 3 is a block diagram of a memory card reader for use in some embodiments of the system of FIG. 1 ;
  • FIG. 4 is a block diagram showing user authentication components of the mobile device in further detail
  • FIG. 5 is a flowchart of a method of user authenticator configuration
  • FIG. 6 is an example of an authenticator configuration window displayable on the mobile device.
  • FIG. 7 is a flowchart of a method of user authentication.
  • the existing computer operating systems described above only allow a single one of the authenticators to be chosen for performing the authentication of the user. If any one of the authenticators installed on the computer system is insecure, this compromises the security of the entire system because an unauthorized user may be able to gain access to the computer system using the insecure authenticator.
  • the described embodiments relate generally to methods, systems and mobile devices employing enhanced user authentication. Further embodiments relate generally to computing devices that employ enhanced user authentication. Mobile devices are used herein as one example of a type of computing device.
  • the enhanced user authentication involves configuring the mobile device (or other computing device) to require authentication by the user using multiple consecutive authenticators.
  • the order of authentication may be selected by a user or system administrator during the authenticator configuration. Use of multiple authenticators in a predetermined order increases the security of the mobile device (or other computing device) by adding further authentication layers and thereby reducing the possibility of unauthorized access to the device.
  • the authenticators may include, for example, smart card, fingerprint, handprint, facial image, retinal, iris, voice, DNA, and/or other authenticators.
  • the user or system administrator may configure the mobile device to employ any of the multiple authenticators in combination, in a specific order. If it is considered that a particular one of the authenticators is essential for optimizing security, that authenticator can be used as part of a combination of authenticators. For example, it may be specified by the system administrator that each mobile device must use a smart card authenticator, together with one or more of the fingerprint, handprint, facial image, retinal, iris, voice, DNA and/or other authenticators. Alternatively, authenticator configuration may be done without reference to any of the authenticators being considered to be essential to the authentication procedure, and the user may simply choose two or more of the installed authenticators to be used in combination.
  • Certain embodiments relate to a method for user authentication for a computing device.
  • the method comprises: enabling receipt of input in relation to selection of a plurality of authenticators for consecutive use by the computing device to authenticate access to the computing device or data stored therein; and storing reference information identifying the selected plurality of authenticators in a memory of the computing device.
  • the computing device may comprise a mobile device.
  • the input may be received in relation to a required authenticator selection and at least one optional authenticator selection.
  • the input may be in relation to a selected order of consecutive use of the plurality of authenticators to authenticate access to the computing device or data stored therein and the storing may comprise storing order-of-use information in the memory that identifies the selected order.
  • the plurality of authenticators may be selected from the group consisting of: a smart card authenticator; a fingerprint authenticator; a handprint authenticator; an iris authenticator; a DNA authenticator; a voice authenticator; a retinal authenticator; and a facial image authenticator.
  • the enabling may comprise launching an authenticator configuration application to display an authenticator configuration window on a display of the computing device and the authenticator configuration window may comprise a plurality of selectable authenticator options, each selectable authenticator option corresponding to a respective one of the plurality of authenticators.
  • the selectable authenticator options may be displayed in the authenticator configuration window to indicate an order of consecutive use of the plurality of authenticators, and the selectable authenticator options can be displayed to indicate an alternative order of consecutive use of the plurality of authenticators in response to the input.
  • Other embodiments relate to a method of user authentication for a computing device.
  • the method comprises: determining that user authentication is required to be performed in relation to the computing device or data stored therein; retrieving from a memory of the computing device reference information identifying a plurality of authenticators for consecutive use to perform the user authentication; performing a first authentication using a first authenticator of the plurality of authenticators; performing a next authentication using a next authenticator of the plurality of authenticators if the first authentication is successful; and allowing access to the computing device or data stored therein if the next authentication is successful.
  • the first and next authentications may be performed in a predetermined order based on the reference information.
  • the plurality of authenticators may be selected from the group consisting of: a smart card authenticator; a fingerprint authenticator; a handprint authenticator; an iris authenticator; a DNA authenticator; a voice authenticator; a retinal authenticator; or a facial image authenticator.
  • Other embodiments relate to a method of user authentication for a computing device.
  • the method comprises: determining that user authentication is required to be performed in relation to the computing device or data stored therein; retrieving from a memory of the computing device reference information identifying a plurality of authenticators for consecutive use to perform the user authentication; performing a first authentication using a first authenticator of the plurality of authenticators; performing a next authentication using a next authenticator of the plurality of authenticators; and allowing access to the computing device or data stored therein if the first authentication is successful and the next authentication is successful.
  • a computing device comprising: a processor; a display responsive to the processor; at least one communication subsystem responsive to the processor for communicating with a plurality of authentication devices; input componentry communicably coupled to the processor; and a memory.
  • the memory is accessible to the processor and stores program code which, when executed by the processor, causes the processor to enable receipt of input from the input componentry in relation to selection of a plurality of authenticators for consecutive use to authenticate a user, and to store in the memory reference information identifying the selected plurality of authenticators.
  • the plurality of authenticators may be selected from the group consisting of: a smart card authenticator; a fingerprint authenticator; a handprint authenticator; an iris authenticator; a DNA authenticator; a voice authenticator; a retinal authenticator; and a facial image authenticator.
  • the input may be received in relation to a required authenticator selection and at least one optional authenticator selection.
  • the input may be further in relation to a selected order of consecutive use of the plurality of authenticators to authenticate the user and the processor may store order-of-use information in the memory that identifies the selected order.
  • the processor when the program code is executed by the processor, the processor is further caused to launch an authenticator configuration application to display an authenticator configuration window on the display, wherein the authenticator configuration window comprises a plurality of selectable authenticator options, each selectable authenticator option corresponding to a respective one of the plurality of authenticators.
