Method and System to Validate Identity Without Putting Privacy at Risk

• US 20190332759A1
• Filed: 05/06/2019
• Published: 10/31/2019
• Est. Priority Date: 09/02/2014
• Status: Active Grant

• Current Assignee: LogicMark LLC (Nxt-Id, Inc.)
• Original Assignee: Nxt-Id, Inc.
• Inventors: Tunnell, Andrew, Santillo, Christopher, Mitchell, Justin, Powers, Sean
• Granted Patent: US 10,970,376 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 30/0248 Avoiding fraud
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A method and system to verify identity while protecting private data. To locally verify identity without requiring communication with an external database or passing personal/identity information over network connections. To create a database and/or statistical model for later use to verify identify, private information from a first media is input to a device. Private information subsequently presented via a second media is then verified locally by comparing to the private information previously captured from the first media. If the resultant correlation score is sufficiently high the private information from the first media and from the second media are determined to belong to the same individual, and the user is authenticated or a desired action is approved. In case of a low correlation score, a notification may be sent to one or more entities alerting authorities of a security breach or identity theft.

Claims

1. A method for authenticating a user, the method comprising:

the user transferring a first user identifier disposed on a first media to a device;

the user transferring a second user identifier disposed on a second media to the device, the first media different from the second media and the first user identifier different from the second user identifier;

the first and second user identifiers not stored in the device prior to steps of transferring;

analyzing the first and second user identifiers at the device without sending the first and second user identifiers external to the device;

at the device, determining a correlation score responsive to the analyzing step, the correlation score indicative that the first and the second user identifiers identify a same user;

at the device determining a relationship between the correlation score and a predetermined correlation threshold and responsive thereto determining whether the first and second user identifiers represent the same user; and

authenticating the user if the first and second user identifiers identify the same user.

2. The method of claim 1 wherein the device comprises a non-network connected device such that the steps of transferring, analyzing, and determining, are executed without connecting to a network, without using an over-the-air communications interface, and without using a database external to the device.

3. The method of claim 1 further comprising if a step of authenticating is executed, permitting the user to conduct a transaction or to access data.

4. The method of claim 1 wherein the first and second media comprise a respective first and second transaction card.

5. The method of claim 4 wherein the first and second transaction cards comprise a respective first and second magnetic-stripe card.

6. The method of claim 1 wherein the step of analyzing further comprises analyzing the first and second user identifiers or analyzing corresponding portions of the first and second user identifiers at the device without sending the first and second user identifiers nor the corresponding portions of the first and second user identifiers external to the device;

7. The method of claim 1 further comprising the user supplying a biometric, the step of analyzing further comprising analyzing the biometric.

8. The method of claim 1 wherein the first or second user identifier comprises a security identifier or comprises private information, and the private information further comprises any one or more of a user'"'"'s last name, a user'"'"'s first name, a user'"'"'s middle name, a user'"'"'s initials, a user'"'"'s current or previous addresses, a user'"'"'s phone number, a user'"'"'s account number, a user'"'"'s license number, a user'"'"'s identity number, a user'"'"'s biometrics and a device number, a device serial number, a device MAC address, and a device IP address.

9. The method of claim 1 wherein the first or second media comprises any one of a memory device, a data storage device, a magnetic stripe card, a memory operative with a radio-frequency identification component, a memory operative with a near-field communications component, a memory operative with a WiFi™

component, a memory operative with a universal serial bus component, a serial memory component, a compact disc/read only memory, or a digital video disc.

10. The method of claim 1 wherein the device comprises any one of a personal computer, a laptop computer, a tablet computer, a dongle, a server, a mobile device, a smart phone, a wearable device or any device comprising a non-transitory memory element.

11. The method of claim 1 wherein the steps of transferring the first and second user identifiers from the respective first and second media comprises using an optical character recognition component.

12. The method of claim 1 wherein prior to steps of transferring the first and second user identifiers the method further comprises one or more of a step of encrypting the first and second user identifiers, a step of disconnecting the device from a network, and a step of scanning the first and second user identifiers for malware.

13. The method of claim 1 further comprising generating a first token that represents the first user identifier and generating a second token that represents the second user identifier, wherein steps of transferring the first user identifier and transferring the second user identifier comprise respectively transferring the first and second tokens.

14. The method of claim 1 wherein the first and second user identifiers each comprise private information of the user, the method further comprising a step of asking the user knowledge-based questions derived from the private information, wherein the step of analyzing further comprises analyzing answers to the knowledge-based questions.

15. The method of claim 1 wherein the step of analyzing the first and second user identifiers comprises analyzing selected elements of the first and second user identifiers in lieu of analyzing all elements of the first and second user identifiers.

16. The method of claim 1 the step of authenticating further comprising authenticating the user if the first and second user identifiers identify the same user and if a step of transferring the second user identifier is executed within a predetermined time interval from a step of transferring the first user identifier.

17. The method of claim 1 wherein the correlation score comprises an initial correlation score, the method further comprising:

authenticating the same user to a first authentication level responsive to the initial correlation score;

receiving a third user identifier;

determining that the third user identifier identifies the same user without sending the third user identifier external to the device; and

responsive to the step of determining, authenticating the same user to a second authentication level higher than the first authentication level.

18. A method for authenticating a user, the method comprising:

the user supplying a user identifier disposed on a first media to a device;

the user supplying a biometric to the device;

the user identifier and the biometric not stored in the device prior to respective steps of supplying;

analyzing the user identifier and the biometric at the device without sending the user identifier and the biometric external to the device;

at the device, determining a correlation score responsive to the analyzing step;

determining a relationship between the correlation score and a predetermined correlation threshold and responsive thereto determining whether the user identifier and the biometric represent a same user; and

authenticating the user if the user identifier and the biometric identify the same user.

19. The method of claim 18 the step of authenticating further comprising authenticating the user if the user identifier and the biometric identify the same user and if a step of transferring the biometric is executed within a predetermined time interval from a step of transferring the user identifier.

20. The method of claim 18 wherein the correlation score comprises an initial correlation score, the method further comprising:

authenticating the same user to a first authentication level responsive to the initial correlation score;

receiving a second user identifier;

determining that the second user identifier identifies the same user; and

responsive to the step of determining, authenticating the same user to a second authentication level higher than the first authentication level.