Patent ID: 12231570

DETAILED DESCRIPTION

Reference will now be made in detail to the present preferred embodiments of the invention, examples of which are illustrated in the accompanying drawings. Wherever possible, the same reference numbers are used in the drawings and the description to refer to the same or like parts.

FIG.1is an illustration of a system100for authenticating users102on a computer system110in accordance with an exemplary embodiment. As shown inFIG.1, the system100can include a computer system110, for example, a multifunction peripheral or multifunction printer (MFP) and one or more computer system120,130, which can be configured to host, for example, one or more of managed print services and/or authentication authority that supports, for example, an authentication protocol including Fast Identity Online (FIDO). The FIDO Alliance develops open and scalable technical specifications that allow people to access websites and applications, for example, through a common protocol using, for example, passkeys, for secure authentication. A passkey is a FIDO login credential, tied to an origin (website or application) and a physical device (e.g., client device140). Passkeys allow users to authenticate without having to enter a username, password, or provide any additional authentication factor, which can enable a user102to leverage, for example, smart phones and/or smart watches with passwordless authentication.

The system100can also include a user102, and a client device140that can authenticate that the user102, for example, for access to the computer system110as disclosed herein. In accordance with an embodiment, the client device140can be, for example, a mobile client, for example, a smart phone, a smart tablet, smart watch, or a biometric band that can be used an authentication device, for example, for authentication of the user102on the computer system110. The authentication of the user102on the computer system110can be, for example, a FIDO authentication workflow for access to the computer system110, for example, a multifunction peripheral (MFP) or printer112, and managed print services124,134that can be hosted on the computer systems120,130. The computer system110is configured to receive, for example, communications from a client device140via a near-field communication (NFC) or Bluetooth protocol.

The one or more computer systems110,120,130, and the client device140can include a processor or central processing unit (CPU), and one or more memories for storing software programs and data. The processor or CPU carries out the instructions of a computer program, which operates and/or controls at least a portion of the functionality of the devices the one or more computer systems110,120,130, and the client device140. The one or more computer systems110,120,130, and the client device140can also include an operating system (OS), which manages the computer hardware and provides common services for efficient execution of various software programs. For example, the software programs can include application software, for example, for managing an authentication module and/or biometric identifier, and/or printer driver software, for example, for one or more of the computer systems110,120,130, for example, the computer system110, for example, the multifunction peripheral (MFP) or printer112.

In accordance with an embodiment, the computer system110can be a multifunction peripheral (MFP) or printer112, which can include at least a copy function, an image reading function, a facsimile (fax) function, and a printer function, and forms an image on a sheet based on a print job multifunction peripheral (print instruction) received, for example, from the computer system110. The MFP or printer112preferably includes a display panel150.

The computer system110can alternatively, for example, be a medical device or a medical apparatus, which can be used, for example, for diagnostic and/or therapeutic purposes. Examples of medical devices or medical apparatuses can include medical imaging devices, which can obtain, for example, radiological, angiographic, sonographic, and/or tomographic images. Alternatively, the one or more computer systems110,120,130, for example, the computer system120,130can be, for example, a back-end database, or enterprise database system, which can be accessed by the one or more users indirectly through an external application, for example, through the computer system110.

In accordance with an embodiment, when the computer system110is a multifunction peripheral (MFP) or printer, the one or more computer systems120,130can be configured to host, for example, managed print services124,134. The managed print services124,134can include, for example, one or more of user authentication, monitoring and reporting, user and cost management, cost accounting and budget management, printer queue management, and workflow management. For example, user authentication can include control over identities of user, which can help ensure that users have been authenticated at a device before a print job is released and/or printed. The monitoring and report features can allow administrators to track and monitor usage in real time through regular, scheduled and on-demand reporting. The user and cost management feature can help manage and charge back costs by assigning users to cost centers, or enabling them to select the relevant cost center, billing or project code before printing a document. In addition, the user and cost management feature can be used to create print rules or policies, which can help ensure tighter cost management by allowing different user roles to access different devices and features. For example, the user and cost management feature can control, for example, duplex printing and/or color printing to individuals and/or groups. In addition, cost accounting and budget management provides for cost control and flexibility, which can be used as a print management solution that allows administrators to assign print budgets to users, with the option to top up their accounts. For example, in an environment such as a university, for example, this allows administrators to give students a free print quota that they can add to as required. In addition, a print queue management can be used for manage of individual production in addition to office print queues in an office, for example.