  • the selectable authenticator options may be displayed in the authenticator configuration window to indicate an order of consecutive use of the plurality of authenticators, and the selectable authenticator options can be displayed to indicate an alternative order of consecutive use of the plurality of authenticators in response to the input.
  • the memory of the computing device may further store program code which, when executed by the processor, causes the process to: determine that user authentication is required to be performed in relation to the computing device or data stored therein; retrieve from the memory the reference information; perform a first authentication using a first authenticator of the plurality of authenticators, wherein the first authenticator is identified by the reference information; perform a next authentication using a next authenticator of the plurality of authenticators if the first authentication is successful, wherein the next authenticator is identified by the reference information; and allow access to the computing device or data stored therein if the next authentication is successful.
  • the first and next authentications may be performed in a predetermined order based on the reference information.
  • Still other embodiments relate to a computing device comprising: a processor; at least one communication subsystem responsive to the processor for communicating with a plurality of authentication devices; and a memory accessible to the processor.
  • the memory stores program code which, when executed by the processor, causes the processor to: determine that user authentication is required to be performed in relation to the computing device or data stored therein; retrieve from a memory of the computing device reference information identifying a plurality of authenticators for consecutive use to perform the user authentication; perform a first authentication using a first authenticator of the plurality of authenticators; perform a next authentication using a next authenticator of the plurality of authenticators if the first authentication is successful; and allow access to the computing device or data stored therein if the next authentication is successful.
  • the program code when executed by the processor, may cause the processor to: determine that user authentication is required to be performed in relation to the computing device or data stored therein; retrieve from a memory of the computing device reference information identifying a plurality of authenticators for consecutive use to perform the user authentication; perform a first authentication using a first authenticator of the plurality of authenticators; perform a next authentication using a next authenticator of the plurality of authenticators; and allow access to the computing device or data stored therein if the first authentication is successful and the next authentication is successful.
  • Still further embodiments relate to computer readable storage storing program code which, when executed by a processor, causes the processor to perform a method of user authentication, comprising: determining that user authentication is required to be performed in relation to a computing device or data stored therein; retrieving from a memory of the computing device reference information identifying a plurality of authenticators for consecutive use to perform the user authentication; performing a first authentication using a first authenticator of the plurality of authenticators; performing a next authentication using a next authenticator of the plurality of authenticators if the first authentication is successful; and allowing access to the computing device or data stored therein if the next authentication is successful.
  • Still further embodiments relate to computer readable storage storing program code which, when executed by a processor, causes the processor to perform a method of user authentication, comprising: determining that user authentication is required to be performed in relation to a computing device or data stored therein; retrieving from a memory of the computing device reference information identifying a plurality of authenticators for consecutive use to perform the user authentication; performing a first authentication using a first authenticator of the plurality of authenticators; performing a next authentication using a next authenticator of the plurality of authenticators; and allowing access to the computing device or data stored therein if the first authentication is successful and the next authentication is successful.
  • the smart card authenticator may be a required authenticator, for example to comply with corporate or government security requirements, and thus the mobile device, smart card and card reader are described in further detail below, with reference to FIGS. 1 to 3 to contextualize some of the possible applications of the described embodiments.
  • FIG. 1 depicts a system 100 for authenticating a user for access to a mobile device 140.
  • the system 100 may comprise a memory card 120 received by, or otherwise communicably coupled with, a card reader 110.
  • "Communicably coupled” as used herein is meant to describe any kind of coupling, for example physical, electrical, logical, signal and/or wireless coupling, or a combination thereof, sufficient to enable communication of signals, data, instructions or other meaningful exchange between the two components. Such coupling may be direct or indirect.
  • System 100 includes multiple authentication devices 130 in communication with mobile device 140 over a wired or wireless interface.
  • Card reader 110 and memory card 120 effectively act as an authentication device 130.
  • the card reader may comprise, or be associated with, a biometric scanner (as another authentication device).
  • Such authentication devices 130 include one or more wireless-enabled personal computers 130 and at least one wireless-enabled mobile device 140.
  • Each of the authentication devices 130 may have a wireless transceiver for communicating with mobile device 140, which also has a wireless transceiver, over a communication link 113 or 114.
  • one or more of the authentication devices 130 may be in communication with mobile device 140 via a wired connection, such as a universal serial bus (USB) cable.
  • USB universal serial bus
  • the mobile device 140 may be any suitable wirelessly enabled mobile device.
  • the mobile device 140 may be a dual mode (data and voice) communication device and personal digital assistant device, such as is described in further detail below in relation to FIG. 2 .
  • the mobile device may be a single mode (data) communication device.
  • the mobile device 140 may be capable of email communication.
  • the user of mobile device 140 is required to authenticate the user's identity for use of the mobile device 140, for example by providing a password or a personal identification number (PIN) code or other authentication methods as described herein, for example to unlock a user interface of mobile device 140, to digitally sign a message or to decrypt an encrypted message.
  • PIN personal identification number
  • Authentication devices 130 may comprise any kind of suitably secure authentication device, such as a retinal, iris, voice, DNA, facial image, handprint and/or fingerprint scanner, which may be communicably coupled to, or comprised in, a portable or fixed computer system which may require access to memory card 120. While not specifically shown in FIG. 1 , each authentication device 130 is enabled for wireless and/or wired communication (either by itself or via an associated computer system) with mobile device 140 and/or card reader 110 in a manner compatible with the communication capabilities of mobile device 140 and/or card reader 110 (described below in relation to FIG. 3 ).
