Protecting codes, keys and user credentials with identity and patterns

• US 9,152,779 B2
• Filed: 01/06/2012
• Issued: 10/06/2015
• Est. Priority Date: 01/16/2011
• Status: Active Grant

• Current Assignee: Michael Stephen Fiske
• Original Assignee: Michael Stephen Fiske
• Inventors: Fiske, Michael Stephen
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): WYSZYNSKI, AUBREY H
• Application Number:
  US13/344,795
• Publication Number:
  US 20120185698A1
• Time in Patent Office: 1,369 Days
• Field of Search: 713/186
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security
• CPC Class Codes: Y04S 50/12 Billing, invoicing, buying or selling transactions or other related activities, e.g. cost or usage evaluation

Abstract

Machine and method of accessing information securely are disclosed. Two sets of user identifying data are acquired. A transformation is established by mapping of one set of data onto another set of data or onto itself. An invariant is generated from the transformation of the user identifying data. An authentication key is generated using the invariant. In an embodiment, the invariant is a relationship between two objects that remains static under transformations between the two objects. In an embodiment, the invariant is a cryptography key. In an embodiment, the transformation(s) help perform an authentication of the user and are executed by digital computer program instructions. In an embodiment, pattern transformation(s) are represented with colors, geometry, or frequencies.

Claims

1. A machine comprising:

a processor system with at least one processor; and

a memory system with one or more machine readable media,

the machine readable media storing thereon one or more instructions, which when executed cause the processor system to implement a method including at least acquiring two sets of user identifying data, via different acquisitions;

transforming, by the processor system, the user identifying data, the transforming including at least a mapping of one of the two sets of user identifying data onto another of the two sets of user identifying data,

calculating, by the processor system, an invariant from one or more transformations of the user identifying data, the transforming of the user identifying data being a result of the one or more transformations, the invariant being a relationship between two objects that, within a tolerance determined prior to authentication, does not change under the one or more of the transformations between the two objects, and

generating by the processor system, an authentication key based on the invariant.

2. The machine of claim 1 wherein said invariant is a cryptography key.

3. The machine of claim 1 wherein said invariant is a user credential or code.

4. The machine of claim 2 wherein said cryptography key encrypts a financial transaction.

5. The machine of claim 1 wherein said computation is executed in a secure area of a processor.

6. The machine of claim 1 wherein each of the two sets of user identifying information includes a biometric template or a biometric print, and said one or more transformations are between two biometric templates or biometric prints of the two sets of user identifying information.

7. The machine of claim 1 wherein each of the two sets of user identifying information includes a non-biometric pattern, and said one or more transformations are between two or more non-biometric patterns of the user identifying information.

8. The machine of claim 1 wherein the method further includes at least authenticating a user associated with the user identifying information and the authenticating includes at least the transforming, by at least performing said one or more transformations.

9. The machine of claim 8 wherein said authenticating includes at least authenticating biometric data associated with the user.

10. The machine of claim 9 where said biometric data includes at least fingerprints.

11. The machine of claim 9 wherein the authenticating of the biometric data includes at least recognizing a voice.

12. The machine of claim 8 where the biometric data includes at least biometric data derived from two or more fingers.

13. The machine of claim 9 wherein said one or more transformations include at least one affine transformation.

14. The machine of claim 8 wherein the authenticating includes at least matching one or more features of one of the two sets of user identifying data with one or more features of another of the two set of user identifying data, and the calculating of said one or more transformations including at least deriving the one or more transformations from steps performed as part of the matching of the one or more features.

15. The machine of claim 14 wherein said matching of the one or more features includes at least matching a pair of features from one of the two sets of user identifying data with a corresponding pair of features from another of the two sets of user identifying data, and the matching of the air of features includes at least matching a relationship between a first feature of the pair of features and a second feature of the pair of features.

16. The machine of claim 14 wherein at least one feature of the one or more features is a fingerprint ridge or a valley ending or a ridge bifurcation or a valley bifurcation.

17. The machine of claim 15 wherein said matching of feature pairs includes at least computing of a distance between features.

18. The machine of claim 14 wherein at least one feature of the one or more features is derived from more than one finger.

19. The machine of claim 1 wherein said transforming includes at least transforming one or more patterns.

20. The machine of claim 19 wherein said patterns are color patterns or geometric patterns.

21. The machine of claim 19 wherein the method further comprises authenticating a user by at least said transforming.

22. The machine of claim 19 wherein said invariant is derived from said transforming of the color patterns, and the transforming of the color patterns includes at least transforming one color pattern of one of the two sets of user identifying information to match another of color pattern of another of the two sets of user identifying information.

