Secure Biometrics Matching with Split Phase Client-Server Matching Protocol

• US 20170142101A1
• Filed: 11/16/2015
• Published: 05/18/2017
• Est. Priority Date: 11/16/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Connell, II, Jonathan H., Park, Jae-Eun, Ratha, Nalini K.
• Granted Patent: US 10,778,672 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

An embodiment of the invention provides a method for secure biometrics matching with split phase client-server matching protocol, wherein a first biometric input is received in an electronic device. The first biometric input is stored in the electronic device as a biometric profile; and, the biometric profile is sent to a server. An additional biometric input is received from a user in the electronic device; and, the additional biometric input is compared to the biometric profile stored in the electronic device to generate a local matching score. The additional biometric input is sent to the server. The local matching score and a remote matching score generated by the at least one server are compared; and, it is determined whether to authenticate the user based on the comparison of the local matching score and the remote matching score.

Claims

1. A method comprising:

receiving a first biometric input in an electronic device;

storing the first biometric input in the electronic device as a biometric profile;

sending the biometric profile to at least one server;

receiving an additional biometric input from a user in the electronic device;

comparing the additional biometric input to the biometric profile stored in the electronic device to generate a local matching score;

sending the additional biometric input to the at least one server;

comparing the local matching score and a remote matching score generated by the at least one server; and

determining whether to authenticate the user based on the comparison of the local matching score and the remote matching score.

2. The method according to claim 1, further comprising comparing the additional biometric input to the biometric profile stored in the at least one server to generate the remote matching score.

3. The method according to claim 1, wherein said determining whether to authenticate the user includes authenticating the user when the local matching score matches the remote matching score.

4. The method according to claim 1, wherein said determining whether to authenticate the user includes denying the user when the local matching score does not match the remote matching score.

5. The method according to claim 1, further comprising determining at least one of whether an integrity of the electronic device is compromised and whether an integrity of the at least one server is compromised based on said comparing of the local matching score and the remote matching score.

6. The method according to claim 5, wherein said determining whether the integrity of the electronic device is compromised includes determining that the integrity of the electronic device is not compromised when the local matching score matches the remote matching score.

7. The method according to claim 5, wherein said determining whether the integrity of the electronic device is compromised includes determining that the integrity of the electronic device is compromised when the local matching score does not match the remote matching score.

8. The method according to claim 5, wherein said determining whether the integrity of the at least one server is compromised includes determining that the integrity of the at least one server is not compromised when the local matching score matches the remote matching score.

9. The method according to claim 5, wherein said determining whether the integrity of the at least one server is compromised includes determining that the integrity of the at least one server is compromised when the local matching score does not match the remote matching score.

10. A method comprising:

receiving a biometric profile of a user by at least one server;

receiving a biometric input from the user by the at least one server, the biometric input being obtained and sent to the at least one server from an electronic device;

comparing the biometric input to the biometric profile stored in the at least one server with a processor to generate a matching score;

comparing the matching score and a matching score generated by the electronic device; and

determining whether to authenticate the user based on said comparing of the matching score and the matching score generated by the electronic device.

11. The method according to claim 10, wherein said determining whether to authenticate the user includes denying the user when the matching score does not match the matching score generated by the electronic device.

12. The method according to claim 10, further comprising determining at least one of whether an integrity of the electronic device is compromised and whether an integrity of the at least one server is compromised based on said comparing of the matching score and the matching score generated by the electronic device.

13. The method according to claim 12, wherein said determining whether the integrity of the electronic device is compromised includes determining that the integrity of the electronic device is not compromised when the matching score matches the matching score generated by the electronic device.

14. The method according to claim 12, wherein said determining whether the integrity of the electronic device is compromised includes determining that the integrity of the electronic device is compromised when the matching score does not match the matching score generated by the electronic device.

15. The method according to claim 12, wherein said determining whether the integrity of the at least one server is compromised includes determining that the integrity of the at least one server is not compromised when the matching score matches the matching score generated by the electronic device.

16. The method according to claim 12, wherein said determining whether the integrity of the at least one server is compromised includes determining that the integrity of the at least one server is compromised when the matching score does not match the matching score generated by the electronic device.

17. The method according to claim 12, wherein said determining whether the integrity of the at least one server is compromised includes determining that the integrity of the at least one server is compromised when a threshold number of matching scores generated by electronic devices fail to match the matching score.

18. The method according to claim 10, further comprising:

comparing the matching score generated by the electronic device to a matching score of a second user, wherein the matching score of the second user is different from the matching score generated by the at least one server; and

determining that the electronic device is compromised when the matching score generated by the electronic device is within a threshold degree if similarity with the matching score of the second user.

19. The method according to claim 10, further comprising:

comparing the matching score generated by the at least one server to a matching score of a second user, wherein the matching score of the second user is different from the matching score generated by the electronic device; and

determining that the at least one server is compromised when the matching score generated by the at least one server is within a threshold degree if similarity with the matching score of the second user.

20. A computer program product comprising:

a computer readable storage medium having stored thereon;

first program instructions executable by a device to cause the device to receive a biometric profile of a user;

second program instructions executable by the device to cause the device to receive a biometric input from the user, the biometric input being obtained and sent to a at least one server from an electronic device;

third program instructions executable by the device to cause the device to compare the biometric input to the biometric profile stored in the at least one server to generate a matching score;

fourth program instructions executable by the device to cause the device to compare the matching score and a matching score generated by the electronic device; and

fifth program instructions executable by the device to cause the device to determine whether to authenticate the user based on said comparing of the matching score and the matching score generated by the electronic device.