  • a retinal, iris, voice, DNA, facial image, handprint and/or fingerprint scanner which may be communicably coupled to, or comprised in, a portable or fixed computer system which may require access to memory card 120. While not specifically shown in FIG. 1 , each authentication device 130 is enabled for wireless and/or wired communication (either by itself or via an associated computer system) with mobile device 140 and/or card reader 110 in a manner compatible with
  • Memory card 120 may be a smart card. Smart cards generally refer to personalized security devices, defined by the ISO 7816 standard and its derivatives, as published by the International Organization for Standardization.
  • a smart card may have a form factor of a credit card and may include a semiconductor device.
  • the semiconductor device may include a memory that can be programmed with security information, for example such as a private decryption key, a private signing key, biometrics information or an authentication certificate.
  • the semiconductor device may include a decryption engine, such as a processor and/or dedicated logic circuitry for performing decryption and/or authentication functions.
  • the smart card may include a connector for powering the semiconductor device and performing serial communication with an external device, such as card reader 110.
  • Smart cards generally have exposed contacts on one surface of the card for establishing electrical contact with corresponding contacts on the card reader, thereby facilitating communication between the smart card and the card reader.
  • memory card 120 and card reader 110 use electrical contact to establish communication therebetween.
  • memory card 120 may be physically received in card reader 110, it is not essential that card reader 110 physically receive or contact memory card 120 in order to establish communication therebetween.
  • memory card 120 may interface with card reader 110 using radio frequency identification records (RFID) technology.
  • RFID radio frequency identification records
  • the Mobile device 140 may be enabled to communicate with a wireless network 150.
  • the wireless network 150 may be implemented as a packet-based cellular network that includes a number of base stations each providing wireless Radio Frequency (RF) coverage to a corresponding area or cell.
  • RF Radio Frequency
  • the wireless network 150 could conform to one or more of the following, among other network standards: Mobitex Radio Network; DataTAC; Global System for Mobile Communication (GSM); General Packet Radio System (GPRS); Time Division Multiple Access (TDMA); Code Division Multiple Access (CDMA); Cellular Digital Packet Data (CDPD); integrated Digital Enhanced Network (iDEN); or various other third or higher generation networks such as Enhanced Data rates for GSM Evolution (EDGE) or Universal Mobile Telecommunications Systems (UMTS), etc.
  • GSM Global System for Mobile Communication
  • GPRS General Packet Radio System
  • TDMA Time Division Multiple Access
  • CDMA Code Division Multiple Access
  • CDPD Cellular Digital Packet Data
  • iDEN integrated Digital Enhanced Network
  • EDGE
  • the wireless network 150 may include a wireless local area network, such as, for example, a wireless local area network that conforms to one or more IEEE 802.11 standards, such as 802.11 b, 802.11 g and 802.11 n.
  • the wireless network 150 is connected, through intermediate communications links (not shown), including, for example, links through the Internet, to one or more enterprise networks (not shown).
  • enterprise networks are each associated with a set of respective mobile devices 140, such that the mobile devices 140 are each enabled to exchange electronic messages and other information with the enterprise networks with which the mobile devices 140 are associated.
  • FIG. 2 illustrates a detailed embodiment of the mobile device 140.
  • the mobile device 140 may comprise a display sub-system 210 and a wireless network communication subsystem 212 for two-way communications with the wireless network 150 ( FIG. 1 ).
  • the communication subsystem 212 includes antennas (not shown), RF transceivers (not shown) and some signal processing capabilities that may be implemented, for example, by a digital signal processor (not shown).
  • the mobile device 140 also includes a controller in the form of at least one mobile device microprocessor 216 that is suitably programmed to control the overall operation and functions of the mobile device 140, which are described in more detail below.
  • the mobile device 140 may further comprise peripheral devices and/or subsystems.
  • peripheral devices and/or subsystems may include, for example, as a flash memory 218, a random access memory (RAM) 220, an auxiliary input/output (I/O) subsystem 222 (e.g., a scroll wheel, trackball, joystick, directional-pad, touch-screen or other navigational component), a serial port 224 (e.g., a Universal Serial Bus, or "USB", port), an input device 226, a speaker 228, a microphone 230, a mobile device short-range communications subsystem 232 and/or an other device subsystem designated generally by reference 234.
  • the short-range communication subsystem 232 may comprise, for example, an infrared transceiver, wireless bus protocol system, such as BluetoothTM, and/or other means of local wireless communications.
  • the input device 226 may comprise, for example, a keyboard, a keypad and/or a touch-screen. The touch-screen may be used in combination with a stylus.
  • the mobile device microprocessor 216 operates under stored program control with code or firmware being stored in the flash memory 218 (or other type of non-volatile memory device or devices).
  • the flash memory 218 includes stored programs (e.g., firmware) including an operating system program or code module 240 and other programs or software applications indicated generally by reference 242.
  • the software applications 242 can, for example, include a World Wide Web (WWW) browsing application 244 and an e-mail client application 246.
  • WWW World Wide Web
  • the software applications 242 of the mobile device 140 further include a memory card driver 248 that may be used in conjunction with the card reader 110, which is described in more detail below in connection with FIG. 3 .
  • the memory card driver 248 may be provided, not by the manufacturer of the mobile device 140, but, instead, by a third party, e.g., the manufacturer of the memory card 120.
  • an Application Programming Interface API may be built in to the memory card driver 248 to allow the mobile device 140 to communicate with the memory card 120 through the card reader 110.
  • API Application Programming Interface
  • the software applications 242 of the mobile device 140 may further include a smart card reader (SCR) pairing and security module 250 for coordinating a pairing process between the mobile device 140 and the card reader 110.
  • SCR smart card reader
  • the roles of the memory card driver 248 and the smart card reader pairing and security module 250 will be described in greater detail below.
  • the operating system code 240, code for specific device applications 242, code for the WWW browsing application 244, code for the e-mail client application 246, code for the memory card driver 248, or code for the smart card reader pairing and security module 250 may be temporarily loaded into a volatile storage medium such as the RAM 220 during operation of the mobile device 140. Received communication signals and other data with information may also be stored in the RAM 220.
  • the mobile device 140 may include, in addition to the internal flash memory 218, persistent memory carried on a SIM (Subscriber Identity Module) card, or other removable device, and at least some of the flash memory 218 may be allocated to the SIM card flash memory.
  • SIM Subscriber Identity Module
