SYSTEM AND METHODS FOR SECURE FILE SHARING AND ACCESS MANAGEMENT

• US 20160065571A1
• Filed: 08/26/2015
• Published: 03/03/2016
• Est. Priority Date: 08/26/2014
• Status: Abandoned Application

• Current Assignee: Veridium IP Limited (Harvard Investments LP)
• Original Assignee: Hoyos Labs Corp.
• Inventors: Hoyos, Hector, Streit, Scott, Braverman, Jason
• Application Number:
  US14/836,557
• Publication Number:
  US 20160065571A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/306 User profiles

Abstract

Disclosed is a system and method for coordinating secured access to an access-controlled environment. A plurality of keys are stored, each associated with a user account and generated by executing a biometric authentication application, using identification information concerning the respective user and a component of the of the respective computing device. Access-control information identifies an access-controlled environment, and a transmission is received from a computing device that includes a respective key and an indicator indicating that the user'"'"'s identity has been biometrically confirmed by the computing device. The key confirms that the user has been biometrically authenticated, and that the transmission is not a replay of a previously received transmission from the computing device. Access to the access-controlled environment is facilitated as a function of the verification, determination and confirmation.

Claims

1. An authorization system for coordinating secured access to an access-controlled environment as a function of biometric authentication of the user, the system comprising:

a processor configured to execute electronic instructions;

a non-transitory computer readable storage medium that is accessible to the processor, wherein at least some of the electronic instructions are stored on the storage medium;

a plurality of keys stored in the storage medium, each of the keys respectively associated with a respective user account and generated, based on confirmation of a respective user'"'"'s identity by a respective computing device executing a biometric authentication application, using identification information concerning the respective user and a component of the of the respective computing device;

a communication module configured to communicatively connect the processor to at least one computing device over a network connection, and wherein the processor, executing the communication module, is configured to receive;

i) access-control information that identifies an access-controlled environment; and

ii) one or more transmissions from a computing device that each include a respective key and an indicator indicating that the user'"'"'s identity has been biometrically confirmed by the computing device;

an authorization module that, when executed by the processor, configures the processor to;

verify that the received key corresponds to at least one of the respective keys,

determine, based on the indicator and the key, that the computing device has biometrically confirmed the identity of the user using the biometric authentication application,

confirm that at least one of the one or more transmissions is not a replay of a previously received transmission from the computing device, and

facilitate, over the network with a remote computing device based on the information that identifies an access-controlled environment, the user access to the access-controlled environment as a function of the verification, determination and confirmation.

2. A method for secure sharing of an encrypted electronic file between users based on biometric authentication of the users performed using respective user computing devices, the method comprising:

receiving, at a server computing device that includes a storage medium having instructions stored therein and a processor configured by executing the instructions, from a first user computing device over a network connection;

information identifying the encrypted electronic file (“

fileID”

), wherein the encrypted electronic file is stored in a file storage medium that is accessible by the first user computing device;

an encryption key;

access control information identifying at least a recipient user who is authorized to access the encrypted electronic file;

receiving, at the server computing device over the network connection, one or more biometric authorization messages, each biometric authorization message being from a respective user computing device and including identification information associated with a respective user of the respective user computing device, and the identification information including a representation of the respective user'"'"'s identity that has been confirmed as a function of biometrics;

verifying, by the server computing device in accordance with a datastore of user accounts associated with respective users and respective user computing devices, that the identification information corresponds to a user account that is associated with the first user and the first user computing device;

generating, by the server computing device, a record of the encrypted electronic file in the storage medium, wherein the record comprises the fileID, the encryption key, the access control information and the userID;

providing, by the server computing device, a registration notification to the first user computing device that is usable for the first user computing device to transmit the encrypted electronic file to a second computing device associated with the recipient and wherein the registration notification causes the first user computing device to erase any locally stored copies of the encryption key.

3. The method of claim 2, further comprising:

receiving, at the server computing device, an access request from a second user computing device, wherein the access request identifies the fileID and identifies the recipient user;

verifying, by the server computing device according to the datastore of user accounts, that the identification information included in a biometric authorization message received from a second user computing device corresponds to a second user account that is associated with the recipient user and the second user computing device;

determining, by the server computing device and in accordance with the received fileID, the stored file record and the recipient user, that the access control information identifies the recipient as an authorized user; and

providing, by the server computing device based on the determination, the encryption key to the second user computing device.

4. The method of claim 2, further comprising:

establishing a two-way secured communication session between the server computing device and at least one user computing device;

determining, by the server computing device, an object security level associated with an object and a subject security level associated a user of the at least one user computing device; and

facilitating, by the server computing device, access to the object by the at least one user computing device when the subject'"'"'s security level is greater than or equal to the object'"'"'s security level.

5. The method of claim 4, wherein establishing the two-way secured communication session between the first user computing device and the server computing device comprises:

transmitting, by the server computing device to the first user computing device over a network, an instruction that, when executed by the first user computing device, causes the first user computing device to launch an application window;

wherein the two-way secured communication session is established between the first user computing device and the one server computing device via the application window, and

establishing the two-way secured communication session based on the verification of the user with the first user computing device automatically provides direct and pre-authorized access to an access controlled environment hosted by the remote computing device via the application window.

