Methods and systems for establishing trust of identity

• US 20040010696A1
• Filed: 10/31/2002
• Published: 01/15/2004
• Est. Priority Date: 10/31/2001
• Status: Abandoned Application

• Current Assignee: Sonavation, Inc.
• Original Assignee: Sonavation, Inc.
• Inventors: Cannon, Greg, Scott, Walter Guy
• Application Number:
  US10/284,439
• Publication Number:
  US 20040010696A1
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06Q 10/02 Reservations, e.g. for tickets, services or events
• CPC Class Codes: G06Q 10/087 Inventory or stock management, e.g. order filling, procurement or balancing against orders
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06V 10/94 Hardware or software architectures specially adapted for image or video understanding
• CPC Class Codes: G06V 40/1306 non-optical, e.g. ultrasonic or capacitive sensing
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

The present invention relates to methods and systems for establishing trust in an identity of an individual in a transaction with a transacting entity. Trust is based on secure biometric data such as a captured print. In one environment, an individual uses an identification device at or near a terminal to carry out the transaction. For example, the identification device may be coupled to the terminal by a wireless or wired link. The terminal is coupled over a network to an identity service provider and/or the transacting entity.

Claims

1. A method for establishing trust in an identity of an individual in a transaction with a transacting entity, comprising:

detecting a sample print of the individual at an identification device;

generating a print document that includes;

identity data associated with the individual, a reference print associated with the individual, and the detected sample print;

sending the generated print document to a terminal;

forwarding the print document to an identity service provider;

retrieving a database print associated with the individual from a database;

extracting minutia data from the reference print, sample print, and database print;

determining a score indicative of a match condition of the extracted minutia data; and

determining whether to trust the identity of the individual based on the score, whereby, the transaction between the individual and the transacting entity can proceed when the identity of the individual is trusted.

2. The method of claim 1, wherein said generating step includes attaching a first digital signature to the print document, wherein the first digital signature comprising at least the identity data encrypted with an individual private key associated with the individual.

3. The method of claim 2, wherein the individual private key is assigned by a certificate authority.

4. The method of claim 2, further comprising:

retrieving an individual public key associated with the individual private key from the database based on the identity data in the forwarded print document;

decrypting the attached first digital signature with the retrieved individual public key; and

verifying the decrypted first digital signature to confirm an individual with access to individual private key sent the print document;

whereby, trust of the identity of the individual is not permitted when said verifying step does not confirm an individual with access to individual private key sent the print document.

5. The method of claim 1, wherein said trust determining step comprises generating a boolean trust value based on the score indicating whether the identity of the individual is trusted or not trusted.

6. The method of claim 5, further comprising:

creating an identity document;

attaching a second digital signature to the identity document, wherein the second digital signature comprises an identity service provider identifier encrypted with an identity service provider individual private key associated with the identity service provider;

decrypting the attached second digital signature with a public key associated with the identity service provider private key; and

verifying the decrypted second digital signature to confirm an identity service provider with access to the identity service provider private key sent the identity document;

whereby, trust of the identity of the individual is not permitted when said verifying step does not confirm an identity service provider with access to the identity service provider private key sent the identity document.

7. The method of claim 6, further comprising:

obtaining the public key associated with the identity service provider private key from a certificate.

8. The method of claim 5, further comprising enabling the transaction with the transacting entity to proceed when the boolean trust value indicates the identity of the individual is trusted.

9. The method of claim 2, further comprising:

sending a certificate that includes an individual public key associated with the individual private key to the terminal;

retrieving an individual public key associated with the individual private key from the certificate;

decrypting the attached first digital signature with the retrieved individual public key; and

verifying the decrypted first digital signature to confirm an individual with access to individual private key sent the print document;

whereby, trust of the identity of the individual is not permitted when said verifying step does not confirm an individual with access to individual private key sent the print document.

10. The method of claim 9, wherein the certificate is generated by a certificate authority.

11. A method for establishing trust in an identity of an individual in a transaction with a transacting entity, comprising:

detecting a sample print of the individual at an identification device;

generating a print document that includes;

identity data associated with the individual, reference minutia data associated with the individual, and the detected sample print;

sending the generated print document to a terminal;

forwarding the print document to an identity service provider;

retrieving database minutia data associated with the individual from a database;

extracting sample minutia data from the sample print;

determining a score indicative of a match condition of the extracted sample minutia data, the reference minutia data, and the database minutia data; and

determining whether to trust the identity of the individual based on the score, whereby, the transaction between the individual and the transacting entity can proceed when the identity of the individual is trusted.