The one or more computer systems110,120,130, and the client device140can be connected via a communication network160. The communication network160may include, for example, a conventional type of network, wired or wireless, and may have any number of configurations, such as a star configuration, token ring configuration, or other known configurations. The communication network160may include one or more local area networks (“LANs”), wide area networks (“WANs”) (e.g., the Internet), virtual private networks (“VPNs”), peer-to-peer networks, near-field networks (e.g., Bluetooth®), cellular networks (for example, 3G, 4G, 5G, other generations), and/or any other interconnected data path across which multiple computing nodes may communicate.

Data may be transmitted in encrypted or unencrypted form between the one or more computer systems110,120,130, and the client device140using a variety of different communication protocols including, for example, various Internet layer, transport layer, or application layer protocols. For example, data may be transmitted between the one or more computer systems110,120,130, and the client device140via the network160using transmission control protocol/Internet protocol (TCP/IP), user datagram protocol (UDP), transmission control protocol (TCP), hypertext transfer protocol (HTTP), secure hypertext transfer protocol (HTTPS), dynamic adaptive streaming over HTTP (DASH), real-time streaming protocol (RTSP), real-time transport protocol (RTP) and the real-time transport control protocol (RTCP), file transfer protocol (FTP), WebSocket (WS), wireless access protocol (WAP), various messaging protocols (SMS, MMS, XMS, IMAP, SMTP, POP, WebDAV, etc.), or other known protocols.

As shown inFIG.1, the user102can present an authenticator to the computer system110. The authentication of the user102on the computer system110can be via, for example, the client device140via a near-field communication (NFC) or Bluetooth. For example, the user102can be authenticate on the client device140, which can be, for example, a security identification and authentication device (or authenticator), which uses automated methods of verifying or recognizing the identity of a living person based on a physiological or behavioral characteristic. Thus, the user need not to manually input passwords to the computer system110, for example, the multifunction peripheral (MFP) or printer112. The method of recognizing the user102can include, for example, fingerprints, electrocardiogram (ECG or EKG) information, facial images, iris, and voice recognition. For example, in accordance with an exemplary embodiment, the client device140can be a wearable device, for example, a Nymi™ band, which detection of the user102is based on the electrocardiogram (ECG) and its unique properties, e.g., electrical activity of the heartbeat of the user (e.g., wearer)102.

For example, authentication via the client device140can include the presentation, for example, of mobile device, smart phone, or smart watch of the user102to a vicinity of the authenticator (e.g., client device140) via a near-field communication (NFC) network (e.g., Bluetooth®) and wherein the user102has previously been authenticated on the mobile device or smart phone by one or more of a user identifier (ID) and password and/or a biometric identifier, for example, facial recognition, fingerprint, of the like. In accordance with an embodiment, the authentication of the user102can be a FIDO authentication workflow as disclosed herein.

In accordance with an exemplary embodiment, the authentication of the user102on the client device140can be a biometric identifier, which is a distinctive, measurable characteristics used to label and describe or identify an individual, including a metric related to human characteristics. For example, the biometric identifier can include physiological characteristics of an individual including but not limited fingerprints, palm veins, face recognition, DNA (or deoxyribonucleic acid), palm print, hand geometry, iris recognition, retina, and/or odor/scent.

In accordance with an embodiment, the authentication of the user102can be via the client device140using a FIDO protocol (or FIDO authentication workflow). The FIDO protocols use standard public key cryptography techniques to provide authentication. In accordance with an embodiment, the user102during registration with the computer system110, the client device140of the user102creates a new key pair. The client device140of the user102retains the private key and registers the public key with, for example, the computer system110. Authentication can be done by the client device140proving possession of the private key to the computer system110by signing a challenge. For example, the private key(s) of the client device140can be used only after the private key(s) are unlocked locally on the client device140by the user102. For example, in accordance with an embodiment, the local unlock of the private keys of the client device140can be accomplished by an action such as biometric identifier of the user102.

