Patent Description:
In order to access functionality within an application or service, a user will often be required to provide authentication credentials. For example, the application or service may require a username and password to be provided prior to allowing access to such application or service.

Users typically have many applications or services that they access, and each may require one or more authentication credentials. For example, a user may access online banking and require a first authentication credential, an application storefront which may require a second authentication credential, social media sites which may require further authentication credentials, among others.

In some cases, a user will reuse the same password or other authentication credential between these sites in order to allow the user to remember such credentials. However, this creates security issues and compromises the user's data if one of such applications or services is breached.

In order to overcome this, or for other reasons, users may store credentials in a credential vault. As used herein, a credential vault can comprise any digital vault that is used to store information for access to an application or a service. For example, the credential vault may store a user name and password for each application or service.

The credential vault itself is typically encrypted and requires a decryption key to access the contents stored therein. The decryption key may comprise a password, personal identification number (PIN), graphical authentication, gesture, biometric data, voice data, or may comprise data that is received from a sensor on a device, or any combination of any of the foregoing. In other cases, a card read by a card reader connected to the device may be used. Other types of sensors could also be used.

<CIT> discloses a method for accessing password-protected computer applications and websites. An existing password field on a device display is overlaid with a password wallet pop-up field which allows a wallet "master" key to unlock a wallet for passwords. An application-specific and/or user-specific password is automatically retrieved from the wallet and entered into the password field.

<CIT> discloses a multi-party security protocol including a key generation mechanism binding secrets to a specific device or URL by adding salt to a master credential. A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) handling mechanism is also used.

<CIT> discloses a method for managing authentication information for a user. According to the method, a master digital key is received from the user, and authentication of the user is obtained based on the master digital key. Further, a user selection is received of one identity from among a plurality of identities that are stored for the user. Authentication information for the user is provided into an application or web page based on the one identity selected by the user.

"LastPass for Android" explains the use of application LastPass for Android <NUM>, which allows to unlock data using email address and password.

<CIT> discloses a method for providing a single sign on features in mobile applications in a secure environment using a shared vault. According to this method, an application can prompt a user to provide user entropy to decrypt a user-entropy-encrypted vault key. Once the vault key is decrypted, the application can decrypt a vault database of the shared vault. The shared vault stores shared secrets and an unlock key. The application can store the unlock key, generate an unlock-key-encrypted vault key, and cause the shared vault to store the unlock-key-encrypted vault key.

<CIT> discloses a method where a security credential is generated based at least in part on a security credential specification associated with a network site. In particular, the security credential and a domain name associated with the network site are stored, and the security credential is provided to the network site when a domain name associated with a trusted certificate provided by the network site matches the stored domain name.

<CIT> discloses a method for managing a plurality of a user's authentication elements, wherein a user initiates a webpage browser session at a user website access device and activates a password manager program. The user's identity is authenticated to an authentication server and allowed to access a secure database comprising a plurality of website authentication elements. Thereafter, the user accesses a first secure website and the program determines the presence of a user authentication data field. When a user authentication data field is present the program instructs the authentication server to automatically transmit at least one of the authentication elements specific to the authentication data field of the first secure website to authenticate the user to the first website.

<CIT> discloses a method for enabling direct electronic payment transfers, wherein identification information of a payer, based on a user selection at a mobile device, is received from a first application installed on the mobile device, a user identification of a payment amount is received via a second application installed on the mobile device, wherein the second application is different from the first application, and biometric data of the user is captured at a biometrics reader of the mobile device, and then compared to authorized biometric data to authenticate the user. Upon successful authentication of the user, a request for the electronic payment transfer from the payer to the user for the payment amount is initiated from the mobile device. <CIT> discloses a system for use with a computer, the computer including a self-encrypting drive, SED, the SED including a nominal space and a pre-boot region, wherein the nominal space can be locked to prevent access to the nominal space. The system includes SED management software configured to be loaded in the pre-boot region of the SED. The SED management software includes a pre-boot operating system, OS, and an unlocking program which is configured to execute within the pre-boot OS, and upon successful authentication of a user, to unlock the nominal space of the SED.

