AUTHENTICATION USING BIOMETRIC TECHNOLOGY THROUGH A CONSUMER DEVICE

• US 20130290136A1
• Filed: 05/21/2013
• Published: 10/31/2013
• Est. Priority Date: 03/05/2012
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Sheets, John F., Wagner, Kim R.
• Granted Patent: US 9,390,445 B2
• Time in Patent Office: Days
• US Class Current: 705/26.35
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments of the invention provide strong user authentication on a consumer device without requiring the user to go through a formal registration process with the issuer or processing network. Certain embodiments allow the use of any biometric technology (e.g., fingerprint scan, iris scan, voice recognition, etc.) supported by their consumer device (e.g., smart phone, tablet computer, personal computer) to authenticate the user. Additionally, the consumer device provides unforgeable evidence of the biometric match in the form of a biometric digital artifact to provide proof to a processing network that the match occurred. The processing network maintains a history of these authenticated transactions and biometric digital artifacts and as more and more non-fraudulent authenticated transactions occur over time, a higher level of trust (i.e., lower risk) is associated with the consumer device, biometric registration process, and the user.

Claims

1. A method for authenticating a user for a transaction, comprising:

receiving, by a processor, a first biometric data of a user;

comparing, by the processor, the first biometric data with a second biometric data of the user stored on a device, wherein the first biometric data and the second biometric data comprise a user voice sample;

determining, by the processor, from the comparison, whether the first biometric data and the second biometric data match according to a predetermined threshold, wherein the predetermined threshold indicates a number of matching biometric features between the first biometric data and the second biometric data; and

creating, by the processor, a biometric digital artifact based on the first biometric data, wherein the biometric digital artifact includes information regarding a type of biometric data received and the determination.

2. The method of claim 1 further comprising registering the second biometric data on the device.

3. The method of claim 1 further comprising sending transaction information and the biometric digital artifact to a transaction processing network.

4. The method of claim 1 wherein the biometric digital artifact is a cryptographically generated value.

5. The method of claim 1 wherein the biometric data comprises a user fingerprint sample, a user voice sample, a user iris image sample, or a user face image sample.

6. A device for authenticating a user for a transaction, comprising:

a processor; and

a non-transitory computer-readable storage medium, comprising code executable by the processor for implementing a method comprising;

receiving a first biometric data of a user;

comparing the first biometric data with a second biometric data of the user stored on the device, wherein the first biometric data and the second biometric data comprise a user voice sample;

determining, from the comparison, whether the first biometric data and the second biometric data match according to a predetermined threshold, wherein the predetermined threshold indicates the degree to which the first biometric data and the second biometric data match; and

creating a biometric digital artifact based on the first biometric data, wherein the biometric digital artifact includes information regarding a type of biometric data received and the determination.

7. The device of claim 6 wherein the method further comprises registering the second biometric data on the device.

8. The device of claim 6 wherein the method further comprises sending information and the biometric digital artifact to a processing network.

9. The device of claim 6 wherein the biometric digital artifact is a cryptographically generated value.

10. The device of claim 6 wherein the biometric data comprises a user fingerprint sample, a user voice sample, a user iris image sample, or a user face image sample.

11. A method for authenticating a user for a transaction, comprising:

receiving, by a device, transaction data and a biometric digital artifact, wherein the biometric digital artifact is generated by a consumer device and comprises information regarding a user voice sample, and a determination of a data match between a first biometric data of a user and a second biometric data of the user;

holding, by a processor, the biometric digital artifact in a queue for a predetermined period of time;

determining, by a processor, that the biometric digital artifact is valid;

forwarding, by a processor, the biometric digital artifact to a database; and

updating, by a processor, a user fraud profile within the database with the biometric digital artifact based on the determination.

12. The method of claim 11 further comprising sending a validation result based upon the determination, and transaction information to a transaction completion device to complete a transaction.

13. The method of claim 11 wherein the determining comprises verifying the biometric digital artifact against one or more valid biometric digital artifacts.

14. The method of claim 11 wherein the updating further comprises adjusting a risk score based on a number of valid biometric digital artifacts received without fraudulent activity.

15. The method of claim 11 wherein the biometric digital artifact is a cryptographically generated value.

16. A server for authenticating a user for a transaction, comprising:

a processor; and

a non-transitory computer-readable storage medium, comprising code executable by the processor for implementing a method comprising;

receiving transaction data and a biometric digital artifact, wherein the biometric digital artifact is generated by a consumer device and comprises information regarding a user voice sample, and a determination of a data match between a first biometric data of a user and a second biometric data of the user;

holding the biometric digital artifact in a queue for a predetermined period of time;

determining that the biometric digital artifact is valid;

forwarding the biometric digital artifact to a database; and

updating a user profile within the database with the biometric digital artifact based on the determination.

17. The server of claim 16 wherein the method further comprises sending a validation result based upon the determination, and transaction information to a transaction completion device to complete a transaction.

18. The server of claim 16 wherein the determining comprises verifying the biometric digital artifact against one or more valid biometric digital artifacts.

19. The server of claim 16 wherein the updating further comprises adjusting a risk score based on a number of valid biometric digital artifacts received without fraudulent activity.

20. The server of claim 16 wherein the biometric digital artifact is a cryptographically generated value.