Biometric authentication with security against eavesdropping

• US 20020174346A1
• Filed: 05/17/2002
• Published: 11/21/2002
• Est. Priority Date: 05/18/2001
• Status: Active Grant

• Current Assignee: Imprivata Incorporated
• Original Assignee: Imprivata Incorporated
• Inventors: Ting, David M. T.
• Granted Patent: US 7,398,549 B2
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The invention relates to systems and methods for using a template in the authentication process using biometric data. In one embodiment, a module modifies a template of the reference set of biometric data with the candidate set of biometric data when the user is authenticated. In another embodiment, a module modifies a copy of the template of the reference biometric data with modification data thereby creating a challenge template. The client compares the challenge template to a candidate set of biometric data thereby creating a response vector. A module authenticates the user based on the response vector and the modification data.

Claims

1. A method for authentication using biometrics, the method comprising:

providing a reference template with a reference set of biometric data associated with an individual;

receiving an authentication request associated with a user;

generating a copy of the reference template;

modifying the copy of the reference template with modification data to generate a challenge template;

transmitting the challenge template;

receiving a response vector based at least-in part on the challenge template and a candidate set of biometric data; and

authenticating the user as the individual associated with the reference set of biometric data based at least in part on the response vector and the modification data.

2. The method of claim 1 further comprising:

receiving the candidate set of biometric data associated with the user; and

comparing the candidate set of biometric data with the challenge template thereby generating the response vector.

3. The method of claim 2 wherein the comparing step further comprises:

determining features in the candidate set of biometric data that match; and

determining features in the candidate set of biometric data that do not match.

4. The method of claim 3 wherein the authenticating step further comprises authenticating the user as the individual associated with the reference set of biometric data if the matched features is not less than a predetermined threshold and the mismatched features sufficiently matches the modification data.

5. The method of claim 1 further comprising registering the individual by generating the reference template with the reference set of biometric data from the individual.

6. The method of claim 1 wherein the authenticating step further comprises authenticating the user as the individual associated with the reference set of biometric data if at least a portion of the data represented by the response vector sufficiently matches the modification data.

7. The method of claim 1 wherein the modification data contains random data.

8. The method of claim 1 wherein the response vector is a hash result.

9. The method of claim 1 wherein the reference template is a portion of a supertemplate.

10. A system for authentication using biometrics, the system comprising a server including:

a reference template having a reference set of biometric data associated with an individual;

a modification module configured to generate a copy of the reference template and modify the copy of the reference template with modification data to generate a challenge template; and

an authentication module configured i) to receive a response vector based at least in part on the challenge template and a candidate set of biometric data and ii) to authenticate a user as the registered individual in response to the response vector and the modification data.

11. The system of claim 10 wherein the modification data contains random data.

12. The system of claim 10 wherein the response vector is a hash result.

13. The system of claim 10 wherein the template is a portion of a supertemplate.

14. The system of claim 10 further comprising:

a client in communication with the server, the client including;

a comparator module configured to compare the candidate set of biometric data, associated with the user, with the challenge template thereby generating the response vector.

15. The system of claim 14 wherein the comparator module is further configured i) to determine features in the candidate set of biometric data that match and ii) to determine features in the candidate set of biometric data that do not match.

16. The system of claim 15 wherein the authentication module is further configured to authenticate the user as the individual associated with the reference set of biometric data if the matched features is not less than a predetermined threshold and the mismatched features sufficiently matches the modification data.

17. The system of claim 10 further comprising a registration module configured to generate the reference template with the reference set of biometric data from the individual.

18. The system of claim 10 wherein the authentication module is further configured to authenticate the user as the individual associated with the reference set of biometric data if at least a portion of the data represented by the response vector sufficiently matches the modification data.

20. The article of claim 19 further comprising

a computer-readable program portion for receiving the candidate set of biometric data associated with the user;

and

a computer-readable program portion for comparing the candidate set of biometric data with the challenge template thereby generating the response vector.

21. The article of claim 20 further comprising a computer-readable program portion for registering the individual by generating the reference template with the reference set of biometric data from the individual.

19. An article of manufacture having computer-readable program portions embodied therein for authentication using biometrics, the article comprising:

a computer-readable program portion for providing a reference template with a reference set of biometric data associated with an individual;

a computer-readable program portion for receiving an authentication request associated with a user;

a computer-readable program portion for generating a copy of the reference template;

a computer-readable program portion for modifying the copy of the reference template with modification data to generate a challenge template;

a computer-readable program portion for transmitting the challenge template;

a computer-readable program portion for receiving a response vector based at least in part on the challenge template and a candidate set of biometric data; and

a computer-readable program portion for authenticating the user as the registered individual based at least in part on the response vector and the modification data.