FIGS.2A and2Bis a flowchart illustrating an example of FIDO registration process200for a user102with an MFP112in accordance with an exemplary embodiment. As shown inFIGS.2A and2B, the process starts in step202where the user102opens, for example, a website (e.g., MFP application) associated with the MFP112on a user interface (or display screen) of the client device140or the display panel150of the MFP112. The website (or MFP application) will present the user with a FIDO registration application for the MFP112and/or managed print services124,134available on the MFP112. The FIDO registration application can be configured to register the client device140of the user102to access one or more of the MFP112and/or the managed print services124,134, of the MFP112. In accordance with an embodiment, the FIDO registration application can be, for example, on the display panel150of the MFP112, for registration of smart watches and/or wearable devices. In step204, the FIDO registration application on the client device140(or the display panel150of the MFP112) can request that the user102, for example, input a username and personal identification number (PIN) or password (e.g., login) to begin the FIDO registration process. The username and the PIN or password can be provided to the user102, for example, by the MFP112or managed print services124,134prior to the FIDO registration process. In step208, the FIDO server verifies the login from the user102and that the user102has been authorized to access the MFP112and one or more managed print services124,134associated with the MFP112. The entry of the login from the user102starts the FIDO registration process for the user102. The FIDO registration process, for example, can be with the FIDO server hosted on one or more of the computer systems112,120,130. In step210, the FIDO server returns a FIDO registration request to the registration application on the client device140of the user102, and which prompts the user102to choose a FIDO authenticator that that matches an acceptance policy of the MFP112, or the managed print services124,134. For example, in accordance with an embodiment, the acceptance policy of the MFP112can require that the FIDO authenticator, for example, can require that the user102enter a biometric identifier, for example, a fingerprint or facial recognition that the user102. In accordance with an embodiment, the biometric identifier can be, for example, the same biometric identifier that the user102uses to unlock the client device140, for example, a smart phone. If the FIDO server is hosted on one of the computer systems120,130, rather than the MFP112, the MFP112can act as FIDO client. In step212, the user102unlocks the FIDO authenticator on the client device102using, for example, a fingerprint reader or facial recognition on the client device140, a securely entered PIN, or other authentication method supported by the client device140. In accordance with an embodiment, the MFP112and/or the managed print services124,134can have an acceptance policy, which requires certain authenticators, for example, at least one biometric identifier, two-factor authentication (2FA), or multifactor authentication as an acceptance policy for the registered client device140. In step214, the client device140of the user creates a public/private key pair (e.g., passkey) unique for the client device140and the services provided the MFP112and the managed print services124,134supported by the MFP112. In step216, the public key is sent to the FIDO server112,120,130associated with the MFP112and the managed print services124,134. In accordance with an embodiment, if the FIDO server is hosted on computer systems120,130, the MFP112can include a FIDO client. The private key and any information about the authentication method (for example, biometric measurements) do not leave the client device140, such that the biometrics of the user102, for example, are not shared with the MFP112or the computer systems120,130.

In accordance with an embodiment, in step218, the user102can access the MFP112by opening, for example, the MFP application, which will present the user102with a login or sign in screen, which requires the user102to enter a password or biometric to unlock the FIDO authenticator in the client device140. In step220, the user102unlocks the FIDO authenticator on the client device140using the same authentication method as at the time of the registration of the client device140during a challenge from the MFP112(i.e., MFP's challenge). The client device140uses the user's account identifier provided by the MFP112to select the correct authentication method or key and signs the MFP's challenge. In step222, the client device140sends the signed challenge back to the MFP112, which verifies the signed challenge with the stored public key in the FIDO server and logs in (or signs in) the user102to the MFP112.

In accordance with an embodiment, the MFP112can be configured to send the MFP's challenge to the client device140upon the client device140being brought within a certain distance, for example, of the MFP112. For example, the communications between the client device140and the MFP112can be via a near field communication or Bluetooth protocol, and the detection of the client device140or a tap of the MFP112on a reader of the MFP112. Accordingly, the user102can be authorized to access the MFP112without an opening of the MFP application.

Once, the user102has been authenticated on the MFP112, in step224, the user102can use the managed print services124,134in which the user102has authorized by, for example, an administrator.