12. The method of claim 11, wherein said generating step includes attaching a first digital signature to the print document, wherein the first digital signature comprising at least the identity data encrypted with an individual private key associated with the individual.

13. The method of claim 12, wherein the individual private key is assigned by a certificate authority.

14. The method of claim 12, further comprising:

retrieving an individual public key associated with the individual private key from the database based on the identity data in the forwarded print document;

decrypting the attached first digital signature with the retrieved individual public key; and

verifying the decrypted first digital signature to confirm an individual with access to individual private key sent the print document;

whereby, trust of the identity of the individual is not permitted when said verifying step does not confirm an individual with access to individual private key sent the print document.

15. The method of claim 11, wherein said trust determining step comprises generating a boolean trust value based on the score indicating whether the identity of the individual is trusted or not trusted.

16. The method of claim 15, further comprising:

creating an identity document;

attaching a second digital signature to the identity document, wherein the second digital signature comprises the boolean trust value encrypted with an identity service provider individual private key associated with the identity service provider; and

further comprising;

decrypting the attached second digital signature with a public key associated with the identity service provider private key; and

verifying the decrypted second digital signature to confirm an identity service provider with access to the identity service provider private key sent the identity document;

whereby, trust of the identity of the individual is not permitted when said verifying step does not confirm an identity service provider with access to the identity service provider private key sent the identity document.

17. The method of claim 16, further comprising:

obtaining the public key associated with the identity service provider private key from a certificate.

18. The method of claim 15, further comprising enabling the transaction with the transacting entity to proceed when the boolean trust value indicates the identity of the individual is trusted.

19. A method for establishing trust in an identity of an individual in a transaction with a transacting entity, comprising:

detecting a sample print of the individual at an identification device;

extracting sample minutia data from the sample print at the identification device;

generating a print document that includes;

identity data associated with the individual, reference minutia data associated with the individual, and the extracted sample minutia data;

sending the generated print document to a terminal;

forwarding the print document to an identity service provider;

retrieving a database print associated with the individual from a database;

determining a score indicative of a match condition of the extracted sample minutia data, the reference minutia data, and the database minutia data

determining whether to trust the identity of the individual based on the score, whereby, the transaction between the individual and the transacting entity can proceed when the identity of the individual is trusted.

20. The method of claim 19, wherein said generating step includes attaching a first digital signature to the print document, wherein the first digital signature comprising at least the identity data encrypted with an individual private key associated with the individual.

21. The method of claim 20, wherein the individual private key is assigned by a certificate authority.

22. The method of claim 20, further comprising:

retrieving an individual public key associated with the individual private key from the database based on the identity data in the forwarded print document;

decrypting the attached first digital signature with the retrieved individual public key; and

verifying the decrypted first digital signature to confirm an individual with access to individual private key sent the print document;

whereby, trust of the identity of the individual is not permitted when said verifying step does not confirm an individual with access to individual private key sent the print document.

23. The method of claim 19, wherein said trust determining step comprises generating a boolean trust value based on the score indicating whether the identity of the individual is trusted or not trusted.

24. The method of claim 23, further comprising:

creating an identity document;

attaching a second digital signature to the identity document, wherein the second digital signature comprises an identity service provider identifier encrypted with an identity service provider individual private key associated with the identity service provider; and

further comprising;

decrypting the attached second digital signature with a public key associated with the identity service provider private key; and

verifying the decrypted second digital signature to confirm an identity service provider with access to the identity service provider private key sent the identity document;

whereby, trust of the identity of the individual is not permitted when said verifying step does not confirm an identity service provider with access to the identity service provider private key sent the identity document.

25. The method of claim 24, further comprising:

obtaining the public key associated with the identity service provider private key from a certificate.

26. The method of claim 23, further comprising enabling the transaction with the transacting entity to proceed when the boolean trust value indicates the identity of the individual is trusted.

27. A method for establishing trust in an identity of an individual in a transaction with a transacting entity, comprising:

detecting a sample print of the individual at an identification device;

extracting sample minutia data from the sample print at the identification device;

determining a score indicative of a match condition of the extracted sample minutia data and reference minutia data; and

determining whether to trust the identity of the individual based on the score, whereby, the transaction between the individual and the transacting entity can proceed when the identity of the individual is trusted.

28. The method of claim 27, further comprising:

generating an identity document at the identification device that includes a boolean trust value generated based on the score, the boolean trust value indicating whether the identity of the individual is trusted or not trusted; and

sending the generated identity document to a terminal.

