Methods for secure enrollment and backup of personal identity credentials into electronic devices

• US 7,590,861 B2
• Filed: 08/06/2003
• Issued: 09/15/2009
• Est. Priority Date: 08/06/2002
• Status: Expired due to Fees

• Current Assignee: Apple Inc.
• Original Assignee: Privaris, Inc.
• Inventors: Johnson, Barry W., Abdallah, David S.
• Primary Examiner(s): Smithers; Matthew B
• Assistant Examiner(s): GERGISO, TECHANE
• Application Number:
  US10/635,762
• Publication Number:
  US 20040139329A1
• Time in Patent Office: 2,232 Days
• Field of Search: 713/179, 713/186, 382/115, 340/5.82
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06V 40/10 Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method and system for securely enrolling personal identity credentials into personal identification devices. The system of the invention comprises the manufacturer of the device and an enrollment authority. The manufacturer is responsible for recording serial numbers or another unique identifier for each device that it produces, along with a self-generated public key for each device. The enrollment authority is recognized by the manufacturer or another suitable institution as capable of validating an individual before enrolling him into the device. The enrollment authority maintains and operates the appropriate equipment for enrollment, and provides its approval of the enrollment. The methods described herein discuss post-manufacturing, enrollment, backup, and recovery processes for the device.

Claims

1. A method for initializing a Personal Identification Device (PID) before biometric enrollment, the method comprising:

receiving a unique identifier at a PID;

receiving at the PID a manufacturer'"'"'s public key following manufacture of the PID and before a biometric data associated with enrollment is received;

generating an asymmetric key pair at the PID;

sending the generated PID'"'"'s public key and the unique identifier to the manufacturer;

receiving at the PID a digital certificate of the PID generated by the manufacturer; and

disabling all functionality within the PID such that the PID is in a state waiting for future biometric enrollment by an enrollment authority.

2. The method of claim 1, wherein the asymmetric key pair includes the generated PID'"'"'s public key, the method further comprising:

sending the generated PID'"'"'s public key from the PID to a party different than the manufacturer.

3. The method of claim 1, wherein the receiving the digital certificate is based on the manufacturer'"'"'s public key and the unique identifier.

4. The method of claim 1, wherein the unique identifier is associated with the asymmetric key pair includes the generated PID'"'"'s public key and the generated PID'"'"'s private key.

5. The method of claim 1, wherein the digital certificate includes the manufacturer'"'"'s public key.

6. The method of claim 1, wherein the receiving the manufacturer'"'"'s public key is from the manufacturer of the PID and separate from the enrollment party authorized to enable enrollment of the biometric data at the PID.

7. The method of claim 1, wherein the PID is configured to enroll the biometric data from a party different from the manufacturer of the PID after the receiving at the PID the digital certificate.

8. The method of claim 1, wherein the digital certificate includes data associated with the PID.