DYNAMIC SEED AND KEY GENERATION FROM BIOMETRIC INDICIA

• US 20150263857A1
• Filed: 05/29/2014
• Published: 09/17/2015
• Est. Priority Date: 02/17/2010
• Status: Active Grant

• Current Assignee: CIP, LLC
• Original Assignee: Ceelox Patents, LLC
• Inventors: Pizano, Erix, Sass, Joe
• Granted Patent: US 9,160,532 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A system, a method, and a computer program for generating a seed and/or a key from live biometric indicia, such that all the information necessary for generating the seed and/or the key is not stored on a storage medium. The method comprises receiving a biometric template from a user and enrolling the template; assigning an optimization value to the enrolled biometric template; encrypting an item of test data using the optimization value, such that the optimization value is an encryption seed; storing the encrypted item of test data on the storage medium; destroying the encryption seed after encrypting the item of test data; receiving a live biometric template; comparing the templates and determining an interval based on a probability that the templates are specific to the same user; iteratively testing values within the interval to identify the value in the interval for decrypting the encrypted item of test data, wherein the value used to decrypt the item of test data is the encryption seed; and generating the key using the seed.

Claims

1. A non-transitory computer-readable storage medium encoded with code segments for regenerating a destroyed seed, the computer-readable storage medium comprising:

a comparison segment for comparing a live biometric template with an enrolled biometric template;

an interval-determining segment for determining a testing interval based upon a probability that the live biometric template and the enrolled biometric template are indicative of a specific user, and based upon an optimization value associated with the enrolled biometric template,

wherein the testing interval has a plurality of values therein,

wherein one of the plurality of values is indicative of or is the same as said destroyed seed;

an interval-filtering segment for applying a filter to the plurality of values within the testing interval so as to reduce noise within the testing interval, such that after application of the filter, the testing interval is a filtered testing interval,

wherein subsequent to applying the filter, the one of the plurality of values indicative of or the same as the destroyed seed remains in the filtered interval; and

a testing segment for iteratively testing the plurality of values within the filtered testing interval to determine a decrypting value,

wherein the testing comprises decrypting an encrypted item of test data,

wherein upon testing a particular value within the filtered testing interval and determining that the particular value is operable to decrypt the encrypted item of test data, the destroyed seed is regenerated and the testing segment ceases iteratively testing,

wherein said interval-filtering segment is executed subsequent to said interval determining segment but prior to iteratively testing the values within the filtered testing interval.

2. The medium of claim 1, further storing:

a key generation segment for generating a decryption key based on the regenerated seed.

3. The medium of claim 2, wherein the key generation segment is generated by a first reflective code segment.

4. The medium of claim 3, wherein the first reflective segment is generated by a second reflective segment.

5. The medium of claim 2, further comprising an authentication code segment for:

performing an HMAC-based one-time password algorithm to obtain a one-time password to be provided by a user;

receiving a password from the user; and

comparing the one-time password to the password received from the user.

6. The medium of claim 2, further comprising a decryption code segment for:

using the decryption key to decrypt the contents of a storage device.

7. The medium of claim 1, wherein the comparison segment compares a live fingerprint reading to an enrolled fingerprint template.

8. A method for regenerating a destroyed seed, comprising the steps of:

comparing a live biometric template with an enrolled biometric template to determine a probability that the live biometric template and the enrolled biometric template are indicative of a the same user;

based on the probability, determining a plurality of values, one of said plurality of values being indicative of or the same as the destroyed seed;

filtering the plurality of values to obtain a filtered plurality of values, one of said filtered plurality of values being indicative of or the same as the destroyed seed;

testing a value of the filtered plurality of values by using the value to decrypt an encrypted item of test data;

determining that the result of decrypting the encrypted item of test data matches an unencrypted item of test data;

based on the value, regenerating the destroyed seed.

9. The method of claim 8, further comprising the step of:

using the regenerated seed to generate a decryption key.

10. The method of claim 9, wherein a first reflective code segment is used to generate the decryption key.

11. The method of claim 10, wherein a second reflective code segment is used to generate the first reflective code segment.

12. The method of claim 9, wherein the decryption key is provided to an HMAC-based one-time password algorithm to obtain a one-time password to be provided by a user.

13. The method of claim 9, further comprising the step of using the decryption key to access a storage device.

14. The method of claim 8, wherein the live biometric template is a fingerprint reading.

15. A system for regenerating a destroyed seed, comprising:

a biometric sensor operable to obtain a live biometric template;

a computer storage medium storing an enrolled biometric template, an unencrypted item of test data, and an encrypted item of test data; and

a seed regeneration module operable to;

compare the live biometric template to the enrolled biometric template and determine a probability of match;

based on the probability, determining a plurality of values, one of said plurality of values being indicative of or the same as the destroyed seed;

filter the plurality of values to obtain a filtered plurality of values, one of said filtered plurality of values being indicative of or the same as the destroyed seed;

test a value of the filtered plurality of values by using the value to decrypt an encrypted item of test data;

determine that the result of decrypting the encrypted item of test data matches an unencrypted item of test data;

based on the value, regenerate the destroyed seed.

16. The system of claim 15, further comprising:

a key generation module operable to;

employ a first reflective code segment to generate a decryption key based on the regenerated seed.

17. The system of claim 16, wherein the key generation module employs a second reflective code segment to generate the first reflective code segment.

18. The system of claim 16, wherein key generation module provides the decryption key to an HMAC-based one-time password algorithm to obtain a one-time password to be provided by a user.

19. The system of claim 16, wherein the decryption key is useable to access a storage device.

20. The system of claim 15, wherein the biometric sensor is a fingerprint reader.