System for biometric security using a fob

• US 8,074,889 B2
• Filed: 09/06/2007
• Issued: 12/13/2011
• Est. Priority Date: 07/10/2001
• Status: Expired due to Fees

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Xatra Fund MX LLC (Intellectual Ventures LLC)
• Inventors: Saunders, Peter D, Montgomery, Joshua L, Larkin, Carl, Gray, William J, Fields, Seth W, Bonalle, David S, Beenau, Blayn W
• Primary Examiner(s): WALSH, DANIEL I
• Application Number:
  US11/850,812
• Publication Number:
  US 20070296551A1
• Time in Patent Office: 1,559 Days
• Field of Search: 235/375, 235/487, 235/492, 235/493, 235/435, 340/572.1, 340/5.52, 340/5.8, 340/5.82
• US Class Current: 235/487
• CPC Class Codes: G01D 21/00 Measuring or testing not otherwise provided for
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/1085 involving automatic teller machines [ATMs]
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/28 Pre-payment schemes, e.g. "pay before"
• CPC Class Codes: G06Q 20/321 using wearable devices
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/355 Personalisation of cards for use
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 30/0215 : Including financial accounts
• CPC Class Codes: G07C 9/247 : electronically, e.g. by comparing signal of hand-writing with a reference signal from the pass
• CPC Class Codes: G07C 9/257 : electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/26 : using a biometric sensor integrated in the pass
• CPC Class Codes: G07C 9/27 : with central registration
• CPC Class Codes: G07C 9/28 : the pass enabling tracking or indicating presence
• CPC Class Codes: G07C 9/29 : the pass containing active electronic elements, e.g. smartcards
• CPC Class Codes: G07F 7/1008 : Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/0861 : using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0869 : for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys
• CPC Class Codes: H04W 88/02 : Terminal devices

Abstract

The present invention discloses a system and methods for biometric security using biometrics in a transponder-reader system. The biometric security system also includes a biometric sensor that detects biometric sample and a device for verifying biometric samples. In one embodiment, the biometric security system includes a transponder configured with a biometric sensor. In another embodiment, the system includes a reader configured with a biometric sensor. The device for verifying samples compares the biometric samples with information stored on the databases.

Claims

1. A Radio Frequency (RF) customer payment device comprising:

an RF transponder configured to receive a device authentication code from an RF Identification (RFID) reader;

a unique device identification code;

a unique device encryption key corresponding to the unique device identification code;

a device account code;

a signature sensor configured to detect proffered signature sample data;

a device authentication circuit configured to use the unique device encryption key to encrypt the device authentication code and the device account code; and

a second RF transponder, wherein at least one of the RF transponder or the second RF transponder is configured to transmit a RFID reader authentication code to the RFID reader and receive an encrypted RFID reader authentication code from the RFID reader in response to the proffered signature sample data matching the authenticated signature sample data;

wherein the RF transponder is configured to transmit at least one of the encrypted device authentication code or the encrypted device account code to the RFID reader.

2. The RF customer payment device of claim 1, further comprising a verification device configured to enable the device authentication circuit in response to the proffered signature sample data matching authenticated signature sample data.

3. The RF customer payment device of claim 2, further comprising a second RF transponder, wherein at least one of the RF transponder or a second RF transponder is configured to transmit a RFID reader authentication code to the RFID reader and receive an encrypted RFID reader authentication code from the RFID reader in response to the proffered signature sample data matching the authenticated signature sample data.

4. The RF customer payment device of claim 3, further comprising an RFID reader decryption key, wherein the device authentication circuit is configured to use the RFID reader decryption key to decrypt the encrypted RFID reader authentication code received from the RFID reader in order to authenticate the RFID reader.

5. The RF customer payment device of claim 3, wherein the signature sensor comprises a switch configured to place the first and second RF transponders in at least one of a selectivity mode or an inclusivity mode, wherein the selectivity mode includes enabling purchase of an item using a selected account number and the inclusivity mode includes the first and second RF transponders in an operational mode permitting the first and second RF transponders to be responsive to RF interrogation and interrogation via a USB connector.

6. The RF customer payment device of claim 3, wherein the signature sensor is configured to store log data within the RF customer payment device, the log data comprising one of detected signature sample data, processed signature sample data and stored signature sample data, and wherein the signature sensor is further configured to employ a security procedure in response to the proffered signature sample data differing from the log data.

7. The RF customer payment device of claim 1, wherein the signature sensor comprises at least one of an LCD screen or a digitizing tablet, and wherein the signature sensor is configured to detect signature data comprising at least one of shape, speed, stroke, stylus pressure, or timing information.