  • the stored program control (i.e., the software applications 242) for the mobile device microprocessor 216 also includes a predetermined set of applications, code components or software modules that control basic device operations, for example, data and voice communication applications which are normally installed on the mobile device 140 as the software applications 242 during the manufacturing process. Further applications may also be loaded (i.e., downloaded) onto the mobile device 140 through the operation of networks described above, the auxiliary I/O subsystem 222, the serial port 224 or the mobile device short-range communications subsystem 232. The downloaded code modules or components are then installed by the user (or automatically) in the RAM 220 or the non-volatile program memory (e.g., the flash memory 218).
  • the serial port 224 comprises a USB-type interface port for interfacing or synchronizing with another device, such as a desktop or notebook computer (not shown).
  • the serial port 224 is used to set preferences through an external device or software application.
  • the serial port 224 is also used to extend the capabilities of the mobile device 140 by providing for information or software downloads, including user interface information, to the mobile device 140 other than through a wireless communication network.
  • the serial port 224 may be used to communicate with card reader 110.
  • the mobile device short-range communications subsystem 232 provides an interface for communication between the mobile device 140 and other devices, including the card reader 110, to be described in greater detail in connection with FIG. 3 , below.
  • the mobile device short-range communications subsystem 232 may employ an infrared communication link or channel, or may operate according to a wireless bus protocol, such as BluetoothTM, or any other localized wireless means of communication.
  • FIG. 3 illustrates an example embodiment of the card reader 110, in the exemplary form of a smart card reader.
  • the card reader 110 may comprise a controller including at least one smart card reader microprocessor 310, which is suitably programmed to control the overall operation and functions of the card reader 110.
  • the card reader 110 may further comprise an output device 312 (e.g., a display module).
  • the card reader 110 may further comprise peripheral devices or subsystems such as a flash memory 314, a random access memory (RAM) 316, which, in some embodiments, includes a portion allocated to a data cache, a serial port 318 (e.g., a USB port), a smart card reader short-range communications subsystem 320 (e.g., an infrared transceiver, wireless bus protocol system using a protocol such as a BluetoothTM), a storage component interface 322 (e.g., for a memory card or any other data storage device), a pairing-activation input device 324 (e.g., a push button) and optionally a biometric input device 325 (e.g., a fingerprint sensor).
  • a flash memory 314, a random access memory (RAM) 316 which, in some embodiments, includes a portion allocated to a data cache, a serial port 318 (e.g., a
  • the smart card reader microprocessor 310 operates under stored program control with code or firmware being stored in the flash memory 314 (or other type of non-volatile memory device or devices).
  • the stored programs e.g., firmware
  • the operating system 326 of the card reader 110 further includes a biometric matching software component 330 and a memory card reader driver component 332.
  • the biometric matching software component 330 is used to analyze or compare candidate biometrics scanned by the biometric input device 325 (as one form of authentication device 130) in reference to stored biometric templates.
  • the memory card reader driver component 332 is responsible for coordinating communications between the card reader 110 and a memory card 120 and/or the memory card driver 248 of the mobile device 140 (via wired or wireless communication link 114).
  • the operating system code 326, code for specific device applications 328, code for the biometric matching software component 330, code for the memory card reader driver component 332, or code components thereof, may be temporarily loaded into a volatile storage medium such as the RAM 316. Received communication signals and other data may also be stored in the RAM 316. Additionally, the storage component interface 322 receives the removable memory card 120, providing additional storage space for the card reader 110.
  • the memory card 120 stores biometric templates 336 and has a card driver and controller 338 responsible for coordinating communications between the memory card 120 and the memory card reader driver component 332 of the smart card reader 110. While operation of the card reader 110 is described in a context wherein the memory card 120 is a smart card, it will be understood by those skilled in the art that the card reader 110 may be designed to operate with any suitable form of memory device.
  • the stored program control (i.e., software applications 328) for the smart card reader microprocessor 310 may include a predetermined set of applications, code components or software modules that control basic device operations, for example, management and security related control of the data of the card reader 110, and may be installed on the card reader 110 as a component of the software applications 328 during the manufacturing process. Further applications may also be loaded (i.e., downloaded) onto the card reader 110 through the operation of the serial port 318, the smart card reader short-range communications subsystem 320 or from the memory card 120. The downloaded code module or components are then installed by the user (or automatically) in the RAM 316 or non-volatile program memory (e.g., the flash memory 314).
  • non-volatile program memory e.g., the flash memory 314.
  • biometric matching software component 330 and the memory card reader driver component 332 are shown to be an integrated portion of the operating system 326 for security purposes (e.g., because individuals should not be permitted to tamper with the biometric matching software component 330 or the memory card reader driver component 332)
  • the biometric matching software component 330 and/or the memory card reader driver component 332 could be installed as one of the software applications 328 so long as suitable security related precautions are taken to ensure that the biometric matching software component 330 and the memory card reader driver component 332 cannot be modified or tampered with by unauthorized users.
  • the serial port 318 may be a USB-type interface port for interfacing or synchronizing with another device, such as a desktop computer (not shown) or the mobile device 140.
  • the serial port 318 is used to set preferences through an external device or software application or exchange data with a device, such as the mobile device 140, which data is stored on the memory card 120 that is plugged into the storage component interface 322 of the card reader 110.
  • the serial port 318 is also used to extend the capabilities of the card reader 110 by providing for downloads, to the card reader 110, of information or software, including user interface information.
  • the short-range communications subsystem 320 provides an interface for communication between the mobile device 140 and the card reader 110.
  • the short-range communications subsystem 320 employs an infrared communication link or channel.
  • the short-range communications subsystem 320 operates according to a wireless RF bus protocol, such as BluetoothTM.
  • the short-range communications subsystem 320 may operate according to any suitable local wired or wireless communication protocol, so long as the short-range communications subsystem 232 ( FIG. 2 ) of the mobile device 140 can operate using the same protocol, thereby facilitating wireless communication between the mobile device 140 and the card reader 110. Any communications mechanism and/or protocol may be implemented for the short-range communications subsystems 232, 320, so long as the mobile device 140 and the card reader 110 can communicate with each other when within physical proximity.
