Patent Publication Number: US-2021165861-A1

Title: Authentication profiles for users

Description:
BACKGROUND 
     Upon logging into computing devices, a user may perform routine operations, such as launching applications, websites, remote sessions, or other configurations. Similarly, prior to logging off from the computing device, the user may choose to close active applications, websites, and remote sessions, particularly for security purposes. With regards to security, this may be particularly useful when multiple users access a computing device. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  illustrates a computing device for authenticating a user via an authentication event, and performing a set of tasks based on the authentication event used, according to an example; 
         FIG. 2  illustrates a method at a computing device for authenticating a user via an authentication event, according to an example; and 
         FIG. 3  is a flow diagram in accordance with an example of the present disclosure. 
     
    
    
     DETAILED DESCRIPTION 
     Examples disclosed herein provide the ability to automatically perform tasks on a computing device upon user authentication, or when the user is signing off, according to an example. By automating such tasks, routine operations generally performed by the user manually may be avoided, essentially saving time and increasing productivity, improving the overall user experience. As an example, users may choose to log into a computing device via various authentication events, such as a smart card, NFC capable device/card, biometric scan, or facial recognition. As will be further described, each authentication event used by a user may have its own authentication profile to handle a customized set of tasks when the user is logging into or logging off from a computing device. As a result, based on the authentication event used by the user, a unique experience may be provided to the user upon logging into the computing device. 
     With reference to the figures,  FIG. 1  illustrates a computing device  100  for authenticating a user via an authentication event, and performing a set of tasks based on the authentication event used, according to an example. The computing device includes at least a first peripheral  102  and second peripheral  104 , to authenticate the user via different authentication events, as will be further described. As an example, based on the peripheral used to authenticate the user, a customized set of tasks may be initiated. The computing device  100  depicts a processor  106  and a memory device  108  and, as an example of the computing device  100  performing its operations, the memory device  108  may include instructions  110 - 118  that are executable by the processor  106 . Thus, memory device  108  can be said to store program instructions that, when executed by processor  106 , implement the components of the computing device  100 . The executable program instructions stored in the memory device  108  include, as an example, instructions to authenticate user ( 110 ), instructions to determine authentication profile ( 112 ), instructions to launch program ( 114 ), instructions to revoke user authentication ( 116 ), and instructions to terminate program ( 118 ). 
     Instructions to authenticate user ( 110 ) represent program instructions that when executed by the processor  106  cause the computing device  100  to receive an attempt to authenticate a user via an authentication event. As mentioned above, the computing device  100  includes a peripheral, such as first peripheral  102  or second peripheral  104 , to authenticate a user via an authentication event corresponding to the peripheral. For example, if the peripheral is a smart card reader, the authentication event may correspond to an insertion or tap of a smart card. If the peripheral involves biometric measurements (e.g., fingerprint scanner, iris scanner), the authentication event may correspond to biometric identifiers, such as a fingerprint, facial recognition, or iris recognition. If the peripheral is an NFC receiver, the authentication event may correspond to the use of an NFC capable device/card. Upon receiving the attempt to authenticate the user via the authentication event, the computing device  100  determines whether the authentication is a valid attempt for allowing access of the computing device  100  to the user. Although a first peripheral  102  and second peripheral  104  is illustrated, the number of peripherals available on the computing device  100  may vary. 
     Instructions to determine authentication profile ( 112 ) represent program instructions that when executed by the processor  106  cause the computing device  100 , upon validating the authentication event used, to determine which authentication profile to initiate, for the user to use the computing device  100 . As an example, the determination of the authentication profile to initiate includes selecting an authentication profile based on the authentication event used. For example, if a smart card is used to authenticate the user, a first authentication profile may be initiated. If a biometric identifier is used, a second authentication profile may be initiated. As an example, each biometric measurement may have its own authentication profile. For example, the authentication profile initiated if a fingerprint scanner is used may be different from the authentication profile initiated if an iris scanner is used. If an NFC capable device/card is used, a third authentication profile may be initiated. As will be further described, each authentication profile for a user may include a unique set of start and exit tasks while using the computing device  100 . 
     Instructions to launch program ( 114 ) represent program instructions that when executed by the processor  106  cause the computing device  100  to initiate the determined authentication profile to launch a customized set of programs or tasks on the computing device  100  for the user. As mentioned above, various authentication profiles may be initiated for a user, based on the authentication event used. For example, a first authentication profile is initiated when a first authentication event is used, and a second authentication profile is initiated when a second authentication event is used. As the set of programs or tasks launched for each authentication profile is different, the customized set of programs launched when the first authentication profile is initiated is different from the customized set of programs launched when the second authentication profile is initiated. As a result, based on the authentication event used by the user, a unique experience may be provided to the user upon logging into the computing device  100 . In addition, when more secure authentication events are used, for example, reserved only for administrators, the customized set of programs may include more secure programs and tasks. 
