Authentication server using multiple metrics for identity verification

• US 20030105966A1
• Filed: 05/02/2002
• Published: 06/05/2003
• Est. Priority Date: 05/02/2001
• Status: Abandoned Application

• Current Assignee: SecuGen Corporation (Pivotec Corp.)
• Original Assignee: SecuGen Corporation (Pivotec Corp.)
• Inventors: Tong, William, Ahn, Jun-Young, Pu, Eric, Sadler, Rick, Lee, Dong Won, Ma, Haili
• Application Number:
  US10/139,661
• Publication Number:
  US 20030105966A1
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

Disclosed is a system for authenticating a user on a computer network using multiple user metrics. The system includes a service provider, a client and an authentication server. The service provider provides a service to clients on the computer network. The client provides authentication information of the user prior to receiving services from the service provider. The authentication information includes at least a supplied user credential associated with the user of the client, a predetermined session code and an extracted biometric template representing biometric information associated with the user of the client. The authentication server verifies the identity of the user by analyzing the supplied user credential, the predetermined session code and the extracted biometric template.

Claims

1. An method of authenticating identity of a user of a client on a computer network including:

extracting a biometric template from the user;

bundling the extracted biometric template with a supplied user credential and predetermined session code;

providing the extracted biometric template, supplied user credential and predetermined session code to an authentication server;

comparing the extracted biometric template, supplied user credential and predetermined session code with, respectively, a registered biometric template, a registered user credential and a session code stored in the authentication server.

2. The method of claim 1 further including:

generating a new session code in the authentication server, the new session code different from the predetermined session code; and

forwarding the new session code to the client to be used during a subsequent transaction.

3. The method of claim 2 further including storing a copy of the new session code in the authorization server.

4. The method of claim 3 further including providing a positive authentication response to a service requesting user authentication on the condition that the extracted biometric template match the registered biometric template, the supplied user credential match the registered user credential and the predetermined session code match the session code stored in the authentication server.

5. The method of claim 4 wherein extracting the extracted biometric template includes:

providing a biometric input device connected to the client;

inputting biometric information from the user into the biometric input device.

6. The method of claim 5 wherein bundling the extracted biometric template with the supplied user credential and predetermined session code is completed by the client.

7. The method of claim 6 wherein bundling the extracted biometric template with the supplied user credential includes bundling the extracted biometric template with a user ID, password or token.

8. The method of claim 7 wherein inputting biometric information from the user includes inputting user fingerprint information.

9. A system for authenticating a user on a computer network including:

a service provider for providing a service to clients on the computer network;

a client for providing authentication information prior to receiving services from the service provider, the authentication information including at least a supplied user credential associated with the user of the client, a predetermined session code and an extracted biometric template representing biometric information associated with the user of the client; and

an authentication server for verifying the identity of the user by analyzing the supplied user ID, the predetermined session code and the extracted biometric template.

10. The system of claim 9 wherein the predetermined session code is generated by the authentication server and provided to the client to the used during an authentication transaction.

11. The system of claim 10 wherein;

the supplied user credential is entered into the client by the user;

the predetermined session code is provided by the client to the authentication server;

the extracted biometric template is generated from biometric information entered by the user into the client computer; and

the supplied user credential, the predetermined session code and the extracted biometric template are each forwarded to the authentication server from the client.

12. The system of claim 11 further including at least a registered user credential, a session code stored in the authentication server and a registered biometric template each stored in the authentication server and each associated with the user of the client wherein the authentication server will compare the supplied user credential with the registered user credential, predetermined session code with the session code stored in the authentication server and the extracted biometric template with the registered biometric template.

13. The system of claim 12 further including a fingerprint input device connected with the client and wherein the extracted biometric template and the registered biometric template are each fingerprint templates.