Biometric identification data protection

• US 20050286746A1
• Filed: 06/25/2004
• Published: 12/29/2005
• Est. Priority Date: 06/25/2004
• Status: Active Grant

• Current Assignee: Tahoe Research Limited (f/k/a Learndale Limited) (Vector Capital Corporation)
• Original Assignee: Intel Corporation
• Inventors: Silvester, Kelan C.
• Granted Patent: US 7,492,925 B2
• Time in Patent Office: Days
• US Class Current: 382/116
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints

Abstract

Embodiments of the present invention can combine biometric identification data with additional information, or knowledge, to form a new type of security measure. One embodiment of the present invention obtains biometric identification data for accessing a particular context, identifies context identification data related to the particular context, and combines the biometric identification data and the context identification data into an identification template.

Claims

1. A method comprising:

obtaining biometric identification data for accessing a particular context;

identifying context identification data related to the particular context; and

combining the biometric identification data and the context identification data into an identification template.

2. The method of claim 1 wherein the biometric identification data comprises at least one of fingerprint data, retina scan data, or facial recognition data.

3. The method of claim 1 wherein the particular context comprises at least one of a device platform and a software application.

4. The method of claim 1 wherein the context identification data comprises at least one of a processor serial number, an asset serial number of a system, a platform configuration register (PCR) value, or a unique software application identifier.

5. The method of claim 1 further comprising:

determining a time factor for accessing the particular context; and

combining the time factor with the biometric identification data and the context identification data into the identification template.

6. The method of claim 5 wherein the time factor comprises at least one of a time limit, a time range, or a date for defining a validity of the identification template.

7. The method of claim 1 further comprising:

enrolling the identification template.

8. The method of claim 7 wherein enrolling the identification template comprises:

generating a one-way hash of the identification template; and

storing the one-way hash securely.

9. The method of claim 8 wherein storing the one-way hash securely comprises at least one of:

storing the one-way hash to a smart card;

storing the one-way hash to a trusted platform module (TPM);

or

encrypting the one-way hash.

10. The method of claim 7 wherein enrolling the identification template comprises:

generating a one-way hash of the identification template;

combining the one-way hash with the identification template into a hashed template; and

storing the hashed template securely.

11. The method of claim 7 wherein enrolling the identification template comprises:

registering the identification template with a network.

12. The method of claim 11 wherein registering the identification template with a network comprises:

providing the identification template to the network.

13. The method of claim 12 wherein registering the identification template with the network further comprises:

receiving a unique identifier for the template from the network; and

storing the unique identifier and the identification template securely.

14. The method of claim 1 further comprising:

authenticating a user based on the identification template.

15. The method of claim 14 wherein authenticating the user comprises:

comparing the biometric identification data to biometric identification data in one or more previously stored identification templates; and

if the biometric identification data matches the biometric identification data in a particular previously stored identification template, comparing the context identification data to context identification data in the particular previously stored identification template.

16. The method of claim 15 wherein authenticating the user further comprises:

denying authentication to the user if either the biometric identification data or the context identification do not match the particular previously stored identification template.

17. The method of claim 15 wherein authenticating the user further comprises:

generating a one-way hash from the particular previously stored identification template;

comparing the one-way hash to a previously stored one-way hash generated from the particular previously stored identification template; and

denying authentication to the user if the one-way hash and the previously stored one-way hash do not match.

18. The method of claim 15 wherein authenticating the user further comprises:

determining a current time;

comparing the current time to a time factor of the particular previously stored identification template; and

denying authentication to the user if the current time violates the time factor.

19. The method of claim 14 wherein, if an authentication attempt fails, the method further comprises:

applying a delay before allowing another authentication attempt.

20. The method of claim 14 wherein authenticating the user comprises:

generating a one-way hash from the identification template;

comparing the one-way hash to one or more previously stored one-way hashes; and

denying authentication to the user if the one-way hash does not match at least one of the previously stored one-way hashes.

21. The method of claim 14 wherein authenticating the user comprises:

providing the identification template to a network, said network to determine if the identification template has been revoked; and

denying authentication to the user if the identification template has been revoked.

22. The method of claim 14 further comprising:

authenticating the user based on at least one of a password or a personal identification number.

23. A method comprising:

obtaining biometric identification data for accessing a particular context;

identifying context identification data related to the particular context; and

authenticating a user based on the biometric identification data, the context identification data, and a previously stored identification template associated with the particular context.

24. The method of claim 23 wherein authenticating the user comprises:

comparing the biometric identification data to biometric identification data in the previously stored identification templates; and

if the biometric identification data matches the biometric identification data in the previously stored identification template, comparing the context identification data to context identification data in the previously stored identification template.

25. The method of claim 24 wherein authenticating the user further comprises:

denying authentication to the user if either the biometric identification data or the context identification do not match the previously stored identification template.

26. The method of claim 24 wherein authenticating the user further comprises:

generating a one-way hash from the previously stored identification template;

comparing the one-way hash to a previously stored one-way hash generated from the previously stored identification template; and

denying authentication to the user if the one-way hash and the previously stored one-way hash do not match.

27. The method of claim 24 wherein authenticating the user further comprises:

determining a current time;

comparing the current time to a time factor of the previously stored identification template; and

denying authentication to the user if the current time violates the time factor.