8. A method comprising:

detecting proffered signature sample data at a signature sensor to facilitate a Radio Frequency (RF) transaction;

associating the proffered signature sample data with at least one of an RF customer payment device, a user identifier, or a transaction account;

receiving a reader authentication code from the RF customer payment device;

encrypting the reader authentication code using a reader encryption key to create an encrypted reader authentication code;

transmitting the encrypted reader authentication code to the RF customer payment device for authentication of the sample receiver;

receiving an encrypted device account code from the RF customer payment device in response to the authentication of the sample receiver;

decrypting the encrypted device account code using the unique device decryption key;

verifying the proffered signature sample data to facilitate activating the RF customer payment device and confirm the proffered signature sample data;

storing the proffered signature sample data as registered signature sample data;

receiving a transaction request from the RF customer payment device, wherein the transaction request comprises transaction signature sample data;

authorizing the transaction request in response to the transaction signature sample data matching the registered signature sample data; and

transmitting the decrypted device account code to facilitate processing the transaction.

9. The method of claim 8, further comprising associating the registered signature sample data with at least one of personal information, credit card information, debit card information, savings account information, or loyalty point information.

10. The method of claim 9, further comprising associating the registered signature sample data with second user information comprising at least one of personal information, credit card information, debit card information, savings account information, or loyalty point information.

11. The method of claim 8, further comprising facilitating at least one of authorized access, activation of a second device, a financial transaction, or a non-financial transaction in response to the transaction signature sample data matching the registered signature sample data.

12. The method of claim 8, further comprising:

transmitting a device authentication code from a sample receiver to the RF customer payment device;

receiving an encrypted device authentication code, second proffered signature sample data, and a unique device identification code from the RF customer payment device;

decrypting the encrypted device authentication code using a unique device decryption key corresponding to the unique device identification code;

comparing the decrypted device authentication code to the device authentication code; and

authenticating the RF customer payment device in response to the second proffered signature sample data matching the registered biometric sample data and in response to the decrypted device authentication code matching the device authentication code.

13. The method of claim 12, further comprising:

receiving a reader authentication code from the RF customer payment device;

encrypting the reader authentication code using a reader encryption key to create an encrypted reader authentication code;

transmitting the encrypted reader authentication code to the RF customer payment device for authentication of the sample receiver;

receiving an encrypted device account code from the RF customer payment device in response to the authentication of the sample receiver;

decrypting the encrypted device account code using the unique device decryption key; and

transmitting the decrypted device account code to facilitate processing the transaction.

14. The method of claim 8, further comprising:

receiving an RF customer payment device update request comprising at least one of a preloaded value update request or a reload protocol update request;

updating, in response to the RF customer payment device update request, at least one of a preloaded value data file or a reload protocol data file, wherein the preloaded value data file comprises a stored value;

requesting a funding source value from a first funding source and the preloaded value data file, wherein the requesting of the funding source value is in response to an instruction from the reload protocol data file;

updating the stored value with the funding source value; and

in response to the stored value being greater than the transaction value, authorizing the transaction request to facilitate the RF transaction.

15. The method of claim 14, wherein the reload protocol update request comprises at least one of a minimum depletion value update request, a time period update request, a number of occurrences update request, or a maximum value update request.

16. The method of claim 15, further comprising determining that the RF transaction complies with a preset transaction limitation comprising at least one of a maximum transaction amount, a minimum transaction amount, a maximum number of transactions within a time period value, a maximum number of transactions value, a use by certain merchants criterion, a temporal limitation, or a use of non-monetary funds criterion.

17. The method of claim 16, further comprising requesting second proffered signature sample data to override the preset transaction limitation.

18. An authorized sample receiver (ASR) comprising:

a biometric sensor configured to receive first proffered signature sample data to facilitate a Radio Frequency (RF) transaction;

a communications device configured to receive an encrypted device authentication code from the RF customer payment device and a second proffered signature sample data associated with an RF customer payment device and store the first proffered signature sample data as registered signature sample data in response to the second proffered signature sample data matching the first proffered biometric sample data;

an RF Identification (RFID) reader configured to receive a transaction request from the RF customer payment device comprising transaction signature sample data, an encrypted device account code, and a unique device identification code;

a plurality of device-specific decryption keys; and

an authentication circuit configured to decrypt the encrypted device account code using a unique RF customer payment device decryption key selected from the plurality of device-specific decryption keys and compare the transaction signature sample data to the registered signature sample data to facilitate authenticating the RF customer payment device.

19. The ASR of claim 18, further configured to transmit a device authentication code to the RF customer payment device, receive an encrypted device authentication code from the RF customer payment device, and decrypt the encrypted device authentication code using the unique RF customer payment device decryption key to facilitate authenticating the RF customer payment device.

20. The ASR of claim 19, further configured to receive an ASR authentication code from the RF customer payment device, encrypt the ASR authentication code, and transmit the encrypted ASR authentication code to the RF customer payment device to facilitate authentication of the ASR.