Secure method and system for biometric verification

• US 7,797,549 B2
• Filed: 12/24/2003
• Issued: 09/14/2010
• Est. Priority Date: 06/28/2001
• Status: Expired due to Fees

• Current Assignee: Irdeto B.V. (MultiChoice Group Ltd.)
• Original Assignee: Cloakware Incorporated (MultiChoice Group Ltd.)
• Inventors: Johnson, Harold J., Main, Alec
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Louie; Oscar A
• Application Number:
  US10/743,784
• Publication Number:
  US 20050138392A1
• Time in Patent Office: 2,456 Days
• Field of Search: 713/186, 713/194, 726/2, 726/16, 726/21, 726/26, 726/27, 380/59
• US Class Current: 713/186
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 2209/043 of tables, e.g. lookup, substitution or mapping
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/002 Countermeasures against attacks on cryptographic mechanisms network architectures or network communication protocols for protection against malicious traffic H04L63/1441
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

There is a need in the computer software and data industries to protect content from unauthorized access to private information. Alphanumeric passwords have been shown to offer very weak protection. Biometrics (personal traits such as fingerprints and hand-written signatures) offer superior protection, but still have a number of weaknesses. The most significant weakness is that there is no existing way to protect the stored biometric data itself; and once a person'"'"'s fingerprint data has been obtained by an attacker, the use of that fingerprint can no longer be considered secure. The invention solves the problem by securing the access software application that manages the biometric data using tamper-resistant encoding techniques. These tamper-resistant encoding techniques include: data-flow, control-flow, mass-data and white-box encoding.

Claims

1. A method of biometric verification using an access software application configured to access another application, system or other software entity to protect biometric data against spoofing or theft, the method comprising the steps:

(a) establishing parameters of the access software application;

(b) generating a biometric template for a user by sampling;

(c) integrating into the access software application, by means of partial evaluation, the parameters and the biometric template;

(d) performing tamper-resistant software (TRS) encoding to the access software application including storing the biometric data in an encoded format that is irreversible, the step of performing TRS encoding being performed according to one of the following;

(i) prior to the establishing of parameters, whereby one TRS implementation covers multiple platforms and multiple biometric templates;

(ii) after the establishing of parameters and before generating the biometric template, whereby one TRS implementation covers one platform only and multiple biometric templates; and

(iii) after the establishing of parameters and after generating the biometric template, whereby one TRS implementation covers one platform only and one biometric template only; and

(e) employing the biometric template which has been integrated into the access software application to evaluate biometric data provided by a user seeking to access the other application, system or software entity to provide an evaluation result which either permits or denies access by the user wherein the TRS encoding comprises mass data encoding for data in array, table or message buffer form; and

wherein the evaluation result comprises branching to a distinct location of the access software application if the user-provided biometric data is found to match the biometric template.

2. A method according to claim 1 whereby the evaluation result comprises a cryptographic key generated to be either correct to permit access by the user or incorrect to deny access by the user, the cryptographic key being generated to be correct only when the user-provided biometric data is found to match the biometric template.

3. A method according to claim 1 whereby the evaluation result comprises a key for a symmetric cipher having high entropy for its key length, if the user-provided biometric data is found to match the biometric template.

4. A method according to claim 1 whereby the evaluation result comprises private key of a public/private key pair, if the user-provided biometric data is found to match the biometric template.

5. A method according to claim 1 whereby the incorrect cryptographic key is identical in bit-length to the correct cryptographic key.