28. The method of claim 23 wherein the previously stored identification template comprises a previously stored one-way hash generated from previous biometric identification data and previous context identification data, and wherein authenticating the user comprises:

generating a one-way hash from the biometric identification data and the context identification data;

comparing the one-way hash to the previously stored one-way hash; and

denying authentication to the user if the one-way hash does not match the previously stored one-way hash.

29. A machine readable medium having stored thereon machine executable instructions that, when executed, implement a method comprising:

obtaining biometric identification data for accessing a particular context;

identifying context identification data related to the particular context; and

combining the biometric identification data and the context identification data into an identification template.

30. The machine readable medium of claim 29, the method further comprising:

determining a time factor for accessing the particular context; and

combining the time factor with the biometric identification data and the context identification data into the identification template.

31. The machine readable medium of claim 29, the method further comprising:

enrolling the identification template.

32. The machine readable medium of claim 31, wherein enrolling the identification template comprises:

generating a one-way hash of the identification template; and

storing the one-way hash securely.

33. The machine readable medium of claim 31 wherein enrolling the identification template comprises:

generating a one-way hash of the identification template;

combining the one-way hash with the identification template into a hashed template; and

storing the hashed template securely.

34. The machine readable medium of claim 31 wherein enrolling the identification template comprises:

registering the identification template with a network.

35. The machine readable medium of claim 29, the method further comprising:

authenticating a user based on the identification template.

36. The machine readable medium of claim 35 wherein authenticating the user comprises:

comparing the biometric identification data to biometric identification data in one or more previously stored identification templates; and

if the biometric identification data matches the biometric identification data in a particular previously stored identification template, comparing the context identification data to context identification data in the particular previously stored identification template.

37. The machine readable medium of claim 36 wherein authenticating the user further comprises:

generating a one-way hash from the particular previously stored identification template;

comparing the one-way hash to a previously stored one-way hash generated from the particular previously stored identification template; and

denying authentication to the user if the one-way hash and the previously stored one-way hash do not match.

38. The machine readable medium of claim 36 wherein authenticating the user further comprises:

determining a current time;

comparing the current time to a time factor of the particular previously stored identification template; and

denying authentication to the user if the current time violates the time factor.

39. The machine readable medium of claim 35 wherein authenticating the user comprises:

generating a one-way hash from the identification template;

comparing the one-way hash to one or more previously stored one-way hashes; and

denying authentication to the user if the one-way hash does not match at least one of the previously stored one-way hashes.

40. A machine readable medium having stored thereon machine executable instructions, the execution of which to implement a method comprising:

obtaining biometric identification data for accessing a particular context;

identifying context identification data related to the particular context; and

authenticating a user based on the biometric identification data, the context identification data, and a previously stored identification template associated with the particular context.

41. The machine readable medium of claim 40 wherein authenticating the user comprises:

comparing the biometric identification data to biometric identification data in the previously stored identification templates; and

if the biometric identification data matches the biometric identification data in the previously stored identification template, comparing the context identification data to context identification data in the previously stored identification template.

42. The machine readable medium of claim 41 wherein authenticating the user further comprises:

generating a one-way hash from the previously stored identification template;

comparing the one-way hash to a previously stored one-way hash generated from the previously stored identification template; and

denying authentication to the user if the one-way hash and the previously stored one-way hash do not match.

43. The machine readable medium of claim 41 wherein authenticating the user further comprises:

determining a current time;

comparing the current time to a time factor of the previously stored identification template; and

denying authentication to the user if the current time violates the time factor.

44. The machine readable medium of claim 40 wherein the previously stored identification template comprises a previously stored one-way hash generated from previous biometric identification data and previous context identification data, and wherein authenticating the user comprises:

generating a one-way hash from the biometric identification data and the context identification data;

comparing the one-way hash to the previously stored one-way hash; and

denying authentication to the user if the one-way hash does not match the previously stored one-way hash.

45. A system comprising:

a mobile electronic device; and

a security application to be implemented by the mobile electronic device, the security application to obtain biometric identification data for accessing the mobile electronic device;

identify device identification data related to the mobile electronic device; and

combine the biometric identification data and the device identification data into an identification template.

46. The system of claim 45, the security application further to:

generate a one-way hash of the identification template; and

store the one-way hash securely.

47. The system of claim 45, the security application further to:

generate a one-way hash of the identification template;

combine the one-way hash with the identification template into a hashed template; and

store the hashed template securely.

48. The system of claim 45, the security application further to:

compare the biometric identification data to biometric identification data in one or more previously stored identification templates; and

if the biometric identification data matches the biometric identification data in a particular previously stored identification template, compare the context identification data to context identification data in the particular previously stored identification template.

49. The system of claim 48, the security application further to:

generate a one-way hash from the particular previously stored identification template;

compare the one-way hash to a previously stored one-way hash generated from the particular previously stored identification template; and

deny authentication to the user if the one-way hash and the previously stored one-way hash do not match.

50. The system of claim 45, the security application further to:

generate a one-way hash from the identification template;

compare the one-way hash to one or more previously stored one-way hashes; and

deny authentication to the user if the one-way hash does not match at least one of the previously stored one-way hashes.