Authentication Using Biometric Technology Through a Consumer Device

• US 20130232073A1
• Filed: 03/05/2013
• Published: 09/05/2013
• Est. Priority Date: 03/05/2012
• Status: Abandoned Application

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Sheets, John F., Wagner, Kim R.
• Application Number:
  US13/785,956
• Publication Number:
  US 20130232073A1
• Time in Patent Office: Days
• US Class Current: 705/44
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/389 Keeping log of transactions for guaranteeing non-repudiation of a transaction
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

Embodiments of the invention provide strong user authentication on a trusted consumer device without requiring the user to go through a formal registration process with the issuer or payment processing network. Certain embodiments allow the use of any biometric technology (e.g., fingerprint scan, iris scan, voice recognition, etc.) supported by their consumer device (e.g., smart phone, tablet computer) to authenticate the user. Additionally, the consumer device provides unforgeable evidence of the biometric match in the form of a biometric digital artifact to provide proof to a payment processing network that the match occurred. The payment processing network maintains a history of these authenticated transactions and biometric digital artifacts and as more and more non-fraudulent authenticated transactions occur over time, a higher level of trust (i.e., lower risk) is associated with the consumer device, biometric registration process, and the user.

Claims

1. A method, comprising:

receiving a first biometric data of a user;

comparing the first biometric data with a second biometric data of the user;

determining, from the comparison, whether the first biometric data and the second biometric data match according to a predetermined threshold; and

creating a biometric digital artifact based on the first biometric data, wherein the biometric digital artifact includes information regarding a type of biometric data received and the determination.

2. The method of claim 1 further comprising registering and storing the second biometric data.

3. The method of claim 1 further comprising sending payment information and the biometric digital artifact to a transaction processing network.

4. The method of claim 1 wherein the biometric digital artifact is a cryptographically generated value.

5. The method of claim 1 wherein the biometric data comprises a user voice sample.

6. A device, comprising:

a processor; and

a non-transitory computer-readable storage medium, comprising code executable by the processor for implementing a method comprising;

receiving a first biometric data of a user;

comparing the first biometric data with a second biometric data of the user;

determining, from the comparison, whether the first biometric data and the second biometric data match according to a predetermined threshold; and

creating a biometric digital artifact based on the first biometric data, wherein the biometric digital artifact includes information regarding a type of biometric data received and the determination.

7. The device of claim 6 wherein the method further comprises registering and storing the second biometric data.

8. The device of claim 6 wherein the method further comprises sending payment information and the biometric digital artifact to a payment processing network.

9. The device of claim 6 wherein the biometric digital artifact is a cryptographically generated value.

10. The device of claim 6 wherein the biometric data comprises a user fingerprint sample.

11. A method, comprising:

receiving payment information and a biometric digital artifact, wherein the biometric digital artifact is generated by a consumer device and comprises information regarding a type of biometric data, and a determination of a data match between a first biometric data of a user and a second biometric data of the user;

holding the biometric digital artifact in a queue for a predetermined period of time;

determining that the biometric digital artifact is valid; and

updating a user fraud profile with the biometric digital artifact based on the determination.

12. The method of claim 11 further comprising sending a validation result based upon the determination, and payment information to a point-of-sale (POS) terminal to complete a transaction.

13. The method of claim 11 wherein the determining comprises verifying the biometric digital artifact against one or more valid biometric digital artifacts.

14. The method of claim 11 wherein the updating further comprises adjusting a risk score based on a number of valid biometric digital artifacts received without fraudulent activity.

15. The method of claim 11 wherein the biometric digital artifact is a cryptographically generated value.

16. A server, comprising:

a processor; and

a non-transitory computer-readable storage medium, comprising code executable by the processor for implementing a method comprising;

receiving payment information and a biometric digital artifact, wherein the biometric digital artifact is generated by a consumer device and comprises information regarding a type of biometric data, and a determination of a data match between a first biometric data of a user and a second biometric data of the user;

holding the biometric digital artifact in a queue for a predetermined period of time;

determining that the biometric digital artifact is valid; and

updating a user profile with the biometric digital artifact based on the determination.

17. The server of claim 16 wherein the method further comprises sending a validation result based upon the determination, and payment information to a point-of-sale (POS) terminal to complete a transaction.

18. The server of claim 16 wherein the determining comprises verifying the biometric digital artifact against one or more valid biometric digital artifacts.

19. The server of claim 16 wherein the updating further comprises adjusting a risk score based on a number of valid biometric digital artifacts received without fraudulent activity.

20. The server of claim 16 wherein the biometric digital artifact is a cryptographically generated value.