29. The method of claim 28, wherein said generating step includes attaching a digital signature to the identity document, wherein the digital signature comprising at least the identity data encrypted with an individual private key associated with the individual;

and further comprising;

sending a certificate that includes an individual public key associated with the individual private key to the terminal; and

decrypting the attached digital signature with the public key sent in the certificate; and

verifying the decrypted digital signature to confirm an individual with access to the individual private key sent the identity document;

whereby, trust of the identity of the individual is not permitted when said verifying step does not confirm an individual with access to the individual private key sent the identity document.

30. The method of claim 29, wherein the certificate is generated by a certificate authority.

31. A method for establishing trust in an identity of an individual in a transaction with a transacting entity, comprising:

detecting a sample print of the individual at an identification device;

generating a print document that includes;

identity data associated with the individual, reference minutia data associated with the individual, and the detected sample print;

sending the generated print document to a terminal;

extracting sample minutia data from the sample print;

determining a score indicative of a match condition of the extracted sample minutia data and the reference minutia data; and

determining whether to trust the identity of the individual based on the score, whereby, the transaction between the individual and the transacting entity can proceed when the identity of the individual is trusted.

32. The method of claim 31, wherein said generating step includes attaching a digital signature to the print document, wherein the first digital signature comprising at least the identity data encrypted with an individual private key associated with the individual, and

further comprising:

sending a certificate that includes an individual public key associated with the individual private key to the terminal;

retrieving an individual public key associated with the individual private key from the certificate;

decrypting the attached first digital signature with the retrieved individual public key; and

verifying the decrypted first digital signature to confirm an individual with access to individual private key sent the print document;

whereby, trust of the identity of the individual is not permitted when said verifying step does not confirm an individual with access to individual private key sent the print document.

33. The method of claim 32, wherein the certificate is generated by a certificate authority.

34. The method of claim 31, wherein said trust determining step comprises generating a boolean trust value based on the score indicating whether the identity of the individual is trusted or not trusted.

35. A method for establishing trust in an identity of an individual in a transaction with a transacting entity, comprising:

detecting a sample print of the individual at an identification device;

extracting sample minutia data from the sample print;

generating a print document that includes;

identity data associated with the individual, reference minutia data associated with the individual, and the extracted sample minutia data;

sending the generated print document to a terminal;

determining a score indicative of a match condition of the extracted sample minutia data, the reference minutia data, and database minutia data; and

determining whether to trust the identity of the individual based on the score, whereby, the transaction between the individual and the transacting entity can proceed when the identity of the individual is trusted.

36. The method of claim 35, wherein said generating step includes attaching a digital signature to the print document, wherein the first digital signature comprising at least the identity data encrypted with an individual private key associated with the individual, and

further comprising:

sending a certificate that includes an individual public key associated with the individual private key to the terminal;

retrieving an individual public key associated with the individual private key from the certificate;

decrypting the attached first digital signature with the retrieved individual public key; and

verifying the decrypted first digital signature to confirm an individual with access to individual private key sent the print document;

whereby, trust of the identity of the individual is not permitted when said verifying step does not confirm an individual with access to individual private key sent the print document.

37. The method of claim 36, wherein the certificate is generated by a certificate authority.

38. The method of claim 35, wherein said trust determining step comprises generating a boolean trust value based on the score indicating whether the identity of the individual is trusted or not trusted.

39. A system for establishing trust in an identity of an individual in a transaction with a transacting entity, comprising:

an identification device that generates a print document including sample data and reference data; and

a terminal, communicatively coupled to said an identification device, whereby, the terminal can facilitate or enable the transaction when trust has been established based on said sample data and said reference data.

40. The system of claim 39, further comprising:

an identity service provider coupled to said terminal.

41. The system of claim 40, wherein said identity service provider performs at least one of extracting and matching operations on said sample data and said reference data.

42. The system of claim 39, wherein said an identification device comprises a handheld, wireless personal identification device.

43. A system for establishing trust in an identity of an individual in a transaction with a transacting entity, comprising:

means for generating a print document including sample data and reference data; and

means for establishing trust in the identity based on the sample data and reference data.

44. A system for establishing trust in an identity of an individual in a transaction with a transacting entity, comprising:

means for detecting a sample print of the individual at an identification device;

means for generating a print document that includes;

identity data associated with the individual, a reference print associated with the individual, and the detected sample print;

means for sending the generated print document to a terminal;

means for forwarding the print document to an identity service provider;

means for retrieving a database print associated with the individual from a database;

means for extracting minutia data from the reference print, sample print, and database print;

means for determining a score indicative of a match condition of the extracted minutia data; and

means for determining whether to trust the identity of the individual based on the score, whereby, the transaction between the individual and the transacting entity can proceed when the identity of the individual is trusted.