  • flash memory 218 comprises program code modules executable by microprocessor 216 to provide a user authenticator framework 410, a plurality of authentication applications 412, 414 and 416 and a user interface module 420. Each authentication application performs a specific authentication function, depending on the type of authenticator it is functionally associated with.
  • User authenticator framework 410 comprises an application that governs user authentication application 412, 414 and 416 and ensures that authentication of the user is carried out properly and securely.
  • User authenticator framework 410 enables authentication configuration to establish which authenticators are to be used during the user authentication process.
  • User authenticator framework 410 may be considered to effectively comprise an authentication configuration application (or module or sub-routine) for this purpose, although such an application is not specifically shown in FIG. 4 .
  • User authenticator framework 410 stores and retrieves reference information that identifies the authenticators selected during configuration so that, when subsequent attempts to access the mobile device 140 (or secure data therein) need to have their access authority authenticated, the user authenticator framework 410 can identify and call upon the appropriate two or more of the authentication applications 412, 414 and 416 to perform their respective authentication functions.
  • authentication application 412 may perform a smart card authentication function and therefore may employ the memory card driver 248 and SCR pairing and security module 250, while authentication application 414 may be comprised of a program code for enabling mobile device 140 to communicate with an external authentication device 130, such as a retinal scanner.
  • one of the authentication applications, such as authentication application 416 may communicate with an external authentication device 130, for example embodied as smart card reader 110 in communication with memory card 120, to authenticate a user based on input received at a biometric input device (such as the fingerprint sensor 325), which may be processed by the biometric matching software component 330 and compared with biometric templates 336.
  • a biometric input device such as the fingerprint sensor 325
  • Authentication applications 412, 414 and 416 may be installed during configuration of mobile device 140, or subsequently. Although three authentication applications are shown in FIG. 4 for illustrative purposes, it will be appreciated by those of skill in the art that two or more authentication applications may be installed for use on mobile device 140.
  • Each authentication application 412, 414 and 416 is specifically adapted to cooperate with mobile device 140 and the appropriate components of the authentication device 130 to which they are functionally connected or associated.
  • the term "authenticator” is intended to comprise a respective authentication application in cooperation with an authentication device 130.
  • microprocessor 216 When executing any of the authentication applications 412, 414, 416, microprocessor 216 communicates with the relevant authentication devices 130 via a communication subsystem 430 of mobile device 140.
  • Communication subsystem 430 is communicably coupled to microprocessor 216 and authentication devices 130.
  • Communication subsystem 430 may comprise, for example, serial port 224, short-range communication subsystem 232, wireless network communication subsystem 212 and/or any other component or subsystem of mobile device 140 that is capable of communicating with a device external to mobile device 140.
  • the authentication application 412, 414 or 416 may perform very few, if any authentication functions, where such functions are performed by the authentication device 130 and/or the user authentication framework 410. In such embodiments, the authentication application may merely receive and interpret an output from the authentication device 130 and pass this onto the user authentication framework 410, which will then determine whether authentication using the relevant authenticator has been successful. In alternative embodiments, most of the functions of the authenticator may be performed by the authentication application (possibly in combination with the user authentication framework 410) and the authentication device 130 may be primarily an input device for gathering biometric information, such as a retinal, fingerprint or facial image scan, and passing this information on to the relevant authentication application.
  • biometric information such as a retinal, fingerprint or facial image scan
  • User interface module 420 communicates with user authenticator framework 410 in order to generate suitable visual displays on display system 210, including displaying an authentication configuration window 600 (as described below in relation to FIG. 6 ), based on information provided by user authenticator framework 410.
  • User interface module 420 is employed in combination with user authenticator framework 410 to perform authenticator configuration (as described below in relation to FIG. 5 ) and, once the configuration has been performed, to perform user interface functions associated with the authentication process (as described below in relation to FIG. 7 ).
  • user interface module 420 interprets user input received, for example, via input componentry 440 of mobile device 140 that is communicably coupled to microprocessor 216, and provides the interpreted user input to user authenticator framework 410 for authentication and/or configuration purposes.
  • User interface module 420 also provides appropriate graphical displays on display subsystem 210 to request user input or notify the user of the success or failure of a part or whole of the authentication process.
  • Input componentry 440 may comprise keyboard 226, auxiliary input/output 222, serial port 224, microphone 230 and/or other device subsystem 234.
  • Method 500 begins at step 510, at which authenticator configuration window 600 is displayed on display sub-system 210.
  • Authenticator configuration window 600 may be displayed as a result of user selection of an appropriate menu option or by clicking on an application icon or as part of a set-up wizard, for example.
  • the user of mobile device 140 is allowed to select from among the multiple authenticators for which authentication applications are installed on the mobile device 140.
  • the user is also allowed to select an order of use of the authenticators, for example, by re-ordering a list 620 of the available and/or selected authenticators.
  • the manner of re-ordering the list 620 of authenticators will depend on the particular user interface functionality provided by mobile device 140 and it will be understood that re-ordering of the list 620 may be accomplished in a number of different ways that would be apparent to those skilled in the art. For example, where user interface functionality permits, an authenticator in list 620 may be dragged and dropped into another part of the list 620.
  • a menu option such as "move authenticator up list” or “move authenticator down list” may be provided in relation to each authenticator in the list 620, allowing it to be moved up or down the list 620.
  • the authenticator at the top of the list 620 may be used first during the authentication process and the order of subsequent authentication may follow the descending order of the list 620.
  • the authenticators may be visually organized or presented in an alternative manner, such as in a group or cluster.
