SYSTEM AND METHOD FOR ELECTRONIC KEY PROVISIONING AND ACCESS MANAGEMENT IN CONNECTION WITH MOBILE DEVICES

• US 20150334562A1
• Filed: 05/13/2015
• Published: 11/19/2015
• Est. Priority Date: 05/13/2014
• Status: Active Grant

• Current Assignee: Element Inc.
• Original Assignee: Element Inc.
• Inventors: Perold, Adam, Abrams, Daniel
• Granted Patent: US 9,913,135 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data

Abstract

Novel systems and methods are disclosed for electronic key provisioning and access management in connection with mobile devices. The electronic keys can be time-denominated and event-denominated, thereby increasing the security and ease of use of access management for physical or virtual resources. The access management is granted in a protocol based on biometric features, contextual data, electronic keys, or a combination thereof.

Claims

1. A computer-implemented system for electronic key provisioning and access management, the system comprising:

(a) a digital processing device comprising a memory module and an operating system configured to perform executable instructions;

(b) a computer program including instructions processed by the digital processing device to execute an application comprising;

(i) a software module configured to obtain one or more biometric features of an end user in a contact-free process, wherein the one or more biometric features comprise features derived from one or more biometric modalities;

a fingerprint, a palm print, an iris, a retina, a face, a human cardiac rhythm, and a human voice;

(ii) a software module configured to create or receive an electronic key, wherein the electronic key is revocable, or time-denominated, or event-denominated, or a combination thereof; and

(iii) a software module configured to grant an access to a physical or virtual resource based on the one or more biometric features, or on the electronic key, or on both thereof.

2. The system of claim 1, wherein the granting the access comprises verifying an identity of the end user based on the one or more biometric features and subsequently unlocking the physical or virtual resource.

3. The system of claim 1, wherein the granting the access comprises (a) a simultaneous or near-simultaneous execution of events, or (b) an asynchronous execution of the events, the events being selected from the following group:

(a) verification or identification of the one or more biometric features of the end user;

(b) measurement of proximity of a geo-location of the end user to a location of the physical or virtual resource;

(c) reading of a device ID of the digital processing device;

(d) entering of a unique passcode by the end user on the digital processing device;

(e) verification or identification of a signature derived from one or more additional biometric modalities of the end user; and

(f) analysis of contextual data to match a user status of the end user.

4. The system of claim 3, wherein the contextual data and data of the location of the physical or virtual resource is updated and sent to the digital processing device on a time-based or event-based schedule, such that any changes in geo-location dependent permissions associated with the data of the location of the physical or virtual resource can be compared against the geo-location of the end user for determination of the granting the access.

5. The system of claim 3, wherein the granting the access comprises requiring permission from one or more additional users.

6. The system of claim 3, wherein the asynchronous execution of the events is permitted based on (a) a monitoring of the digital processing device between time periods of the events, or (b) user-inputted or contextual data.

7. The system of claim 1, wherein the contact-free process comprises verification or identification of the end user via an optical or audio signature of the end user'"'"'s one or more biometric modalities.

8. The system of claim 7, wherein the optical signature of the end user'"'"'s biometric modality is derived from a feature set of a human palm, performed by capturing an image or a set of images of the end user'"'"'s palm through following steps:

(a) detecting a palm area using local classifiers;

(b) extracting features from one or more regions of interest; and

(c) computing a matching score against one or more user models stored in a database, provided that the database is augmented dynamically through a learning process and the learning process comprises a deep learning-based methodology.

9. The system of claim 1, wherein the physical resource comprises (a) one or more of:

a house, an apartment, a hotel room, an office, a building, a facility, a storage unit, an automobile, a bicycle, a motorcycle, an airplane, a helicopter, a remotely operated robot such as a drone, or a maritime vessel;

or (b) a subspace of one or more of;

a house, an apartment, a hotel room, an office, a building, a facility, a storage unit, an automobile, a bicycle, a motorcycle, an airplane, a helicopter, a remotely operated robot such as a drone, or a maritime vessel.

10. The system of claim 1, wherein the virtual resource comprises one or more of:

financial information, a digital services account, a digital goods account, an individual file, a plurality of files, a user interface, a security system, an operating system, an application, a plurality of applications, an email, or a telecommunications system.

