Biometric certificates

• US 6,310,966 B1
• Filed: 05/08/1998
• Issued: 10/30/2001
• Est. Priority Date: 05/09/1997
• Status: Expired due to Term

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: GTE Service Corporation (Verizon Communications Inc.)
• Inventors: Dulude, Robert S., Musgrave, Clyde
• Primary Examiner(s): Bella, Matthew C.
• Assistant Examiner(s): CHAWAN, SHEELA C
• Application Number:
  US09/075,165
• Time in Patent Office: 1,271 Days
• Field of Search: 382/116, 382/115, 382/156, 382/232, 380/4, 380/23, 380/25, 380/30, 380/49, 705/39, 340/146.3, 340/5.82, 340/5.6, 340/5.65, 340/5.86, 341/155
• US Class Current: 382/115
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Biometric identification is combined with digital certificates for electronic authentication as biometric certificates. The biometric certificates are managed through the use of a biometric certificate management system. Biometric certificates may be used in any electronic transaction requiring authentication of the participants. Biometric data is pre-stored in a biometric database of the biometric certificate management system by receiving data corresponding to physical characteristics of registered users through a biometric input device. Subsequent transactions to be conducted over a network have digital signatures generated from the physical characteristics of a current user and from the electronic transaction. The electronic transaction is authenticated by comparison of hash values in the digital signature with re-created hash values. The user is authenticated by comparison against the pre-stored biometric certificates of the physical characteristics of users in the biometric database.

Claims

1. A method for authenticating an electronic transaction involving a user, comprising the steps of:

registering a user, including the steps of;

receiving a registration set of physical characteristics of the user at a biometric input device;

generating registration biometric data corresponding to the registration set of physical characteristics;

generating a biometric certificate from the registration biometric data, user input data, a public key of the user, and a digital signature; and

storing the biometric certificate in a biometric database;

transmitting an electronic transaction over a network, the electronic transaction including transaction biometric data, transaction first data, and a digital signature generated from the transaction biometric data and the transaction first data, the step of transmitting including the steps of;

receiving a current set of physical characteristics of the user;

generating the transaction biometric data from the current set related to the physical condition of the user;

generating a first hash value signal from the transaction first data and the transaction biometric data;

generating the digital signature from the hash value and a private key signal of the user;

transmitting the digital signature over the network; and

transmitting the transaction biometric data and the transaction first data over the network; and

authenticating the electronic transaction, including the steps of;

receiving the digital signature, the transaction biometric data and the transaction first data from the network;

retrieving user identification (ID) data from the transaction first data;

retrieving a biometric certificate, corresponding to the user ID data, from the biometric database;

extracting the registration biometric data and the user public key from the biometric certificate;

decrypting the digital signature using the user public key to retrieve the first hash value from the digital signature;

generating a second hash value from the transaction biometric data and the transaction first data;

comparing the first hash value to the second hash value using a first classifier;

generating a first validation signal to authenticate the transmission of the transaction first data and the transaction biometric data based on the comparison by the first classifier;

comparing the registration biometric data and the transaction biometric data using a second classifier; and

generating a second validation signal to authenticate the user based on the comparison by the second classifier.

2. The method of claim 1, wherein the step of authenticating further comprises the step of:

ANDing the first and second validation signals.

3. The method of claim 1, wherein the step of receiving a registration set of physical characteristics of the user includes the step of:

receiving visual characteristics of the user using a visual reader as the biometric input device.

4. The method of claim 1, wherein the step of receiving a registration set of physical characteristics of the user includes the step of:

receiving speech characteristics of the user using a speech digitizer as the biometric input device.

5. The method of claim 1, wherein the step of generating the registration biometric data includes the step of:

generating a bit sequence greater than about 500 bytes in length as the registration blometric data.

6. A system for authenticating an electronic transaction involving a user, comprising:

a registration section configured to register a user by receiving a registration set of physical characteristics of the user at a biometric input device, generating registration biometric data corresponding to the registration set of physical characteristics, generating a biometric certificate from the registration biometric data, user input data, a public key of the user, and a digital signature, and storing the biometric certificate in a biometric database;

a transmission section configured to transmit an electronic transaction over a network, the electronic transaction including transaction biometric data, transaction first data, and a digital signature generated from the transaction biometric data and the transaction first data, the transmitting section receiving a current set of physical characteristics of the user, generating the transaction biometric data from the current set related to the physical condition of the user, generating a first hash value signal from the transaction first data and the transaction biometric data, generating the digital signature from the hash value and a private key signal of the user, transmitting the digital signature over the network, and transmitting the transaction biometric data and the transaction first data over the network; and

an authentication section configured to authenticate the electronic transaction by receiving the digital signature, the transaction biometric data and the transaction first data from the network, retrieving user identification (ID) data from the transaction first data, retrieving a biometric certificate, corresponding to the user ID data, from the biometric database, extracting the registration biometric data and the user public key from the biometric certificate, decrypting the digital signature using the user public key to retrieve the first hash value from the digital signature, generating a second hash value from the transaction biometric data and the transaction first data, comparing the first hash value to the second hash value using a first classifier, generating a first validation signal to authenticate the transmission of the transaction first data and the transaction biometric data based on the comparison by the first classifier, comparing the registration biometric data and the transaction biometric data using a second classifier, and generating a second validation signal to authenticate the user based on the comparison by the second classifier.

7. The system of claim 6, wherein the authentication section is further configured to AND the first and second validation signals.

8. The system of claim 6, wherein the registration section is configured to receive visual characteristics of the user using a visual reader as the biometric input device.

9. The system of claim 6, wherein the registration section is configured to receive speech characteristics of the user using a speech digitizer as the biometric input device.

10. The system of claim 6, wherein the registration section is configured to generate a bit sequence greater than approximately 500 bytes in length as the registration biometric data.