     As an example, the customized set of programs or tasks includes a predefined set of applications, remote sessions, and/or websites to launch upon the user logging into the computing device  100 . For programs requiring user credentials, such as an application or remote session, the authentication profile may also pass through the authentication information of the user, in order for the application or remote session to load properly. As an example, if the application or remote session supports pass through credentials, an authentication token may be passed through to this application or remote session, once the authentication profile is initiated. Once the customized set of programs or tasks are launched on the computing device  100 , including the programs that require pass through credentials, the computing device  100  is ready for use by the user, with the routine programs used by the user loaded. 
     Instructions to revoke user authentication ( 116 ) represent program instructions that when executed by the processor  106  cause the computing device  100  to receive an attempt to revoke user authentication. As an example, the attempt to revoke user authentication may correspond to a second instance of the authentication event described above. For example, attempt to revoke user authentication may correspond to a second insertion or tap of a smart card, a second use of a biometric identifier, such as a fingerprint, facial recognition, or iris recognition, or a second tap of an NFC capable device/card on an NFC receiver. However, an authentication event besides the one used initially may be used when attempting to revoke user authentication. However, if the user forgets to revoke user authentication, it may be revoked, for example, after a certain period of inactivity, or when a presence sensor has detected that the user has left the vicinity of the computing device  100 . Similarly, if a second user attempts to log into the computing device  100 , for example, while the initial user is still logged in, user authentication of the initial user may be revoked, for security purposes. 
     Instructions to terminate program ( 118 ) represent program instructions that when executed by the processor  106  cause the computing device  100 , upon receiving the attempt to revoke the user authentication, to terminate the customized set of programs, or any programs that remain open. Automatically closing active applications, remote sessions, and websites, for example, when a user leaves or logs out from the computing device  100 , improves overall security. As an example, terminating the customized set of programs includes signing out of the programs from the customized set of programs requiring user credentials, as described above. For example, if an application or remote session supports it, the computing device  100  may request or pass through a sign-out event to the respective application or remote session (e.g., Sending ExitWindows, log off event for remote desktop protocol (RDP), or custom windows message to a windows application). As an example, if applications are manually launched by the user, they may not be affected by the revoking of the user authentication. As an example, upon terminating the customized set of programs, the computing device  100  may initiate local operating system (OS) events such as logoff, restart, shutdown, and lock. 
     Memory device  108  represents generally any number of memory components capable of storing instructions that can be executed by processor  106 . Memory device  108  is non-transitory in the sense that it does not encompass a transitory signal but instead is made up of at least one memory component configured to store the relevant instructions. As a result, the memory device  108  may be a non-transitory computer-readable storage medium. Memory device  108  may be implemented in a single device or distributed across devices. Likewise, processor  106  represents any number of processors capable of executing instructions stored by memory device  108 . Processor  106  may be integrated in a single device or distributed across devices. Further, memory device  108  may be fully or partially integrated in the same device as processor  106 , or it may be separate but accessible to that device and processor  106 . 
     In one example, the program instructions  110 - 118  can be part of an installation package that when installed can be executed by processor  106  to implement the components of the computing device  100 . In this case, memory device  108  may be a portable medium such as a CD, DVD, or flash drive or a memory maintained by a server from which the installation package can be downloaded and installed. In another example, the program instructions may be part of an application or applications already installed. Here, memory device  108  can include integrated memory such as a hard drive, solid state drive, or the like. 
       FIG. 2  illustrates a method  200  at a computing device for authenticating a user via an authentication event, according to an example. In discussing  FIG. 2 , reference may be made to the example computing device  100  illustrated in  FIG. 1 . Such reference is made to provide contextual examples and not to limit the manner in which method  200  depicted by  FIG. 2  may be implemented. 
     Method  200  begins at  202 , where the computing device receives an attempt to authenticate a user via an authentication event. Referring to computing device  100 , the computing device  100  includes a peripheral, such as first peripheral  102  or second peripheral  104 , to authenticate a user via an authentication event corresponding to the peripheral. 
     At  204 , upon receiving the attempt to authenticate the user via the authentication event, the computing device determines whether the authentication is a valid attempt for allowing access of the computing device to the user. If the authentication event is not validated, method  200  returns to  202 . 
     Otherwise, method  200  proceeds to  206 , where the computing device selects an authentication profile based on the authentication event used at  202 . For example, if the authentication event corresponds to an insertion or tap of a smart card, a first authentication profile may be initiated. If the authentication event corresponds to biometric identifiers, such as a fingerprint, facial recognition, or iris recognition, a second authentication profile may be initiated. If the authentication event corresponds to the use of an NFC capable device/card, a third authentication profile may be initiated. 