In addition, the FIDO protocol as disclosed can be a FIDO2 protocol that consist of a W3C Web Authentication (WebAuth) standard and the FIDO Client to Authenticator Protocol 2 (CTAP2).

In accordance with an embodiment, the method and system for custom authenticators using the FIDO protocol as disclosed herein, can also be integrated with one or more federation protocols, for example, Security Assertion Markup Language (SAML), OpenID Connect (OIDC), and Open Authorization (OAuth). For example, a SAML service provider (SP) can requests from the SAML identity provider (IDP) that user authentication be FIDO-based. In accordance with an embodiment, a SAML IDP returns a SAML Assertion to the service provider (SP) indicating that user authentication was performed using FIDO. A OIDC (relying party) RP requests from the OIDC Provider that authentication be FIDO-based. An OIDC Provider returns a token to the relying party (RP) indicating that user authentication was performed using FIDO, and how. In addition, FIDO could be leveraged in OAuth2 environments for user authentication prior to user consent and authorization to access a protected resource, for example, the managed print services.

FIG.3is a flowchart300for custom authenticators for multifunction peripherals (MFP) in accordance with an embodiment in accordance with an embodiment. As shown inFIG.3, is step310, a processor receives a Fast Online ID-based (FIDO-based) authentication from a client device140via a wireless communication, the FIDO-based authentication configured to provide a user102of the client device140access to the multifunction peripheral112. In step320, the processor determines a validity of the FIDO-based authentication from the client device140of the user102. In step330, the processor grants the user102access to the multifunction peripheral112when the validity of the FIDO-based authentication from the client device140of the user102has been validated.

In accordance with an embodiment, the FIDO-based authentication is based on a biometric identifier received by the client device140for the user102. For example, the biometric identifier of the FIDO-based authentication can be from biometric authenticator device. The biometric authenticator device can include one or more of a sensor, a scanning device, or an electronic reader, and wherein the biometric identifier of the user102being at least one physiological characteristic of the user102, and wherein the at least one physiological characteristic is selected from one or more of fingerprints, palm veins, face recognition, DNA (deoxyribonucleic acid), palm print, hand geometry, iris recognition, retina, and/or odor/scent.

In accordance with an embodiment, the validity of the FIDO-based authentication from client device140of the user102can include sending, by the processor, an online service challenge to the client device140of the user102to login with a previously registered device that matches an acceptance policy of the multifunction peripheral112, receiving, by the processor, a response to the online service challenger, the response including a private key from the client device140; and verifying, by the processor, that the private key received from the client device140matches a stored public key in a FIDO server. In accordance with an embodiment, the processor can be a FIDO client on the multifunction peripheral112, and the method further includes accessing the FIDO server that is external to the multifunction peripheral112to verify that the private key received from the client device140matches the stored public key in the FIDO server. In addition, the online service challenge can be received by the client device140via a pop-up, the pop-up being a graphical user102interface (GUI) that appears on a display of the client device140.

In accordance with an embodiment, the client device140is a mobile device, a smart phone, or a wearable device. In addition, the wireless communication can be a near-field communication (NFC) or a Bluetooth technology standard.

In accordance with an embodiment, the method further includes granting, by the processor, access to the user102to one or more managed print services provider by a service provider to the multifunction peripheral112. The processor and the service provider can be hosted, for example, on an internal web server.

In accordance with an embodiment, the client device140is a smart phone or a smart watch and the multifunction peripheral112includes a reader, and wherein the reader of the multifunction peripheral112receives the FIDO-based authentication from a tap of the smart phone or the smart watch on the reader.

In accordance with an exemplary embodiment, the receiving of the FIDO-based authentication from the client device140for the user102can be via the communication protocol on the processor, which does not require an opening of a website on the client device140.

In accordance with an embodiment, the method further includes receiving, by the processor, the FIDO-based authentication from a reader that is external to the multifunction peripheral112. The FIDO-based authentication can be from the client device140using a same authenticator as the user102uses to access the client device140. For example, the same authenticator can be at least one of a biometric identifier or a multifactor authentication.