23. The machine of claim 19 wherein at least one of said patterns contains at least one image recognizable by a person.

24. The machine of claim 23 wherein said image is a dog.

25. The machine of claim 19 wherein noise or randomness are added to said one or more patterns prior to the transforming.

26. The machine of claim 19 wherein said derivation uses a one-way method or one-way function one or more times.

27. The machine of claim 1 wherein

the method further includes at least computing a transformation difference from at least said one or more transformations, the transformation difference being a difference between two transformations, a first transformation of the two transformations being between a first subset of user identifying data of a first of the two sets of user identifying data and a second subset of user identifying data of the second of the two sets of user identifying data and a second transformation of the two transformations being a transformation between the first subset of user identifying data and a third subset of user identifying data, the third subset of user identifying data being a subset of the second set of user identifying data.

28. The machine of claim 27 wherein the method further includes at least deriving said invariant from at least the transformation difference.

29. The machine of claim 27 wherein the method further includes at least deriving said invariant from at least something that is known to a user.

30. The machine of claim 27 wherein

the method further includes at least deriving the invariant from at least the transformation difference;

applying a one-way method or one-way function at least once to said invariant.

31. The machine of claim 30 wherein the deriving of the invariant from at least the transformation difference includes deriving the invariant from at least something that is known in addition to deriving the invariant from the transformation difference, such that the invariant to which the one-way method or one-way function is applied depends on said transformation difference and depends on something that is known.

32. The machine of claim 1 wherein the generating of the authentication key includes at least applying a one-way method or one-way function one or more times to the invariant.

33. A machine-implemented method comprising:

acquiring two sets of user identifying data, each set of user identifying data being acquired at a different time,

transforming, by a machine system, the user identifying data, the transforming including at least applying one or more transformations to the user identifying data, each transformation being a mapping of one set of user identifying data of the two sets of user identifying data onto another set of user identifying data of the two sets of user identifying data, the machine system including at least a processor system having one or more processors and a memory system, and

calculating, by the processor system, an invariant from the one or more transformations the invariant being a relationship between two objects that, within a tolerance determined prior to authentication, does not change under transformations between the two objects, where one of the two objects is associated with one of the two sets of user identifying data and another of the two objects is associated with another of the two sets of user identifying data.

34. The method of claim 33 wherein said invariant is at least one of the following:

a cryptography key, a code or a user credential.

35. The method of claim 34 wherein the method further comprises securing a financial transaction by at least encrypting the financial transaction with said cryptography key or code or user credential.

36. The method of claim 33 wherein said transformations are computed in a secure area of a processor.

37. The method of claim 33 wherein each of the two sets of user identifying information includes a biometric template or a biometric print, and said one or more transformations are between biometric templates or biometric prints of the two sets of identifying information.

38. The method of claim 33 wherein each of the two sets of user identifying information includes a non-biometric pattern, and said one or more transformations are between two or more non-biometric patterns of the user identifying information.

39. The method of claim 35 wherein the method further comprises authenticating a user associated with the user identifying information and the authenticating includes at least the transforming, by at least performing said one or more transformations.

40. The method of claim 38 wherein said authenticating includes at least authenticating biometric data associated with the user.

41. The method of claim 40 where said biometric data includes at least fingerprints.

42. The method of claim 40 wherein the authenticating of the biometric data includes at least recognizing a voice.

43. The method of claim 40 wherein the biometric data includes at least biometric data derived from two or more fingers.

44. The method of claim 40 wherein said one or more transformations include at least one affine transformation.

45. The method of claim 40 wherein the authenticating includes at least matching one or more features in said biometric data, and generating said one or more transformations based at least on the matching of the one or more features.

46. The method of claim 45 wherein said matching of the one or more features includes at least a matching pair of features from one of the two sets of user identifying information with a corresponding pair of features from another of the two sets of user identifying data, and the matching of the pair of features includes at least matching a relationship between a first feature of the pair of features and a second feature of the pair of features.

47. The method of claim 45 wherein at least one feature of the one or more features is a fingerprint ridge or valley ending or a ridge bifurcation or a valley bifurcation.

48. The method of claim 46 wherein said matching of feature pairs includes at least computing a distance between features.

49. The method of claim 48 wherein at least one feature of the one or more features is derived from more than one finger.

50. The method of claim 33 wherein each set of two sets of user identifying data including one or more patterns, and said transforming including mapping the one or more patterns of one of the two sets of user identifying data to one or more patterns of the other set of user identifying data.