Accordingly there is provided a method, computing device and computer program as detailed in the claims that follow.

The present disclosure provides a method at a computing device, the method comprising: detecting, at the computing device, a trigger that authentication is pending for an application or service; indicating a state of a credential vault via a user interface of the computing device; and when the credential vault is in a locked state, activating an authentication mechanism for the credential vault without changing focus on the user interface for the application or service.

The present disclosure further provides a computing device comprising: a processor; and a memory for storing instruction code, wherein the instruction code causes the computing device to: detect a trigger that authentication is pending for an application or service; indicate a state of a credential vault via a user interface of the computing device; and when the credential vault is in a locked state, activate an authentication mechanism for the credential vault without changing focus on the user interface for the application or service.

The present disclosure further provides a computer readable medium for storing program code for execution on a processor of a computing device, the program code comprising instructions for: detecting at the computing device, a trigger that authentication is pending for an application or service; indicating a state of a credential vault via a user interface of the computing device; and when the credential vault is in a locked state, activating an authentication mechanism for the credential vault without changing focus on the user interface for the application or service.

In many cases, when a user wants to access an application or service, the user may go to a credential vault in order to obtain the access credentials. This is especially true for applications or services that are not accessed very frequently. A credential vault can be any password manager or credential storage which is independently encrypted and locked using a key. Such key can include, for example, a password, a PIN, a gesture, voice data, biometric data read from a biometric sensor such as a fingerprint that is read by a fingerprint sensor, a tag that is read or challenged by a wireless tag proximity sensor such as a near field communication (NFC) sensor or a radio frequency identifier (RFID) sensor on the device, or a combination of any of the foregoing, among other options. For example, the device may have a fingerprint sensor and the credential used to access content within the credential vault and may comprise the fingerprint of a user. Similarly, the credential may be stored or derived on a near field communications tag or card, which may, when placed in proximity to a user device, provide credential information to the user device to allow the credential vault to be accessed.

The process to obtain information from a credential vault may be cumbersome. In order to unlock the credential vault, the user typically needs to change the focus of the display from the current application or service to the credential vault. The unlocking procedure for the credential vault must then be started, and when the credential vault is unlocked the authentication credentials for the particular application or service must be obtained.

Such process detracts from a user experience with the application or service. Further, the particular set of steps to unlock the credential vault is complicated and may lead a user to skip using such vault and instead to use weaker security such as repeated passwords between applications or services.

Therefore, in accordance with the present disclosure, the process for allowing a service or application to be unlocked is performed directly from the application or service, without needing to leave such application or service.

In accordance with the embodiments described below, the application or service is unlocked by entering a password.

For example, the application or service may need a fingerprint to be read, an encryption key to be utilized, or digital passcode to be used, or a combination of any of the foregoing. In this case, such information may be obtained from the credential vault rather than directly from a sensor.

When using a password for the authentication credential, the placing of the input focus on the device may cause a keyboard to be displayed within the application or service. In accordance with one embodiment of the present disclosure, the virtual keyboard is modified to provide functionality to unlock and access the credential vault, including the display of the status of the credential vault.

In other cases, a virtual keyboard may not be required. For example, the device may comprise or be coupled to a physical keyboard, or the authentication mechanism for the application or service does not require a keyboard. Thus in some embodiments of the present disclosure, a device display may be modified to show the status of the credential vault by providing some aspects of the virtual keyboard in order to provide direct access to the credential vault from the application or service.

The embodiments of the present disclosure is implemented on a computing device. Such computing device may comprise any fixed or portable computing device, including, but not limited to, a desktop computer, laptop computer, mobile device, smartphone, tablet, vehicular computing system, among other options. In the embodiments below the computing device is described as a mobile device for illustration purposes only.

