Biometric authentication over wireless wide-area networks

• US 7,548,981 B1
• Filed: 03/03/2004
• Issued: 06/16/2009
• Est. Priority Date: 03/03/2004
• Status: Active Grant

• Current Assignee: Sprint Spectrum LP (Deutsche Telekom AG)
• Original Assignee: Sprint Spectrum LP (Deutsche Telekom AG)
• Inventors: Senogles, Brian L., Taylor, Paul W., Fink, Nathan A.
• Primary Examiner(s): Chang; Jungwon
• Application Number:
  US10/792,468
• Time in Patent Office: 1,931 Days
• Field of Search: 455/432.1, 455/403, 455/435.1, 713/202, 713/201, 713/186, 370/349, 370/401, 380/248, 709/227
• US Class Current: 709/227
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data

Abstract

A system and method are described for providing biometric authentication to mobile nodes, such as mobile nodes seeking a mobile Internet protocol (mobile IP) connection to a network. The mobile node sends a registration request that includes biometric data. If the biometric data is authenticated, the mobile node is provided with a network address, such as an IP address, to use in network communications.

Claims

1. A method of authenticating a mobile node, comprising:

receiving at a mobility agent a first registration request message associated with a mobile node, wherein the registration message includes biometric data;

sending a second registration request from the mobility agent to a home agent, the second registration request including the biometric data;

after receiving the second registration request at the home agent, determining whether the biometric data is associated with an authorized user;

only after determining that the biometric data is associated with an authorized user, assigning a network address to the mobile node; and

sending the network address to the mobile node in a registration reply message.

2. The method of claim 1, wherein at least the second registration message is a mobile IP registration request message and at least the second registration reply is a mobile IP registration reply message.

3. The method of claim 2, wherein receiving the first registration message includes receiving the biometric data in an MN-FA extension of the registration message.

4. The method of claim 2, wherein receiving the first registration message includes receiving the biometric data in an MN-HA extension of the registration message.

5. The method of claim 1, wherein the second registration message includes a user identifier, and wherein determining whether the biometric data is associated with an authorized user comprises:

identifying stored biometric data associated with the user identifier; and

comparing the stored biometric data with the biometric data included in the second registration message.

6. The method of claim 5, wherein the biometric data included in the second registration message is first encoded data, and wherein comparing the stored biometric data with the biometric data included in the registration message comprises encoding the stored biometric data to create second encoded data and comparing the first encoded data with the second encoded data.

7. The method of claim 1, wherein determining whether the biometric data is associated with an authorized user comprises sending an access request message to an authenticator, wherein the access request message includes the biometric data.

8. The method of claim 1, wherein the network address is an IP address.

9. A method of authenticating a mobile node, comprising:

sending an agent advertisement from an agent node, wherein the agent advertisement includes a request for biometric data;

receiving, at the agent node, a registration request associated with the mobile node, wherein the registration request includes biometric data;

sending, to an authenticator node, an access request including the biometric data;

receiving, from the authenticator node, an access acceptance including a network address; and

sending, to the mobile node, a registration reply assigning the network address to the mobile node.

10. The method of claim 9, wherein the agent node is a mobile IP home agent.

11. The method of claim 9, wherein the agent node is a mobile IP foreign agent.

12. The method of claim 9, wherein the network address is an IP address.

13. A method of authenticating a mobile node, comprising:

sending an agent advertisement from a mobility agent, wherein the agent advertisement includes a request for biometric data;

receiving a first registration message associated with a mobile node, wherein the first registration message includes biometric data;

sending a second registration request from the mobility agent to a home agent, the second registration message including the biometric data;

after receiving the second registration request at the home agent, determining whether the biometric data is associated with an authorized user;

in response to a determination that the biometric data is associated with an authorized user, assigning a network address to the mobile node;

after assigning the network address to the mobile node, receiving at the home agent network data sent to the assigned network address; and

forwarding the network data from the home agent to the mobile node.

14. The method of claim 13, wherein the receiving of network data is performed at a home agent.

15. The method of claim 14, wherein forwarding the network data to the mobile node includes sending the network data to a foreign agent.

16. A method of authenticating the user of a mobile telephone comprising:

receiving, at the mobile telephone, an agent advertisement from an agent node, wherein the agent advertisement includes a request for biometric data;

collecting biometric data of a user in response to receiving the agent advertisement;

sending the collected biometric data to the agent node in a registration request message;

after sending the collected biometric data, receiving a registration reply message including a home address assigned to the mobile telephone; and

receiving, from the agent node, data addressed to the home address.

17. A method according to claim 16, wherein collecting biometric data includes obtaining biometric data from the user if biometric data stored at the mobile telephone has expired, and obtaining biometric data from a memory if biometric data stored at the mobile telephone has not expired.

18. A method according to claim 16, wherein collecting biometric data includes operating a biometric data sensor to obtain biometric data from the user in response to receiving the agent advertisement.