Biometric verification with improved privacy and network performance in client-server networks

• US 9,189,612 B2
• Filed: 05/13/2014
• Issued: 11/17/2015
• Est. Priority Date: 05/13/2013
• Status: Active Grant

• Current Assignee: Ira Konvalinka
• Original Assignee: Ira Konvalinka
• Inventors: Konvalinka, Ira
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US14/276,738
• Publication Number:
  US 20140337635A1
• Time in Patent Office: 553 Days
• Field of Search: 713/186
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability

Abstract

The present invention relates to improving the privacy of biometric information used in biometric authentication of identity by retaining all biometric information corresponding to a given user, and conducting all transactions related thereto (i.e., the actual authentication process) on a client (i.e., user) side of the system, thereby maximizing the user'"'"'s control over biometric information corresponding to himself and preventing the storage of biometric templates on third-party servers outside of the control of the concerned individual. In a particular example of the present invention, security for the biometric information is further enhanced by encrypting the biometric template (used as a comparison reference during authentication, as is known) stored on the client side and completely destroying an original unencrypted version of the template. Also specified is secure storage of encryption keys for encrypting biometric data at the client. In yet a further example of the present invention, authentication is preferably conducted using the encrypted biometric templates.

Claims

1. A method of biometric authentication of a client-side authorized smart device user at least occasionally connected to a remote server via a communication network, comprising:

comparison, by the smart device, of an encrypted input biometric template corresponding to a biometric representation operably received by the smart device with an encrypted reference biometric template previously stored on the smart device and corresponding to a biometric representation of the user; and

reporting by the smart device to the remote server of user authentication success/failure based on the comparison of the encrypted input biometric template and the previously stored encrypted reference biometric template,

wherein previously storing the reference biometric template corresponding to a biometric representation of the user comprises;

recording a biometric representation of the user on the client-side smart device;

converting the biometric representation of the user into an unencrypted reference biometric template;

encrypting the unencrypted reference biometric template, using a revocable hardwired encryption key, to obtain the encrypted reference biometric template; and

substantially simultaneously storing the encrypted reference biometric template in a memory of the smart device and permanently deleting the recorded biometric representation of the user and the unencrypted reference biometric template.

2. The method of claim 1, wherein the biometric representation operably received by the smart device corresponds to a person to be authenticated as the authorized user corresponding to the encrypted reference biometric template stored in the smart device, wherein the method further comprises:

reception by the smart device of the biometric representation of the person to be authenticated;

converting the biometric representation of the person to be authenticated into an unencrypted input biometric template;

encrypting the unencrypted input biometric template to obtain an encrypted input biometric template; and

substantially simultaneously storing the encrypted input biometric template in a memory of the smart device and permanently deleting the recorded biometric representation of the user and the unencrypted input biometric template.

3. The method according to claim 1, wherein communication between the client-side smart device and the remote server is encrypted in both directions.

4. The method according to claim 3, wherein communication between the client-side smart device and the remote server is encrypted in both directions using an SSL secure communication protocol.

5. The method of claim 1, wherein the biometric representation of the user is recorded using a biometric representation detector either integral with or operably associated with the smart device.

6. The method according to claim 2, wherein, prior to generating a new reference biometric template corresponding to a subsequent legitimate user of the smart device, the current user of the smart device must authenticate himself in order to permit generation and retention of the new reference biometric template corresponding to the subsequent legitimate user of the smart device.

7. The method according to claim 1, wherein the biometric representation is one of fingerprints, retinal vein patterns, facial structure, iris patterns, voice prints, and palm prints.

8. A system for authenticating the identity of a smart device client user, comprising:

a client-side smart device constructed and arranged to selectively receive a biometric representation of an authorized user of the smart device, convert the biometric representation into a reference biometric template, and encrypt the reference biometric template using a revocable hardwired encryption key in the smart device, wherein the smart device comprises or is operably associated with a biometric representation reader for detecting and inputting the biometric representation of the authorized user; and

at least one remote server in at least occasional electronic communication with the smart device, and constructed and arranged to selectively send a request to a given smart device user to authenticate himself, and to act in response to the authentication result transmitted back from the smart device,

wherein the smart device is further constructed and arranged to selectively receive an input biometric representation of the smart device user who is to be authenticated, convert the input biometric representation into an encrypted input biometric template, and perform an authentication comparison of the encrypted reference biometric template and the encrypted input biometric template.

9. The system according to claim 8, wherein the biometric representation is one of fingerprints, retinal vein patterns, facial structure, iris patterns, voice prints, and palm prints.

10. The system according to claim 8, wherein the smart device comprises an internal memory for storing the encrypted reference biometric template, and the smart device is further constructed and arranged to permanently delete the biometric representation and the reference biometric template substantially simultaneous to the storage of the encrypted reference biometric template.

11. The system according to claim 8, wherein the smart device is further constructed and arranged to substantially simultaneously store the encrypted input biometric template in a memory of the smart device and permanently delete the received input biometric representation and the unencrypted input biometric template.