Reference is now made to <FIG>, which shows an example computing device <NUM>. In accordance with the embodiment of <FIG>, device <NUM> includes a display <NUM>. In one example, display <NUM> comprises a touch sensitive display, thereby providing a first user interface to computing device <NUM>.

In the example of <FIG>, the computing device has navigated a browser to a service entitled "ExampleWebsite. Such service may include, for example, a banking service, social media, online retail, cloud storage, corporate website, among others. In other embodiments, a user may have launched an application either local to or remote from the computing device <NUM>.

The application or service <NUM> requires authentication prior to allowing access to all or parts of the application or service. In the example of <FIG>, the application or service <NUM> includes a username field <NUM> and a password field <NUM>.

When the user interface focus is placed in one of these fields, for example by touching or selecting one of these fields, a keyboard <NUM> may be displayed on display <NUM>. Such keyboard <NUM> may be utilized to enter the information in the username field <NUM> or password field <NUM> manually.

In accordance with one embodiment of the present disclosure, a credential vault user interface <NUM> comprising a bar is further added to the user interface. Credential vault user interface <NUM> includes a user interface element <NUM> such as an icon indicating a current status of the credential vault, a user interface element <NUM> such as an autofill icon to allow the username and/or password to be filled merely by pressing the icon when the credential vault is unlocked, and a user interface element <NUM> such as an update field which allows new records to be created in the credential vault.

The embodiment of <FIG> is however one example, and more or fewer icons could be displayed within the credential vault user interface <NUM>. For example, rather than a bar <NUM>, only user interface element <NUM> comprising an icon could be provided within a key of keyboard <NUM> in some cases.

Further, on a computing device <NUM> comprising or coupled to a physical keyboard, the credential bar field including credential vault icon <NUM> may be displayed without the remainder of keyboard <NUM> being displayed.

In other embodiments, user interface element <NUM> may be provided in a notification tray for the application, or provided as a pop-up window within the application.

The user interface element <NUM> that is displayed for the credential vault is determined based on a state of the credential vault. For example, in one embodiment the credential vault may use an input method engine (IME) to provide a state through the operating system of computing device <NUM>. Keyboard <NUM> may watch for such state and when the keyboard is activated and a trigger indicating that authentication is required is provided, the keyboard may be enhanced with the credential vault bar <NUM> including the icon <NUM> of the appropriate state for the credential vault.

In the example of <FIG>, the credential vault is locked, as shown by user interface element <NUM> which shows a locked symbol. Further, in the embodiment of <FIG>, the credential vault indicates that it will accept a fingerprint input by utilizing a fingerprint symbol within the user interface element <NUM>. However, other examples are possible. For example, if a near field communication tag was utilized for unlocking the credential vault, a near field communication symbol may be displayed within user interface element <NUM>. In other embodiments, user interface element <NUM> may not indicate the input method but may simply leave it to the user to utilize whatever input method is typically used to unlock the credential vault. Other examples are possible and are within the scope of the present disclosure.

In accordance with various embodiments of the present disclosure, the activation of the keyboard <NUM> with the credential vault bar <NUM> further causes a sensor on computing device <NUM> to be activated in order to receive an input to unlock the credential vault. In particular, in accordance with the embodiment of <FIG>, user interface element <NUM> shows that the credential vault may be unlocked using a fingerprint sensor. In this regard, computing device <NUM>, when the keyboard and user interface element <NUM> are displayed, activates the fingerprint sensor at that time. For example, the credential vault could cause the computing device to activate the fingerprint sensor based on the fact that the keyboard is up and the credential vault is locked.

Thus, a user of computing device <NUM> could then place a finger on the fingerprint sensor and the credential vault is unlocked automatically without changing the focus away from the application or service <NUM>.

Reference is now made to <FIG>. In the example of <FIG>, the computing device <NUM> has detected a fingerprint on a fingerprint sensor and the credential vault has been unlocked. This is shown by user interface element <NUM>, which comprises an icon and shows an unlocked symbol for the credential vault.