51. The method of claim 50 wherein said patterns are color patterns or geometric patterns.

52. The method of claim 50 further comprising authenticating a user by at least performing the transforming.

53. The method of claim 51 wherein the calculating of said invariant is based on the mapping between color patterns or geometric patterns.

54. The method of claim 50 wherein at least one of said patterns contains at least one image recognizable by a person.

55. The method of claim 54 wherein said image is a dog.

56. The method of claim 50 further comprising adding noise or randomness to said one or more patterns.

57. The method of claim 54 wherein the calculating of the invariant includes at least applying a one-way method or one-way function one or more times to the one or more transformations.

58. The method of claim 33 further comprising computing a transformation difference from said one or more transformations, the transformation difference being a difference between two transformations, a first transformation of the two transformations being between a first subset of user identifying data of a first of the two sets of user identifying data and a second subset of user identifying data of the second of the two sets of user identifying data and a second transformation of the two transformations being a transformation between the first subset of user identifying data and a third subset of user identifying data, the third subset of user identifying data being a subset of the second set of user identifying data.

59. The method of claim 58 wherein the calculating of said invariant includes at least deriving the invariant from at least said transformation difference.

60. The method of claim 58 wherein the calculating of said invariant includes at least deriving the invariant from at least something that is known to a user.

61. The method of claim 59 further comprising applying a one-way method or one-way function at least once to the transformation difference, and said invariant depends on said transformation difference.

62. The method of claim 61 wherein said invariant depends on said transformation difference and depends on something that is known.

63. The method of claim 33 wherein said derivation includes at least applying a one-way method or one-way function at least one time.

64. A method comprising performing a biometric authentication by a machine system having a processor system and memory system including at least one processor, the authentication including at least

acquiring as part of the authentication a first set of biometric data including at least a first biometric print;

determining, by a processor, a first set of one or more transformations that transforms the first biometric pattern of the first set of biometric data to a second biometric pattern of a second set of biometric data that is stored in the memory system;

determining, by the processor, a second set of one or more transformations that transforms the first biometric pattern of the first set of biometric data to a third biometric print, the third biometric pattern being a biometric pattern of the second set of biometric data that is different than the second biometric print, the third biometric pattern being stored in the memory system;

the second set of biometric data having been acquired during an enrollment process in which the user enrolls in the machine system;

computing a transformation difference from the first set of one or more transformations and the second set of one or more transformations, therein generating the transformation difference from the biometric authentication, the transformation difference being a transformation that computes a difference between results of the first set of one or more transformations and results of the second set of one or more transformations;

deriving, within a tolerance determined prior to authentication, an invariant from the transformation difference;

applying a one way method or one-way function at least once to said invariant therein forming an authentication key that depends on the transformation difference generated from the biometric authentication;

the one way method being a method for which computing an inverse is intractable and the one way function being a function for which computing an inverse is intractable.

70. The method of claim 64, the security pattern being a biometric pattern.

65. A method comprising performing a biometric authentication by a machine system having a processor system and memory system including at least one processor, the authentication including at least

determining, by the processor system, a first set of one or more transformations that transforms a first security pattern to a second security pattern;

determining, by the machine system, a second set of one or more transformations that transforms the first security pattern to a third security pattern;

determining, by the machine system, an inverse of the second set of one or more transformations;

computing, by the machine system, a third transformation that transforms results from the first set of one or more transformations to results of the second set of one or more transformations;

deriving, by the machine system, within a tolerance determined prior to authentication, an invariant from the third transformation;

applying, by the machine system, a one way method or one-way function at least once to user data that includes at least the invariant therein forming a security code;

the one way method being a method for which computing an inverse is intractable and the one way function being a function for which computing an inverse is intractable.

66. The method of claim 65, the tolerance being smaller than the invariant;

further comprising;

matching, by the machine system, the security code computed by the applying, by searching variations of a stored version of the invariant that are within the tolerance determined prior to authentication for a match to the security code computed.

67. The method of claim 66, the method further comprising:

determining whether a match resulted from a collision, where the match resulting from the collision is a match resulting from applying a one way function to a different set of data than the user data;

the determining whether a match resulted from a collision including at least testing whether variations of the security code are effective for an intended purpose of the security code.

68. The method of claim 65,

the deriving of the invariant including at least computing an inverse of the second set of transformations;

and

computing a composite transformation from the first set of transformations and the inverse of the second set of transformations; and

deriving the invariant from the composite transformation.

69. The method of claim 65,

the deriving of the invariant including at least

computing a difference between the first set of transformations and the second set of transformations.