  • Selection of the multiple authenticators in step 520 can be effected in a number of different ways, depending on the particular user interface functionality provided by mobile device 140. For example, where the available authenticators are set out as items in a group or list 620, selection or de-selection of an authenticator may be effected by "clicking" on a corresponding selectable authenticator option (or item) 622, 624, 626 or 628 in list 620. Each item in the list 620 or group may have a selection status indicator, such as a graphically toggling icon, like a check box, check circle (button) or a word ("Yes" or "No") or symbol (“Y” or “N”) to indicate whether the authenticator is selected or not selected.
  • the selection status indicator may be graphically distinct from the written text description of the authenticator comprised in each list or group item 622, 624, 626 or 628, or it may be integrated therewith.
  • the check box may be considered to be graphically distinct, but a "halo", bolding, color inversion or other form of emphasis that is integrated with the written text may be used instead as a selection status indicator.
  • the user can explicitly or implicitly save the selected configuration, which triggers storage of reference information identifying the selected authenticators and the selected order of authentication, at step 530.
  • Explicit saving of the selected configuration may occur, for example, by selecting a "save" menu option while authenticator configuration window 600 is displayed or by selecting a "save” option on a pop-up window displayed in response to a user request to exit the authenticator configuration window 600.
  • Implicit saving may occur, for example, whenever a selection, deselection or order change is made or may occur if the window 600 is exited without an explicit save.
  • the reference information identifying the selected authenticators and the order of authentication may be stored in any suitable data format in a record or table within flash memory 218 so as to be accessible to user authenticator framework 410.
  • FIG. 6 shows one example of an authenticator configuration window 600, where the authentication configuration window comprises a banner portion 610 with a written text description to accompany the list 620 of authenticators.
  • the written text description may comprise, for example, "User Authenticators".
  • the list 620 (or group) of authenticators are arranged beneath the banner portion 610, with each authenticator corresponding to a particular item 622, 624, 626 or 628 in the list 620. Although four items are shown in FIG. 6 as being included in list 620, in other embodiments, two or three, or more than four, items may be included in list 620.
  • one or more of the authenticators in list 620 may be a required authenticator and thus may be displayed in authenticator configuration window 600 as being constantly selected and may not be unselected.
  • Other authenticators may be optional, in the sense that none of them is specifically required to be used as part of the authentication process, although at least one of the optional authenticators must be selected to be used in combination with the required authenticator.
  • two or more of the authenticators may be selected from the list 620, without any requirement as to which of the authenticators must be included in the selection.
  • Method 700 begins at step 710, at which the user authentication framework 410 determines whether user authentication is required, for example, where the mobile device 140 is requested by a user to be accessed or where the user is required to be authenticated to access sensitive information stored on mobile device 140.
  • user authentication framework 410 retrieves the reference information (previously stored at step 530) relating to the user selected authenticators and their selected order of use, at step 720. From the retrieved reference information, user authentication framework 410 identifies which authenticator is to be used first in the authentication process and which one or more further authenticators are to be used next.
  • reference information previously stored at step 530
  • user authentication framework 410 cooperates with the appropriate authentication application 412, 414, or 416 (corresponding to the first authenticator) and the appropriate authentication device 130 to perform a first part of the user authentication.
  • the specific authentication procedure for each authenticator may be as described herein or as known to those skilled in the art.
  • user authentication framework 410 determines whether the authentication at step 730 was successful and, if so, determines at step 745 whether further user authentication is required. As the embodiments described herein generally perform authentication using multiple different authenticators, authenticator framework 410 will usually initiate authentication using the next authenticator at step 760. If no further authentication is required at step 745, and step 730 was successful, then user authentication framework 410 proceeds to allow access to the computing device, or data stored therein, at step 790. If authentication at step 730 was not successful, then, at step 750, user authentication framework 410 interacts with user interface module 420 to provide a non-authentication message on display subsystem 210.
  • determining whether authentication at step 730 was successful in step 740 may be performed in the background while process flow continues to the next step without requiring the determining to be complete. In other words, the determining in step 740 may be executed in parallel with the next step, rather than in series. Once the determining in step 740 is complete, if the authentication was unsuccessful, process flow may jump to step 750, and a non-authentication message is provided.
  • user authentication framework 410 determines whether the authentication using the next authenticator at step 760 was successful. If the authentication at step 760 was not successful, then a non-authentication message is displayed at step 750. If the authentication at step 760 was successful then, at step 780, user authentication framework 410 determines whether any further user authentication is required. If further user authentication is required, then steps 760 to 780 are performed with respect to the further user authentication. Otherwise, user authentication is considered by user authentication framework 410 to be complete and the mobile device 140 is unlocked at step 790.
  • step 740 may be omitted and determination at steps 730 and 760 of whether the authentication of each authenticator was successful may be performed after authentication input has been received for all authenticators. In such embodiments, the order of performance of step 770 and step 780 as described above is reversed.
  • user authentication framework 410 may cooperate with user interface module 420 to provide some kind of notification to the user to the effect that authentication was successfully completed, although the mere fact of unlocking the mobile device 140 may be sufficient indication to the user that authentication was successful.
  • user authentication framework 410 may record each event in which authentication at step 730 or 760 was not successful in order to determine whether access to mobile device 140 or sensitive data stored therein is being sought by an unauthorized user. Further, user authentication framework 410 may store any input that is received during the failed authentication attempts, as such information may help to identify the unauthorized user.
  • X and/or Y is intended to mean X or Y or both.
  • X, Y, and/or Z is intended to mean X or Y or Z or any combination thereof.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Telephone Function (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Collating Specific Patterns (AREA)
EP08150681.8A 2008-01-25 2008-01-25 Procédé, système et dispositif mobile utilisant une authentification améliorée de l'utilisateur Active EP2083399B1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP08150681.8A EP2083399B1 (fr) 2008-01-25 2008-01-25 Procédé, système et dispositif mobile utilisant une authentification améliorée de l'utilisateur
CA2647309A CA2647309C (fr) 2008-01-25 2008-12-19 Methode, systeme et dispositif mobile utilisant l'authentification amelioree de l'utilisateur