Once the credential vault is unlocked then the authentication that is pending for the application or service may be completed. For example, in one embodiment a user may use user interface element <NUM> to allow the credential vault to fill in the one or both of the user name and/or password fields for the application or service <NUM>. This would be done by having the credential vault look up the application or service and provide the information through the interface.

In an alternative embodiment, the unlocking of credential vault <NUM> may provide an indication that the authentication parameters should be provided to the application or service <NUM> automatically. In this case, detecting a fingerprint on the fingerprint sensor may cause both the credential vault to unlock and the filling of the information on the application or service.

In the above examples, control remains with the credential vault. Thus the verification of either the password, fingerprint, NFC reader or other input mechanism for the authentication to the credential vault is done within the credential vault itself. Therefore, the security of the credential vault is not compromised.

Further, the state of user interface element <NUM> or <NUM> is provided by the credential vault, either directly to the keyboard service, application or service, or by utilizing the operating system of computing device <NUM>. For example, mechanisms may exist within the operating system to provide state information, and the changing of the state that is being monitored by an application or service may cause a trigger to the application or service.

In still further examples, a challenge-response mechanism may be utilized. In this case, the credential vault may include software to analyze the challenge and provide the appropriate response. Here, the activation of the challenge-response mechanism within the application or service <NUM> may further activate a credential vault bar <NUM> or element <NUM>, allowing the credential vault to be unlocked without changing focus from the application or service <NUM>.

In the case that the authentication mechanism for unlocking the credential vault is unsuccessful, various inputs or feedback may be provided to the user. For example, if the user is to use a fingerprint scanner to unlock the credential vault and the fingerprint scan is unsuccessful, an icon displaying an unsuccessful authentication may be provided to the user. In other cases, a pop up window, an audible signal, or any visual, audible or tactile indicator may indicate that the authentication was unsuccessful.

Reference is now made to <FIG>, which shows a dataflow diagram with the various elements described above. The embodiment of <FIG> is merely one example of the implementation of the methods and systems described herein.

In particular, in the example of <FIG>, an application or service <NUM> interacts through an operating system <NUM> of computing device <NUM>. Operating system <NUM> can be any computing device operating system including, but not limited to, Android™, iOS™, BlackBerry™ OS, Windows™, Linux, MacOS™, among others.

Further, a keyboard service <NUM> may be utilized by operating system <NUM> to provide for input on a touch screen if such service is required.

The embodiment of <FIG> includes a credential vault <NUM> along with an authentication sensor <NUM>. Authentication sensor <NUM>, as described above, can comprise any one or more of the following: a fingerprint reader, near field communication sensor, a card reader, a retinal or iris scanner, a camera, among other options.

In the embodiment of <FIG>, a credential vault <NUM> may update the operating system <NUM> by providing a state for the credential vault. This is shown, for example, with message <NUM>. Updating may be performed, for example using an interface between the keyboard service and the credential vault, or by using the operating system to hold state information, among other options.

At some later point, application or service <NUM> triggers an authentication requirement, as shown by message <NUM> to operating system <NUM> of computing device. As indicated above, the authentication trigger <NUM> includes placing the focus of the user interface into a password field.

The computing device <NUM>, using the operating system <NUM>, may activate a keyboard <NUM> using message <NUM>. In this case, the activation may include the credential vault icon that corresponds with the state provided previously in message <NUM>.

Further, operating system <NUM> may be used determine whether the credential vault is locked, and if yes, it may activate a sensor <NUM>, as shown by message <NUM>. For example, the credential vault may ask the operating system to activate the sensor in one embodiment. In another embodiment credential vault may store its state in a location that can be accessed by applications through the operating system. Other options are possible and are within the scope of the present disclosure. The activation of the sensor <NUM> allows for the authentication input for the credential vault without changing the focus away from the application or service <NUM>.

