Secure method and apparatus to verify personal identity over a network

• US 8,406,428 B2
• Filed: 11/10/2009
• Issued: 03/26/2013
• Est. Priority Date: 12/11/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bauchot, Frederic, Marmigere, Gerard, Truntschka, Carole, Tressols, Florence
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US12/615,838
• Publication Number:
  US 20100150353A1
• Time in Patent Office: 1,232 Days
• Field of Search: 382/282, 380/282, 713/168, 713/186, 713/189, 713/176, 726/15, 726/4, 726/7
• US Class Current: 380/282
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

The present application provides an apparatus and method for verifying a user, via captured biometric characteristics of the user, who is interacting online. The captured biometrics are guaranteed to be captured in real-time, and avoids the possibility of providing biometrics that were previously captured, by sending to the user a time-sensitive challenge and requiring the user to provide the requested biometric information within a predetermined time period. Therefore, the present invention is best positioned for environments where trusted identification of a user is needed online to facilitate secure transactions.

Claims

1. A system for on-demand authentication of a user as an owner of an avatar interacting in a virtual world environment, said system comprising:

means for issuing, from a first computing device, a temporary challenge to the user interacting in said virtual world environment at a second computing device, said temporary challenge issued with limited time life for authenticating the user, and said temporary challenge being encrypted with a public key of said user, said public key employed as part of a public key encryption algorithm;

means for receiving, at said second computing device, said temporary challenge with limited time life, said second computing device having a memory storage device including a protected memory storing a private key of the user;

means for decrypting said received temporary challenge with said private key;

means for capturing biometric information of the user in response to the received temporary challenge from the first computing device;

means for hashing the biometric information at said second computing device;

means for encrypting the hash of the captured biometric information concatenated with the received challenge as an encrypted response, said encrypting means employing said stored private user key of the user;

means for returning the encrypted response to the first computing device; and

means for authenticating the user at said first computing device by processing the encrypted challenge within a limited amount of time.

2. The system according to claim 1, wherein the public key encryption algorithm includes RSA algorithm.

3. The system according to claim 1, wherein the hashing is according to at least one of an MD5 hash algorithm and an SHA-1 hash algorithm.

4. The system according to claim 1, wherein the received challenge was transmitted by a virtual world server.

5. The system according to claim 1, wherein the biometric information includes digitally captured human characteristics of at least one of a fingerprint, a handprint, a hand-written signature, an iris and a retina.

6. The system according to claim 1, wherein said limited time life is on the order of minutes, or an amount of time to allow transmission of the temporary challenge, capture of the user'"'"'s biometric pattern and return of the hash/encrypted response by the user.

7. A method for on-demand authentication of a user as an owner of an avatar interacting in a virtual world environment, said method comprising:

issuing, from a first computing device, a temporary challenge to the user interacting in said virtual world environment at a second computing device, said temporary challenge issued with limited time life for authenticating the user, and said temporary challenge being encrypted with a public key of said user, said public key employed as part of a public key encryption algorithm;

receiving, at said second computing device, said temporary challenge with limited time life, said second computing device having a memory storage device including a protected memory storing a private key of the user;

decrypting said received temporary challenge with said private key;

capturing, at the user device, biometric information of the user in response to the received temporary challenge;

hashing the biometric information at said second computing device;

encrypting, using said stored private user key of the user, the hash of the captured biometric information concatenated with the received temporary challenge as an encrypted response;

returning the encrypted response to the first computing device; and

authenticating the user at said first computing device by processing the encrypted challenge within a limited amount of time.

8. The method according to claim 7, wherein the public key encryption algorithm includes RSA algorithm.

9. The method according to claim 7, wherein the hashing is according to at least one of an MD5 hash algorithm and an SHA-1 hash algorithm.

10. The method according to claim 7, wherein the first computing device is a virtual world server.

11. The method according to claim 7, wherein the biometric information includes digitally captured human characteristics of at least one of a fingerprint, a handprint, a hand-written signature and an iris.

12. The method according to claim 7, wherein said limited time life is on the order of minutes, or an amount of time sufficient to allow transmission of the temporary challenge, capture of the user'"'"'s biometric pattern and return of the hash/encrypted response by the user.