In accordance with an embodiment, the processor is part of the multifunction peripheral112, and the granted access to the multifunction peripheral112for the user102include access to managed print services hosted by a service provider external to the multifunction peripheral112.

FIG.4illustrates a representative computer system400in which embodiments of the present disclosure, or portions thereof, may be implemented as computer-readable code executed on hardware. For example, the one or more computer systems110,112,120,130, or client devices140associated with the method and system for custom authenticators as disclosed herein may be implemented in whole or in part by a computer system400using hardware, software executed on hardware, firmware, non-transitory computer readable media having instructions stored thereon, or a combination thereof and may be implemented in one or more computer systems or other processing systems. Hardware, software executed on hardware, or any combination thereof may embody modules and components used to implement the methods and steps of the presently described method and system.

If programmable logic is used, such logic may execute on a commercially available processing platform configured by executable software code to become a specific purpose computer or a special purpose device (for example, programmable logic array, application-specific integrated circuit, etc.). A person having ordinary skill in the art may appreciate that embodiments of the disclosed subject matter can be practiced with various computer system configurations, including multi-core multiprocessor systems, minicomputers, mainframe computers, computers linked or clustered with distributed functions, as well as pervasive or miniature computers that may be embedded into virtually any device. For instance, at least one processor device and a memory may be used to implement the above described embodiments.

A processor unit or device as discussed herein may be a single processor, a plurality of processors, or combinations thereof. Processor devices may have one or more processor “cores.” The terms “computer program medium,” “non-transitory computer readable medium,” and “computer usable medium” as discussed herein are used to generally refer to tangible media such as a removable storage unit418, a removable storage unit422, and a hard disk installed in hard disk drive412.

Various embodiments of the present disclosure are described in terms of this representative computer system400. After reading this description, it will become apparent to a person skilled in the relevant art how to implement the present disclosure using other computer systems and/or computer architectures. Although operations may be described as a sequential process, some of the operations may in fact be performed in parallel, concurrently, and/or in a distributed environment, and with program code stored locally or remotely for access by single or multi-processor machines. In addition, in some embodiments the order of operations may be rearranged without departing from the spirit of the disclosed subject matter.

A processor device404may be processor device specifically configured to perform the functions discussed herein. The processor device404may be connected to a communications infrastructure406, such as a bus, message queue, network, multi-core message-passing scheme, etc. The network may be any network suitable for performing the functions as disclosed herein and may include a local area network (“LAN”), a wide area network (“WAN”), a wireless network (e.g., “Wi-Fi”), a mobile communication network, a satellite network, the Internet, fiber optic, coaxial cable, infrared, radio frequency (“RF”), or any combination thereof. Other suitable network types and configurations will be apparent to persons having skill in the relevant art. The computer system400may also include a main memory408(e.g., random access memory, read-only memory, etc.), and may also include a secondary memory410. The secondary memory410may include the hard disk drive412and a removable storage drive414, such as a floppy disk drive, a magnetic tape drive, an optical disk drive, a flash memory, etc.

The removable storage drive414may read from and/or write to the removable storage unit418in a well-known manner. The removable storage unit418may include a removable storage media that may be read by and written to by the removable storage drive414. For example, if the removable storage drive414is a floppy disk drive or universal serial bus port, the removable storage unit418may be a floppy disk or portable flash drive, respectively. In one embodiment, the removable storage unit418may be non-transitory computer readable recording media.

In some embodiments, the secondary memory410may include alternative means for allowing computer programs or other instructions to be loaded into the computer system400, for example, the removable storage unit422and an interface420. Examples of such means may include a program cartridge and cartridge interface (e.g., as found in video game systems), a removable memory chip (e.g., EEPROM, PROM, etc.) and associated socket, and other removable storage units422and interfaces420as will be apparent to persons having skill in the relevant art.

Data stored in the computer system400(e.g., in the main memory408and/or the secondary memory410) may be stored on any type of suitable computer readable media, such as optical storage (e.g., a compact disc, digital versatile disc, Blu-ray disc, etc.) or magnetic storage (e.g., a hard disk drive). The data may be configured in any type of suitable database configuration, such as a relational database, a structured query language (SQL) database, a distributed database, an object database, etc. Suitable configurations and storage types will be apparent to persons having skill in the relevant art.