Sensor <NUM>, in the example of <FIG>, receives an input, as shown at arrow <NUM>, and provides the input back through operating system <NUM> as shown by message <NUM>.

The input is then provided to credential vault <NUM> for verification, as shown by message <NUM>. Verification of the input is performed at the credential vault, as shown by arrow <NUM>. In other embodiments, verification may be done in various ways. For example, the operating system may verify the fingerprint and provide the verification to the credential vault, and in doing so may unlock a key which the credential vault can now access. That key is used to access an encrypted database for a user. For example, the key may be used to decrypt a file stored by the credential vault which reveals a master password for a user, which is used to decrypt the database.

In the example of <FIG>, the authentication parameter is valid and therefore the input is verified. The credential vault <NUM> then sends a message back through operating system <NUM> to indicate that the authentication is verified and the state of the credential vault has changed from locked to unlocked. This is shown in the example of <FIG> with message <NUM>.

The keyboard or credential vault bar may receive the notification that the state has change and the icon on the display may therefore be updated, as shown by message <NUM>.

Optionally, on verification, credential vault <NUM> may further provide authentication parameters back to application or service <NUM>, as shown by message <NUM>.

In other embodiments, the pressing of an icon on keyboard <NUM> may trigger the authentication parameters <NUM> to be provided to application or service <NUM>.

Thus, in accordance with the above, the credential vault stores authentication credentials for an application or service, where the vault is unlocked within the application or service itself. However, control of the unlock process remains within the credential vault, thereby maintaining the security of the credential vault.

The modules and devices described above may be any computing device. One simplified block diagram of a computing device is shown with regard to <FIG>.

In <FIG>, device <NUM> includes a processor <NUM> and a communications subsystem <NUM>, where the processor <NUM> and communications subsystem <NUM> cooperate to perform the methods of the embodiments described above.

Processor <NUM> is configured to execute programmable logic, which may be stored, along with data, on device <NUM>, and shown in the example of <FIG> as memory <NUM>. Memory <NUM> can be any tangible, non-transitory computer readable storage medium. The computer readable storage medium may be a tangible or in transitory/non-transitory medium such as optical (e.g., CD, DVD, etc.), magnetic (e.g., tape), flash drive, hard drive, or other memory known in the art.

Alternatively, or in addition to memory <NUM>, device <NUM> may access data or programmable logic from an external storage medium, for example through communications subsystem <NUM>.

Communications subsystem <NUM> allows device <NUM> to communicate with other devices or network elements.

Communications between the various elements of device <NUM> may be through an internal bus <NUM> in one embodiment. However, other forms of communication are possible and are within the scope of the present disclosure.

If a sensor is used to gain access to a credential vault, the sensor may be an internal sensor <NUM> communicating through internal bus <NUM> or may be an external sensor <NUM> that connects to computing device <NUM> through any wired or wireless mechanism.

Further, if computing device <NUM> comprises a mobile device, one example device is described below with regard to <FIG>.

Mobile device <NUM> may comprise a two-way wireless communication device having voice and data communication capabilities. Mobile device <NUM> generally has the capability to communicate with other computer systems on the Internet. Depending on the exact functionality provided, the mobile device may be referred to as a data messaging device, a two-way pager, a wireless e-mail device, a cellular telephone with data messaging capabilities, a wireless Internet appliance, a wireless device, a user equipment, a smartphone, a tablet, a laptop, a notebook, or a data communication device, as non-limiting examples.

Where mobile device <NUM> is enabled for two-way communication, it may incorporate a communication subsystem <NUM>, including a receiver <NUM> and a transmitter <NUM>, as well as associated components such as one or more antenna elements <NUM> and <NUM>, local oscillators (LOs) <NUM>, and a processing module such as a digital signal processor (DSP) <NUM>. As will be apparent to those skilled in the field of communications, the particular design of the communication subsystem <NUM> will be dependent upon the communication network in which the device is intended to operate.