     At  208 , the computing device initiates the authentication profile to launch a customized set of programs or tasks. As mentioned above, various authentication profiles may be initiated for a user, based on the authentication event used. As a result, based on the authentication event used by the user, a unique experience may be provided to the user upon logging into the computing device  100 . As an example, the customized set of programs or tasks includes a predefined set of applications, remote sessions, and/or websites to launch upon the user logging into the computing device. For programs requiring user credentials, such as an application or remote session, the authentication profile may also pass through the authentication information of the user, in order to seamlessly log in to the application or remote session. As an example, if the application or remote session supports pass through credentials, an authentication token may be passed through to this application or remote session, once the authentication profile is initiated. 
     Once the customized set of programs or tasks are launched on the computing device, including the programs that require pass through credentials, the computing device is ready for use by the user, with the routine programs used by the user loaded. The computing device remains available for the user until the user authentication is revoked. As an example, user authentication may be revoked by the user itself or when another user attempts to log into the computing device. Referring to method  200 , at  210 , the computing device determines whether it receives an attempt to revoke user authentication, for example, by the user. At  212 , the computing device determines whether it receives an attempt to authenticate another user, for example, by the other user attempting to authenticate itself via an authentication event, as described above. If neither attempt is received at  210  or  212 , the computing device remains logged in for the original user. However, as an example, if the user forgets to revoke user authentication, the computing may be revoke the user authentication, for security purposes, for example, after a certain period of inactivity at the computing device, or when a presence sensor has detected that the user has left the vicinity of the computing device. 
     At  214 , if the computing device receives either an attempt to revoke user authentication at  210  or an attempt to authenticate another user at  212 , the computing device terminates the customized set of programs, or any programs that remain open, and then returns to  202 . Automatically closing active applications, remote sessions, and websites, for example, when a user leaves or logs out from the computing device, improves overall security. Examples include cleaning up the browsing history, application history, and deleting temporary files. As an example, terminating the customized set of programs includes signing out of the programs from the customized set of programs requiring user credentials, as described above. In addition, upon terminating the customized set of programs, the computing device may initiate local OS events such as logoff, restart, shutdown, and lock. 
       FIG. 3  is a flow diagram  300  of steps taken by a computing device to implement a method for authenticating a user via an authentication event, according to an example. Although the flow diagram of  FIG. 3  shows a specific order of execution, the order of execution may differ from that which is depicted. For example, the order of execution of two or more blocks or arrows may be scrambled relative to the order shown. Also, two or more blocks shown in succession may be executed concurrently or with partial concurrence. All such variations are within the scope of the present invention. 
     At  310 , the computing device receives an attempt to authenticate a user via an authentication event. As described above, the computing device includes peripherals to authenticate the user via an authentication event corresponding to the peripheral used. 
     At  320 , upon validating the authentication event use, the computing device determines which authentication profile to initiate for the user to use the computing device. As an example of determining which authentication profile to initiate, the computing device selects an authentication profile based on the authentication event used. For example, if the authentication event corresponds to an insertion or tap of a smart card, a first authentication profile may be initiated. If the authentication event corresponds to biometric identifiers, such as a fingerprint, facial recognition, or iris recognition, a second authentication profile may be initiated. If the authentication event corresponds to the use of an NFC capable device/card, a third authentication profile may be initiated. 
     At  330 , the computing device initiates the determined authentication profile to launch a customized set of programs on the computing device for the user. As an example, a first authentication profile is initiated when a first authentication event is used, and a second authentication profile is initiated when a second authentication event is used. As a result, the customized set of programs launched when the first authentication profile is initiated may be different from the customized set of programs launched when the second authentication profile is initiated. As an example, for programs from the customized set of programs requiring authentication, the computing device passes through credentials for the first user to the programs requiring the authentication. 
     Once the customized set of programs or tasks are launched on the computing device, including the programs that require pass through credentials, the computing device is ready for use by the user, with the routine programs used by the user loaded. The computing device remains available for the user until the user authentication is revoked, as described above. 
     It is appreciated that examples described may include various components and features. It is also appreciated that numerous specific details are set forth to provide a thorough understanding of the examples. However, it is appreciated that the examples may be practiced without limitations to these specific details. In other instances, well known methods and structures may not be described in detail to avoid unnecessarily obscuring the description of the examples. Also, the examples may be used in combination with each other. 
     Reference in the specification to “an example” or similar language means that a particular feature, structure, or characteristic described in connection with the example is included in at least one example, but not necessarily in other examples. The various instances of the phrase “in one example” or similar phrases in various places in the specification are not necessarily all referring to the same example. 
     It is appreciated that the previous description of the disclosed examples is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these examples will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other examples without departing from the scope of the disclosure. Thus, the present disclosure is not intended to be limited to the examples shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.