11. The system of claim 1, wherein the electronic key is synchronized with a database in a computing device, the computing device being controlled by a manager of the physical or virtual resource and the manager allowing a user of the computing device to perform one or more of the following:

(a) viewing data associated with the electronic key;

(b) communicating directly with the end user;

(c) creating or destroying the electronic key; and

(d) sending or receiving the electronic key.

12. The system of claim 1, wherein the application further comprises a software module configured to receive, store, transmit, or create the electronic key to the physical or virtual resource.

13. Non-transitory computer-readable storage media encoded with a computer program including instructions executable by a digital signal processor to create an application for electronic key provisioning and access management, the application comprising:

(a) a software module configured to obtain one or more biometric features of an end user in a contact-free process, wherein the one or more biometric features comprise features derived from one or more biometric modalities;

a fingerprint, a palm print, an iris, a retina, a face, a human cardiac rhythm, and a human voice;

(b) a software module configured to create or receive an electronic key, wherein the electronic key is revocable, or time-denominated, or event-denominated, or a combination thereof; and

(c) a software module configured to grant an access to a physical or virtual resource based on the one or more biometric features, or on the electronic key, or on both thereof.

14. The media of claim 13, wherein the granting the access comprises verifying an identity of the end user based on the one or more biometric features and subsequently unlocking the physical or virtual resource.

15. The media of claim 13, wherein the granting the access comprises (a) a simultaneous or near-simultaneous execution of events, or (b) an asynchronous execution of the events, the events being selected from the following group:

(a) verification or identification of the one or more biometric features of the end user;

(b) measurement of proximity of a geo-location of the end user to a location of the physical or virtual resource;

(c) reading of a device ID of the digital processing device;

(d) entering of a unique passcode by the end user on the digital processing device;

(e) verification or identification of a signature derived from one or more additional biometric modalities of the end user; and

(f) analysis of contextual data to match a user status of the end user.

16. The media of claim 15, wherein the contextual data and data of the location of the physical or virtual resource is updated and sent to the digital processing device on a time-based or event-based schedule, such that any changes in geo-location dependent permissions associated with the data of the location of the physical or virtual resource can be compared against the geo-location of the end user for determination of the granting the access.

17. The media of claim 15, wherein the granting the access comprises requiring permission from one or more additional users.

18. The media of claim 15, wherein the asynchronous execution of the events is permitted based on (a) a monitoring of the digital processing device between time periods of the events, or (b) user-inputted or contextual data.

19. The media of claim 13, wherein the contact-free process comprises verification or identification of the end user via an optical or audio signature of the end user'"'"'s one or more biometric modalities.

20. The media of claim 19, wherein the optical signature of the end user'"'"'s biometric modality is derived from a feature set of a human palm, performed by capturing an image or a set of images of the end user'"'"'s palm through following steps:

(a) detecting a palm area using local classifiers;

(b) extracting features from one or more regions of interest; and

(c) computing a matching score against one or more user models stored in a database, provided that the database is augmented dynamically through a learning process and the learning process comprises a deep learning-based methodology.

21. The media of claim 13, wherein the physical resource comprises (a) one or more of:

a house, an apartment, a hotel room, an office, a building, a facility, a storage unit, an automobile, a bicycle, a motorcycle, an airplane, a helicopter, a remotely operated robot such as a drone, or a maritime vessel;

or (b) a subspace of one or more of;

a house, an apartment, a hotel room, an office, a building, a facility, a storage unit, an automobile, a bicycle, a motorcycle, an airplane, a helicopter, a remotely operated robot such as a drone, or a maritime vessel.

22. The media of claim 13, wherein the virtual resource comprises one or more of:

financial information, a digital services account, a digital goods account, an individual file, a plurality of files, a user interface, a security system, an operating system, an application, a plurality of applications, an email, or a telecommunications system.

23. The media of claim 13, wherein the electronic key is synchronized with a database in a computing device, the computing device being controlled by a manager of the physical or virtual resource and the manager allowing a user of the computing device to perform one or more of the following:

(a) viewing data associated with the electronic key;

(b) communicating directly with the end user;

(c) creating or destroying the electronic key; and

(d) sending or receiving the electronic key.