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP08150681.8A EP2083399B1 (fr) 2008-01-25 2008-01-25 Procédé, système et dispositif mobile utilisant une authentification améliorée de l'utilisateur

Publications (2)

Publication Number Publication Date
EP2083399A1 true EP2083399A1 (fr) 2009-07-29
EP2083399B1 EP2083399B1 (fr) 2016-03-23

Family

ID=39495710

Family Applications (1)

Application Number Title Priority Date Filing Date
EP08150681.8A Active EP2083399B1 (fr) 2008-01-25 2008-01-25 Procédé, système et dispositif mobile utilisant une authentification améliorée de l'utilisateur

Country Status (2)

Country Link
EP (1) EP2083399B1 (fr)
CA (1) CA2647309C (fr)

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8447273B1 (en) 2012-01-09 2013-05-21 International Business Machines Corporation Hand-held user-aware security device
JP2014154121A (ja) * 2013-02-14 2014-08-25 Bank Of Tokyo-Mitsubishi Ufj Ltd ユーザ認証装置、ユーザ認証方法及びユーザ認証プログラム
JP2016526211A (ja) * 2013-05-13 2016-09-01 ホヨス ラボラトリー アイピー リミテッド アクセス制御される環境へのアクセスを認可するためのシステム及び方法
US9626501B2 (en) 2008-01-25 2017-04-18 Blackberry Limited Method, system and mobile device employing enhanced user authentication
JPWO2016117500A1 (ja) * 2015-01-19 2017-11-24 日本電気株式会社 認証装置、方法、システムとプログラム並びにサーバ装置
JP2018045719A (ja) * 2017-12-18 2018-03-22 株式会社三菱東京Ｕｆｊ銀行 ユーザ認証装置及びユーザ認証プログラム
US9996684B2 (en) 2013-05-13 2018-06-12 Veridium Ip Limited System and method for authorizing access to access-controlled environments
JP2019029038A (ja) * 2018-10-19 2019-02-21 株式会社三菱Ｕｆｊ銀行 ユーザ認証装置及びユーザ認証プログラム
DE102018001629A1 (de) * 2018-03-01 2019-09-05 Giesecke+Devrient Mobile Security Gmbh Persönliche Identifizierung durch Musterübereinstimmung
US11210380B2 (en) 2013-05-13 2021-12-28 Veridium Ip Limited System and method for authorizing access to access-controlled environments
US11550889B2 (en) 2020-07-16 2023-01-10 International Business Machines Corporation Device functionality management via face scanning
CN117994882A (zh) * 2024-04-02 2024-05-07 杭州海康威视数字技术股份有限公司 一种通行权限认证设备及方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2342744A (en) 1998-10-14 2000-04-19 Toshiba Kk User confirmation using biometrics
US20010007592A1 (en) 1996-07-25 2001-07-12 California Institute Of Technology, Biometric combination lock
EP1251468A2 (fr) * 2001-04-17 2002-10-23 Matsushita Electric Industrial Co., Ltd. Procédé et dispositif d'authentification personnelle
DE10317296A1 (de) * 2003-04-15 2004-11-11 Platanista Gmbh Verfahren zur Verwendung von Fingerabdrücken als Kombination von Sein und Wissen zur biometrischen Benutzerauthentifizierung
WO2007010799A1 (fr) 2005-07-22 2007-01-25 Sharp Kabushiki Kaisha Appareil de terminal mobile d’informations

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20010007592A1 (en) 1996-07-25 2001-07-12 California Institute Of Technology, Biometric combination lock
GB2342744A (en) 1998-10-14 2000-04-19 Toshiba Kk User confirmation using biometrics
EP1251468A2 (fr) * 2001-04-17 2002-10-23 Matsushita Electric Industrial Co., Ltd. Procédé et dispositif d'authentification personnelle
DE10317296A1 (de) * 2003-04-15 2004-11-11 Platanista Gmbh Verfahren zur Verwendung von Fingerabdrücken als Kombination von Sein und Wissen zur biometrischen Benutzerauthentifizierung
WO2007010799A1 (fr) 2005-07-22 2007-01-25 Sharp Kabushiki Kaisha Appareil de terminal mobile d’informations