The computer system400may also include a communications interface424. The communications interface424may be configured to allow software and data to be transferred between the computer system400and external devices. Exemplary communications interfaces424may include a modem, a network interface (e.g., an Ethernet card), a communications port, a PCMCIA slot and card, etc. Software and data transferred via the communications interface424may be in the form of signals, which may be electronic, electromagnetic, optical, or other signals as will be apparent to persons having skill in the relevant art. The signals may travel via a communications path426, which may be configured to carry the signals and may be implemented using wire, cable, fiber optics, a phone line, a cellular phone link, a radio frequency link, etc.

The computer system400may further include a display interface402. The display interface402may be configured to allow data to be transferred between the computer system400and external display430. Exemplary display interfaces402may include high-definition multimedia interface (HDMI), digital visual interface (DVI), video graphics array (VGA), etc. The display430may be any suitable type of display for displaying data transmitted via the display interface402of the computer system400, including a cathode ray tube (CRT) display, liquid crystal display (LCD), light-emitting diode (LED) display, capacitive touch display, thin-film transistor (TFT) display, etc. Computer program medium and computer usable medium may refer to memories, such as the main memory408and secondary memory410, which may be memory semiconductors (e.g., DRAMs, etc.). These computer program products may be means for providing software to the computer system400. Computer programs (e.g., computer control logic) may be stored in the main memory408and/or the secondary memory410. Computer programs may also be received via the communications interface424. Such computer programs, when executed, may enable computer system400to implement the present methods as discussed herein. In particular, the computer programs, when executed, may enable processor device404to implement the methods illustrated byFIGS.1-3, as discussed herein. Accordingly, such computer programs may represent controllers of the computer system400. Where the present disclosure is implemented using software executed on hardware, the software may be stored in a computer program product and loaded into the computer system400using the removable storage drive414, interface420, and hard disk drive412, or communications interface424.

The processor device404may comprise one or more modules or engines configured to perform the functions of the computer system400. Each of the modules or engines may be implemented using hardware and, in some instances, may also utilize software executed on hardware, such as corresponding to program code and/or programs stored in the main memory408or secondary memory410. In such instances, program code may be compiled by the processor device404(e.g., by a compiling module or engine) prior to execution by the hardware of the computer system400. For example, the program code may be source code written in a programming language that is translated into a lower level language, such as assembly language or machine code, for execution by the processor device404and/or any additional hardware components of the computer system400. The process of compiling may include the use of lexical analysis, preprocessing, parsing, semantic analysis, syntax-directed translation, code generation, code optimization, and any other techniques that may be suitable for translation of program code into a lower level language suitable for controlling the computer system400to perform the functions disclosed herein. It will be apparent to persons having skill in the relevant art that such processes result in the computer system400being a specially configured computer system400uniquely programmed to perform the functions discussed above.

In accordance with an exemplary embodiment, the methods and processes as disclosed can be implemented on a non-transitory computer readable medium. The non-transitory computer readable medium may be a magnetic recording medium, a magneto-optic recording medium, or any other recording medium which will be developed in future, all of which can be considered applicable to the present invention in all the same way. Duplicates of such medium including primary and secondary duplicate products and others are considered equivalent to the above medium without doubt. Furthermore, even if an embodiment of the present invention is a combination of software and hardware, it does not deviate from the concept of the invention at all. The present disclosure may be implemented such that its software part has been written onto a recording medium in advance and will be read as required in operation.

As used herein, an element or step recited in the singular and preceded by the word “a” or “an” should be understood as not excluding plural elements or steps, unless such exclusion is explicitly recited. Furthermore, references to “example embodiment” or “one embodiment” of the present disclosure are not intended to be interpreted as excluding the existence of additional examples that also incorporate the recited features.

The patent claims at the end of this document are not intended to be construed under 35 U.S.C. § 112(f) unless traditional means-plus-function language is expressly recited, such as “means for” or “step for” language being expressly recited in the claim(s).

It will be apparent to those skilled in the art that various modifications and variation can be made to the structure of the present invention without departing from the scope or spirit of the invention. In view of the foregoing, it is intended that the present invention cover modifications and variations of this invention provided they fall within the scope of the following claims and their equivalents.