SECURE METHOD AND APPARATUS TO VERIFY PERSONAL IDENTITY OVER A NETWORK

• US 20100150353A1
• Filed: 11/10/2009
• Published: 06/17/2010
• Est. Priority Date: 12/11/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Truntschka, Carole, Marmigere, Gerard, Bauchot, Frederic, Tressols, Florence
• Granted Patent: US 8,406,428 B2
• Time in Patent Office: Days
• US Class Current: 380/282
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

The present application provides an apparatus and method for verifying a user, via captured biometric characteristics of the user, who is interacting online. The captured biometrics are guaranteed to be captured in real-time, and avoids the possibility of providing biometrics that were previously captured, by sending to the user a time-sensitive challenge and requiring the user to provide the requested biometric information within a predetermined time period. Therefore, the present invention is best positioned for environments where trusted identification of a user is needed online to facilitate secure transactions.

Claims

1. A self-contained apparatus for on-demand authentication of a user over a network of computing devices, where a first computing device connected to the network of computing devices issues a temporary challenge to the user for authentication, comprising:

means for capturing biometric information of the user in response to a received temporary challenge from the first computing device, whose validity is limited in time;

means for encrypting the biometric information with the received challenge as an encrypted response;

means for returning the encrypted challenge to the first computing device; and

means for authenticating the user by processing the encrypted challenge within a limited amount of time.

2. The self-contained apparatus according to claim 1, wherein the means for encrypting utilizes a public key encryption algorithm and the encrypted response is encrypted with a private key issued to the user.

3. The self-contained apparatus according to claim 2, wherein the public key encryption algorithm includes RSA algorithm.

4. The self-contained apparatus according to claim 2, further comprising a protected memory storing the private key of the user.

5. The self-contained apparatus according to claim 2, wherein the encrypted response includes a hashing of the biometric information and the received challenge.

6. The self-contained apparatus according to claim 5, wherein the hashing is according to at least one of an MD5 hash algorithm and an SHA-1 hash algorithm.

7. The self-contained apparatus according to claim 1, wherein the received challenge was transmitted by a virtual world server.

8. The self-contained apparatus according to claim 1, wherein the biometric information includes digitally captured human characteristics of at least one of a fingerprint, a handprint, a hand-written signature, an iris and an retina.

9. A method for on-demand authentication of a user, comprising:

receiving a challenge issued by a first computing device connected to a network of computing devices, at a user device via a network connection;

capturing, at the user device, biometric information of the user in response to a received challenge, whose validity is limited in time, from a trusted third party;

encrypting the biometric information with the received challenge as an encrypted response;

returning the encrypted challenge to the first computing; and

means for authenticating the user by processing the encrypted challenge within a limited amount of time.

10. The method according to claim 9, wherein the encrypting utilizes a public key encryption algorithm and the encrypted response is encrypted with a private key issued to the user.

11. The method according to claim 10, wherein the public key encryption algorithm includes RSA algorithm.

12. The method according to claim 10, further comprising a protected memory storing the private key of the user.

13. The method according to claim 10, wherein the encrypted response includes a hashing of the biometric information and the received challenge.

14. The method according to claim 13, wherein the hashing is according to at least one of an MD5 hash algorithm and an SHA-1 hash algorithm.

15. The method according to claim 9, wherein the first computing device is a virtual world server.

16. The method according to claim 9, wherein the biometric information includes digitally captured human characteristics of at least one of a fingerprint, a handprint, a hand-written signature and an iris.