Electronic data vault providing biometrically protected electronic signatures

• US 7,941,380 B2
• Filed: 05/21/2009
• Issued: 05/10/2011
• Est. Priority Date: 06/18/2001
• Status: Expired due to Fees

• Current Assignee: DAON Enterprises Limited
• Original Assignee: Daon Holdings Limited
• Inventors: Tattan, Oliver, White, Conor, Loughman, Stephen, Peirce, Michael, Murphy, Michael
• Primary Examiner(s): Worjloh; Jalatee
• Application Number:
  US12/469,753
• Publication Number:
  US 20090282260A1
• Time in Patent Office: 719 Days
• Field of Search: 705 64- 79, 713/186, 713/150, 713/155, 713/156, 726/2, 726/4, 726/5, 380/277
• US Class Current: 705/71
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/68 Special signature format, e.g. XML format
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

An eVault system securely stores personal data and documents for citizens and allows controlled access by citizens and optionally by service providers. The eVault may be adapted to allow processes involving the documents to be carried out in a secure and paperless fashion. Documents are certified, and biometric matching is used for security. On effecting a match with a biometric identifier presented by a user, the user is allowed access to his personal eVault and to access a personal cryptographic key stored therein. One or more of these personal keys may be securely applied within the eVault to generate an electronic signature, amongst other functions.

Claims

1. A method of associating at least one cryptographic key with a specific user and storing an associated key in a datastore specific to the specific user, the method comprising:

storing a set of personal identifiers, including at least one personal identifier, associated with the specific user in a datastore specific to the specific user;

linking the set of personal identifiers with at least one cryptographic key generated for the specific user;

signing, with a certificate authority, one of the at least one cryptographic keys;

communicating a success code from an e-signature application to an authentication engine after successfully completing said signing operation; and

registering the specific user for the e-signature application upon receiving the success code at the authentication engine, wherein

the set of personal identifiers includes at least one biometric identifier, and

another of the at least one cryptographic keys is subsequently accessed by

capturing the at least one biometric identifier from a user at a client system, the client system being configured to communicate with at least the authentication engine,

comparing the captured at least one biometric identifier against a datastore of previously stored personal identifiers with the authentication engine, and

on matching a personal identifier with the captured at least one biometric identifier, providing the other cryptographic key for use.

2. The method as claimed in claim 1 wherein the at least one cryptographic key comprises a set of cryptographic keys.

3. The method as claimed in claim 2 wherein the set of cryptographic keys comprises a pair of public and private keys.

4. The method as claimed in claim 2 wherein the set of cryptographic keys includes a symmetric key.

5. The method as claimed in claim 1 wherein the at least one cryptographic key comprises an asymmetric key.

6. The method as claimed in claim 5, said registering operation further comprising:

comparing a captured set of personal identifiers with previously stored identifiers in the datastore; and

accepting the captured set of identifiers when said comparing the captured set of personal identifiers operation does not find a matching previously stored identifier.

7. The method as claimed in claim 1 further comprising:

associating the specific user with a pre-existing user;

authenticating the identity of the pre-existing user; and

storing the set of personal identifiers for the specific user after said authenticating operation.

8. The method according to claim 1 further comprising requesting the at least one cryptographic key for the specific user to be generated.

9. The method as claimed in claim 8 wherein said requesting operation comprises a signed request for the at least one cryptographic key.