Network access requirements will also vary depending upon the type of network <NUM>. In some networks network access is associated with a subscriber or user of mobile device <NUM>. A mobile device may require a removable user identity module (RUIM) or a subscriber identity module (SIM) card in order to operate on a network. The SIM/RUIM interface <NUM> is normally similar to a card-slot into which a SIM/RUIM card can be inserted and ejected. The SIM/RUIM card can have memory and hold many key configurations <NUM>, and other information <NUM> such as identification, and subscriber related information. Without a SIM card, the mobile device may still be capable of limited functionality, including placing an emergency call.

When required network registration or activation procedures have been completed, mobile device <NUM> may send and receive communication signals over the network <NUM>. As illustrated in <FIG>, network <NUM> can include multiple base stations communicating with the mobile device.

Signals received by antenna <NUM> through communication network <NUM> are input to receiver <NUM>, which may perform such common receiver functions as signal amplification, frequency down conversion, filtering, channel selection and the like. Analog to digital (A/D) conversion of a received signal allows more complex communication functions such as demodulation and decoding to be performed in the DSP <NUM>. In a similar manner, signals to be transmitted are processed, including modulation and encoding for example, by DSP <NUM> and input to transmitter <NUM> for digital to analog (D/A) conversion, frequency up conversion, filtering, amplification and transmission over the communication network <NUM> via antenna <NUM>. DSP <NUM> not only processes communication signals, but also provides for receiver and transmitter control. For example, the gains applied to communication signals in receiver <NUM> and transmitter <NUM> may be adaptively controlled through automatic gain control algorithms implemented in DSP <NUM>.

Mobile device <NUM> generally includes a processor <NUM> which controls the overall operation of the device. Communication functions, including data and optionally voice communications, are performed through communication subsystem <NUM>. Processor <NUM> also interacts with further device subsystems such as the display <NUM>, flash memory <NUM>, random access memory (RAM) <NUM>, auxiliary input/output (I/O) subsystems <NUM>, serial port <NUM>, one or more keyboards or keypads <NUM>, speaker <NUM>, microphone <NUM>, other communication subsystem <NUM> such as a short-range communications subsystem and any other device subsystems, such as sensors, generally designated as <NUM>. Serial port <NUM> may include a USB port or other port known to those in the art.

Some of the subsystems shown in <FIG> perform communication-related functions, whereas other subsystems may provide "resident" or on-device functions. Notably, some subsystems, such as keyboard <NUM> and display <NUM>, for example, may be used for both communication-related functions, such as entering a text message for transmission over a communication network, and device-resident functions such as a calculator or task list.

Operating system software used by the processor <NUM> may be stored in a persistent store such as flash memory <NUM>, which may instead be a read-only memory (ROM) or similar storage element (not shown). Those skilled in the art will appreciate that the operating system, specific device applications, or parts thereof, may be temporarily loaded into a volatile memory such as RAM <NUM>. Received communication signals may also be stored in RAM <NUM>.

As shown, flash memory <NUM> can be segregated into different areas for both computer programs <NUM> and program data storage <NUM>, <NUM>, <NUM> and <NUM>. These different storage types indicate that each program can allocate a portion of flash memory <NUM> for their own data storage requirements. On such program data storage may include a credential vault.

Processor <NUM>, in addition to its operating system functions, may enable execution of software applications on the mobile device. A predetermined set of applications that control basic operations, including at least data and voice communication applications for example, will normally be installed on mobile device <NUM> during manufacturing. Other applications could be installed subsequently or dynamically.

Applications and software may be stored on any computer readable storage medium. The computer readable storage medium may be a tangible or intransitory/non-transitory medium such as optical (e.g., CD, DVD, etc.), magnetic (e.g., tape) or other memory known in the art.