Cited By (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9626501B2 (en) 2008-01-25 2017-04-18 Blackberry Limited Method, system and mobile device employing enhanced user authentication
US8447273B1 (en) 2012-01-09 2013-05-21 International Business Machines Corporation Hand-held user-aware security device
JP2014154121A (ja) * 2013-02-14 2014-08-25 Bank Of Tokyo-Mitsubishi Ufj Ltd ユーザ認証装置、ユーザ認証方法及びユーザ認証プログラム
JP2019109919A (ja) * 2013-05-13 2019-07-04 バリディウム アイピー リミテッド アクセス制御される環境へのアクセスを認可するためのシステム及び方法
JP2016526211A (ja) * 2013-05-13 2016-09-01 ホヨス ラボラトリー アイピー リミテッド アクセス制御される環境へのアクセスを認可するためのシステム及び方法
US11210380B2 (en) 2013-05-13 2021-12-28 Veridium Ip Limited System and method for authorizing access to access-controlled environments
US9996684B2 (en) 2013-05-13 2018-06-12 Veridium Ip Limited System and method for authorizing access to access-controlled environments
JP2019021327A (ja) * 2013-05-13 2019-02-07 バリディウム アイピー リミテッド アクセス制御される環境へのアクセスを認可するためのシステム及び方法
US11030286B2 (en) 2015-01-19 2021-06-08 Nec Corporation Authentication apparatus, method, system and program, and server apparatus
US10579781B2 (en) 2015-01-19 2020-03-03 Nec Corporation Authentication apparatus, method, system and program, and server apparatus
JPWO2016117500A1 (ja) * 2015-01-19 2017-11-24 日本電気株式会社 認証装置、方法、システムとプログラム並びにサーバ装置
JP2018045719A (ja) * 2017-12-18 2018-03-22 株式会社三菱東京Ｕｆｊ銀行 ユーザ認証装置及びユーザ認証プログラム
DE102018001629A1 (de) * 2018-03-01 2019-09-05 Giesecke+Devrient Mobile Security Gmbh Persönliche Identifizierung durch Musterübereinstimmung
JP2019029038A (ja) * 2018-10-19 2019-02-21 株式会社三菱Ｕｆｊ銀行 ユーザ認証装置及びユーザ認証プログラム
US11550889B2 (en) 2020-07-16 2023-01-10 International Business Machines Corporation Device functionality management via face scanning
CN117994882A (zh) * 2024-04-02 2024-05-07 杭州海康威视数字技术股份有限公司 一种通行权限认证设备及方法

Also Published As

Publication number Publication date
CA2647309A1 (fr) 2009-07-25
EP2083399B1 (fr) 2016-03-23
CA2647309C (fr) 2017-04-25

Similar Documents

Publication Publication Date Title
US9626501B2 (en) Method, system and mobile device employing enhanced user authentication
CA2647309C (fr) Methode, systeme et dispositif mobile utilisant l'authentification amelioree de l'utilisateur
US8074880B2 (en) Method, system and mobile device employing enhanced fingerprint authentication
US8152066B2 (en) Method and system for determining support for a memory card
EP2192511B1 (fr) Entrée simplifiée de séquences de caractères biométriques
EP2450822B1 (fr) Procédé, système et lecteur de carte intelligente pour la gestion d'un accès à une carte intelligente
US9762573B2 (en) Biometric framework allowing independent application control
US9378346B2 (en) Optimized biometric authentication method and system
US8838989B2 (en) Optimized biometric authentication method and system
EP2597585B1 (fr) Combinaison de navigation et détection d'empreintes digitales
US8584222B2 (en) Secure pin reset process
EP1890426B1 (fr) Procédé et système de détermination du support pour une carte mémoire
CA2607816C (fr) Appariement de peripherique sans fil a l'ecran verrouillable
EP2083544B1 (fr) Procédé et système d'authentification biométrique optimisée
EP2192524B1 (fr) Procédé, système et dispositif mobile utilisant une authentification de glissement de doigt améliorée
EP2083545B1 (fr) Procédé et système d'authentification biométrique optimisée

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20080125

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MT NL NO PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA MK RS

AKX Designation fees paid

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MT NL NO PL PT RO SE SI SK TR

AXX Extension fees paid

Extension state: RS

Payment date: 20080125

Extension state: AL

Payment date: 20080125

Extension state: BA

Payment date: 20080125

Extension state: MK

Payment date: 20080125

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: BLACKBERRY LIMITED

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: BLACKBERRY LIMITED

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAJ Information related to disapproval of communication of intention to grant by the applicant or resumption of examination proceedings by the epo deleted

Free format text: ORIGINAL CODE: EPIDOSDIGR1

INTG Intention to grant announced

Effective date: 20150611

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

INTC Intention to grant announced (deleted)
INTG Intention to grant announced

Effective date: 20150723

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

INTG Intention to grant announced

Effective date: 20160127

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MT NL NO PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA MK RS

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 783801

Country of ref document: AT

Kind code of ref document: T

Effective date: 20160415

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602008042998

Country of ref document: DE

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20160323

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160624

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160623

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 783801

Country of ref document: AT

Kind code of ref document: T

Effective date: 20160323

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160723

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160725

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602008042998

Country of ref document: DE

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 10

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160623

26N No opposition filed

Effective date: 20170102

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20170131

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20170131

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20170125

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 11

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20170125

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20170125

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20080125

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20160323

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20160323

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20240129

Year of fee payment: 17

Ref country code: GB

Payment date: 20240123

Year of fee payment: 17

REG Reference to a national code

Ref country code: DE

Ref legal event code: R082

Ref document number: 602008042998

Country of ref document: DE

Ref country code: DE

Ref legal event code: R081

Ref document number: 602008042998

Country of ref document: DE

Owner name: MALIKIE INNOVATIONS LTD., IE

Free format text: FORMER OWNER: BLACKBERRY LIMITED, WATERLOO, ONTARIO, CA

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20240125

Year of fee payment: 17