6. The method of claim 4, wherein the server computing device is a secure webserver.

7. The method of claim 6, wherein the two-way communication session is established directly between the secure webserver and the first user computing device or a second user computing device.

8. The method of claim 4, wherein the two-way communication session is established between the secure webserver and the second user computing device indirectly.

9. The method of claim 2, further comprising:

identifying, in accordance with the encryption key, a respective user computing device that is associated with the first user; and

receiving, by the server computing device from the first computing device, access control information that corresponds to the access-control information.

10. A method for secure sharing of an encrypted electronic file between users based on biometric authentication of the users performed using respective user computing devices, the method comprising:

transmitting, by a server computing device to a first user computing device, a request to confirm identity of a first user associated with the first user computing device;

receiving, by the server computing device in response to the request and from the first user computing device, a confirmation of the identity as a function of biometric authentication by the first user computing device;

determining, by the server computing device, a key that is unique to the first user, the first user computing device and the confirmation that the user identity using biometric authentication by the user computing device;

validating, by the server computing device and in accordance with the key, the confirmation, the identity of the user and the user computing device based on the biometric authentication, a secure communication session; and

constructing, by the server computing device and using the key, the validated secure communication session over a network between the server computing device and the first user computing device associated with the validated user.

11. The method of claim 10,

wherein the biometric authorization comprises one or more keys and a biometric authentication status;

and further comprising;

associating a plurality of user accounts with one or more stored keys that are each uniquely associated with respective users and respective user computing devices;

verifying, by the server computing device, that a key received from the first computing device corresponds to at least one of the one or more stored keys is associated with the first user and the first user computing device to confirm that the first user was biometrically authenticated by the first user computing device.

12. The method of claim 10, wherein the validating comprises:

verifying the identity of the first user by testing the key against one or more previously stored plurality of identity assertion keys, wherein each identity assertion key is unique to a respective enrolled user and the enrolled user'"'"'s associated user computing device; and

confirming, by the server computing device, that a user computing device is associated with the verified user.

13. The method of claim 10, further comprising:

receiving, by the server computing device from the first computing device, a transaction request that comprises the key, and

comparing, by the server computing device, the key to a respective key included in at least one user profile.

14. The method of claim 13, wherein the at least one user profile includes transaction account information concerning a transaction account, and further comprising:

retrieving, by the computing device from at least one database, at least one access rule, wherein the user is authorized to access an access-controlled environment based on the transaction account information and the at least one access rule.

15. The method of claim 14, further comprising:

generating, by the server computing device, an authorization notification that grants the first user computing device access to the access-controlled environment; and

transmitting, by the server computing device to the first computing device, the authorization notification.

16. The method of claim 15, wherein the at least one remote computing device is associated with the first user, and wherein the authorization notification causes the at least one remote computing device to:

retrieve, from a memory in accordance with the authorization notification, account details associated with the at least one transaction account, and

transmit at least the account details to a remote computing device that grants access to the access-controlled environment.

17. The method of claim 16, wherein the at least one remote computing device is the user computing device.

18. The method of claim 15, wherein the authorization notification includes at least one of:

a password;

a user identifier;

a user computing device identifier;

a transaction request;

access-control information;

information concerning the at least one transaction account;

information indicating that the user has been authorized to access the access-controlled environment; and

information indicating that the user has been biometrically authenticated.

19. The method of claim 14, wherein the access-controlled environment includes one or more of:

a physical location;

one or more computing devices;

a computer storage device;

a database; and

an electronic device.

20. A system for authorizing access to an access-controlled environment, the method comprising:

a network communication interface;

a computer-readable storage medium;

one or more processors configured to interact with the network communication interface and the computer-readable storage medium and execute one or more software modules stored on the storage medium including;

a database module, that when executed configures the one or more processors to access at least one database that includes user profiles that include information to identify respective users, respective user computing devices and respective transaction accounts that are associated with respective access-controlled environments;

a communication module that when executed configures the one or more processors to receive access-control information that identifies the access-controlled environment, and to receive from a user computing device over a network, a transaction request including;

a user identifier that identifies a user, and

a user computing device identifier that identifies the user computing device, wherein the transaction request provides confirmation that the user computing device has biometrically authenticated the user;

an authorization module that that when executed configures the one or more processors to process, using the at least one database, the transaction request to authorize the user to access the access-controlled environment by determining;

that the user identifier is associated with at least one user profile stored in the at least one database,

that the user computing device identifier is associated with the at least one user profile, and

that the at least one user profile identifies a transaction account associated with the access-controlled environment;

wherein the authorization module also configures the one or more processors to generate an authorization notification that facilitates the authorized user to access to the access-controlled environment; and

wherein the communication module further configures the one or more processors to transmit the authorization notification to at least one remote computing device over a network.