System and method for authenticated and privacy preserving biometric identification systems

• US 8,325,994 B2
• Filed: 06/13/2011
• Issued: 12/04/2012
• Est. Priority Date: 04/30/1999
• Status: Expired due to Fees

• Current Assignee: Gidipo LLC
• Original Assignee: George I. Davida
• Inventors: Davida, George I.
• Primary Examiner(s): Carter, Aaron W
• Application Number:
  US13/158,586
• Publication Number:
  US 20110302420A1
• Time in Patent Office: 540 Days
• Field of Search: 382115-127, 340/5.1, 340/5.2, 340/5.52, 340/5.53, 340 58- 586, 713/186
• US Class Current: 382/115
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06V 40/10 Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands

Abstract

A biometric based identification and authorization for a collected physical biometric for a security infrastructure is presented. The biometric identification and authorization is achieved with an identity verification template (IVT) generated from a User Biometric (UB) collected from a human or non-human object and stored on an biometric storage device (e.g., a magnetic strip card, smart card, Universal Serial Bus (USB) flash drive or a Radio Frequency Identifier (RFID) device, etc.). The generated UB is discarded. The IVT does not contain complete information from the UB but allows for accurate verification of the human or non-human object when another UB is generated for the human or non-human object at a later time.

Claims

1. A method for uniquely identifying a user via biometric analysis, comprising:

generating a first user biometric (UB) from a plurality of data bits of information of physical biometric information with an application on a first server network device with one or more processors on an biometric identification system including a plurality of server network devices each with one or more processors and one or more biometric scanners each with one or more processors used to collect physical biometric information from a human or non-human object;

encoding cryptographically authorization information via the application into the generated first UB defining a set of privileges granted to the human or non-human objects for a security infrastructure;

generating cryptographically an Identification and Verification Template (IVT) from the generated and encoded first UB via the application with a lossy transformation of information stored in the generated first UB and error correcting codes, wherein the generated IVT does not include complete information from the generated and encoded first UB but does allow for verification of the human or non-human object when the IVT is accessed a later time;

discarding the generated and encoded first UB; and

storing the generated IVT on an off-line biometric storage device for use within the security infrastructure.

3. The method of claim 1, wherein the physical biometric information includes an iris scan or a portion of an iris scan of the human.

4. The method of claim 1 wherein the physical biometric information includes a facial scan of the human.

5. The method of claim 1 wherein the physical biometric information includes a finger print scan of the human.

6. The method of claim 1, further comprising:

storing the generated and encoded first UB on the off-line biometric storage device.

7. The method of claim 1 wherein the off-line biometric storage device includes a magnetic strip card, smart card, Universal Serial Bus (USB) flash drive or a Radio Frequency Identifier (RFID) device.

8. The method of claim 6 wherein the RFID device includes an RFID tag or an RFID sensor.

9. The method of claim 1 wherein the off-line biometric storage device includes a computer readable medium on a smart phone or a tablet computer.

10. The method of claim 1 wherein the one or more server network devices include on-line server network devices connected to a communications network or off-line servers not connected to a communications network.

11. The method of claim 1 wherein the generated and encoded first UB is discarded and not stored on the biometric identification system.

12. The method of claim 1 wherein the physical biometric information is collected with a camera component on a smart phone or tablet computer.

13. The method of claim 1 wherein the first server network device is connected to a communications network.

14. The method of claim 1 further comprising:

encrypting the generated IVT on an off-line biometric storage device one or more times with one or more different encryption keys.

15. The method of claim 1 further comprising:

receiving a request on the application on the first server network device to verify an identity of the human or non-human object;

generating a second user biometric (UB) for the human or non-human object with the application on the first server network device;

retrieving the IVT stored on off-line biometric storage device with the application on the first server on the biometric identification system; and

verifying cryptographically an identify of the human or non-human object using the generated second UB and the retrieved IVT without directly comparing the second UB and the retrieved IVT.

16. The method of claim 15 wherein the verifying cryptographically step includes:

generating a lossy transformation of the second UB with error correcting codes to create a lossy second UB;

generating a cryptographic authentication of the lossy second UB; and

comparing cryptographically the generated cryptographic authentication of the lossy second UB to the retrieved IVT.

2. A non-transitory computer readable medium having stored therein a plurality of instructions for causing one or more processors to execute the steps of:

generating a first user biometric (UB) from a plurality of data bits of information of physical biometric information with an application on a first server network device with one or more processors on an biometric identification system including a plurality of server network devices each with one or more processors and one or more biometric scanners used to collect physical biometric information from a human or non-human object;

encoding cryptographically authorization information via the application into the generated first UB defining a set of privileges granted to the human or non-human objects for a security infrastructure;

generating cryptographically an Identification and Verification Template (IVT) from the generated and encoded first UB via the application with a lossy transformation of information stored in the generated first UB and error correcting codes, wherein the generated IVT does not include complete information from the generated and encoded first UB but does allow for verification of the human or non-human object when the IVT is accessed a later time;

discarding the generated and encoded first UB; and

storing the generated IVT on an off-line biometric storage device for use within the security infrastructure.

17. A system for uniquely identifying a user via biometric analysis, comprising in combination:

means for generating a first user biometric (UB) from a plurality of data bits of information of physical biometric information with an application on a first server network device with one or more processors on an biometric identification system including a plurality of server network devices each with one or more processors and one or more biometric scanners used to collect physical biometric information from a human or non-human object;

means for encoding cryptographically authorization information via the application into the generated first UB defining a set of privileges granted to the human or non-human objects for a security infrastructure;

means for generating cryptographically an Identification and Verification Template (IVT) from the generated and encoded first UB via the application with a lossy transformation of information stored in the generated first UB and error correcting codes, wherein the generated IVT does not include complete information from the generated and encoded first UB but does allow for verification of the human or non-human object when the IVT is accessed a later time;

means for discarding the generated and encoded first UB;

means for storing the generated IVT on an off-line biometric storage device for use within the security infrastructure;

means for encrypting the generated IVT on an off-line biometric storage device one or more times with one or more different encryption keys;

means for receiving a request on the application on the first server network device to verify an identity of the human or non-human object;

means for generating a second user biometric (UB) for the human or non-human object with the application on the first server network device;

means for retrieving the IVT stored on off-line biometric storage device with the application on the first server on the biometric identification system; and

means for verifying an identify of the human or non-human object using the generated second UB and the retrieved dependency vector without directly comparing the retrieved IVT and the second UB.