BIOMETRIC AUTHENTICATION FOR REMOTE INITIATION OF ACTIONS AND SERVICES

• US 20090100270A1
• Filed: 12/18/2008
• Published: 04/16/2009
• Est. Priority Date: 05/18/2001
• Status: Active Grant

• Current Assignee: Imprivata Incorporated
• Original Assignee: Imprivata Incorporated
• Inventors: Ting, David M.
• Granted Patent: US 8,220,063 B2
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In one aspect, the invention relates to generating a trusted communication channel with a client. An agent module is provided at the client along with a task set including one or more tasks. One or more client components needed to complete each of the tasks of the task set is determined, and it is further determined whether each of the needed client components is trustworthy. An equivalent component for components determined to be untrustworthy may be provided.

Claims

1-42. -42. (canceled)

43. An article of manufacture having computer-readable program portions encoded thereon for provisioning a client, the article comprising computer readable instructions for:

establishing an identity of a client user based on strong authentication data; and

based on the established user identity, remotely providing to the client computer a set of provisioning modules specific to the user for execution on the client computer, the execution of the provisioning modules causing transfer of information onto the client computer.

44. The article of manufacture of claim 43 wherein the strong authentication data is biometric indicia.

45. The article of manufacture of claim 43 further comprising instructions for causing, upon execution of the provisioning modules, installation of at least one of application programs and user-specific data onto the client computer.

46. The m article of manufacture of claim 45 further comprising instructions for obtaining the biometric indicia from the user by the client computer and transmitting the indicia to a server for identity establishment.

47. The article of manufacture of claim 44 further comprising instructions for obtaining the biometric indicia from the user by the client computer and are analyzing the indicia at the client computer for identity establishment.

48. A system for provisioning a client computer, the system comprising:

an authentication module establishing an identity of a client user based on strong authentication data; and

a server for remotely providing to the client computer, based on the established user identity, a set of provisioning modules specific to the user for execution on the client computer, the execution of the provisioning modules causing transfer information onto the client computer.

49. The system of claim 48 wherein the strong authentication data is biometric indicia.

50. The system of claim 48 wherein execution of the provisioning modules causes installation of at least one of application programs and user-specific data onto the client computer.

51. The system of claim 49 wherein the client computer comprises a biometric input device for obtaining the indicia.

52. The system of claim 51 wherein the client computer comprises a communication module for transmitting the indicia to the server for identity establishment.

53. The system of claim 51 wherein the client computer comprises an analysis module for analyzing the indicia for identity establishment.