One software application may be a personal information manager (PIM) application having the ability to organize and manage data items relating to the user of the mobile device such as, but not limited to, e-mail, calendar events, voice mails, appointments, and task items. Further applications, including productivity applications, social media applications, games, among others, may also be loaded onto the mobile device <NUM> through the network <NUM>, an auxiliary I/O subsystem <NUM>, serial port <NUM>, short-range communications subsystem or any other suitable subsystem <NUM>, and installed by a user in the RAM <NUM> or a non-volatile store (not shown) for execution by the processor <NUM>. Such flexibility in application installation increases the functionality of the device and may provide enhanced on-device functions, communication-related functions, or both.

In a data communication mode, a received signal such as a text message or web page download will be processed by the communication subsystem <NUM> and input to the processor <NUM>, which may further process the received signal for output to the display <NUM>, or alternatively to an auxiliary I/O device <NUM>.

A user of mobile device <NUM> may also compose data items such as email messages for example, using the keyboard <NUM>, which may be a complete alphanumeric keyboard or telephone-type keypad, either physical or virtual, among others, in conjunction with the display <NUM> and possibly an auxiliary I/O device <NUM>. Such composed items may then be transmitted over a communication network through the communication subsystem <NUM>.

For voice communications which are optional, overall operation of mobile device <NUM> is similar, except that received signals may typically be output to a speaker <NUM> and signals for transmission may be generated by a microphone <NUM>. Alternative voice or audio I/O subsystems, such as a voice message recording subsystem, may also be implemented on mobile device <NUM>. Although voice or audio signal output is preferably accomplished primarily through the speaker <NUM>, display <NUM> may also be used to provide an indication of the identity of a calling party, the duration of a voice call, or other voice call related information for example.

Serial port <NUM> in <FIG> may be implemented in a mobile device for which synchronization with a user's desktop computer (not shown) may be desirable, but is an optional device component. Such a port <NUM> may enable a user to set preferences through an external device or software application and may extend the capabilities of mobile device <NUM> by providing for information or software downloads to mobile device <NUM> other than through a wireless communication network. As will be appreciated by those skilled in the art, serial port <NUM> can further be used to connect the mobile device to a computer to act as a modem or for charging a battery on the mobile device.

Other communications subsystems <NUM>, such as a short-range communications subsystem, is a further optional component which may provide for communication between mobile device <NUM> and different systems or devices, which need not necessarily be similar devices. For example, the subsystem <NUM> may include an infrared device and associated circuits and components or a Bluetooth™ communication module to provide for communication with similarly enabled systems and devices. Subsystem <NUM> may further include non-cellular communications such as WiFi or WiMAX, or near field communications.

Claim 1:
A method at a computing device (<NUM>), the method comprising:
detecting a trigger (<NUM>) that an authentication process is pending for an application or service (<NUM>), wherein the trigger includes placing input focus into a password entry area (<NUM>) of a user interface for the application or service (<NUM>), the user interface being displayed on a display (<NUM>) of the computing device (<NUM>), and the password entry area (<NUM>) being configured to receive a password for authenticating a user to the application or service (<NUM>);
indicating a locked or unlocked state of a credential vault (<NUM>) via the user interface for the application or service (<NUM>);
when the credential vault is in a locked state, activating (<NUM>) an authentication mechanism for the credential vault (<NUM>) without changing focus on the user interface for the application or service (<NUM>), wherein activating the authentication mechanism without changing focus on the user interface for the application or service (<NUM>) comprises directly activating a biometric sensor (<NUM>) or a wireless tag proximity sensor (<NUM>) for receiving a user input;
sending (<NUM>), to the credential vault (<NUM>), an input received by the biometric sensor (<NUM>) or wireless tag proximity sensor (<NUM>);
receiving (<NUM>), from the credential vault (<NUM>), a message indicating whether a verification of the received input has succeeded or failed; and
changing (<NUM>) the locked state of the credential vault indicated via the user interface for the application or service (<NUM>) from locked to unlocked, if the message indicates that the verification of the received input has succeeded.