Authentication using biometric technology through a consumer device

• US 9,390,445 B2
• Filed: 05/21/2013
• Issued: 07/12/2016
• Est. Priority Date: 03/05/2012
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Sheets, John F., Wagner, Kim R.
• Primary Examiner(s): Qayyum, Zeshan
• Application Number:
  US13/899,496
• Publication Number:
  US 20130290136A1
• Time in Patent Office: 1,148 Days
• Field of Search: 726/2
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments of the invention provide strong user authentication on a consumer device without requiring the user to go through a formal registration process with the issuer or processing network. Certain embodiments allow the use of any biometric technology (e.g., fingerprint scan, iris scan, voice recognition, etc.) supported by their consumer device (e.g., smart phone, tablet computer, personal computer) to authenticate the user. Additionally, the consumer device provides unforgeable evidence of the biometric match in the form of a biometric digital artifact to provide proof to a processing network that the match occurred. The processing network maintains a history of these authenticated transactions and biometric digital artifacts and as more and more non-fraudulent authenticated transactions occur over time, a higher level of trust (i.e., lower risk) is associated with the consumer device, biometric registration process, and the user.

Claims

1. A method for authenticating a user for a payment transaction, comprising:

storing, by a server computer, a user fraud profile and a queue;

associating, by the server computer, a predetermined period of time with the queue;

receiving, by the server computer and from a device, payment transaction data associated with the payment transaction and a biometric digital artifact;

comparing, by the server computer, the biometric digital artifact to other biometric digital artifacts stored in the user fraud profile;

authenticating, by the server computer, the payment transaction based on the comparison;

sending, by the server computer, an authentication result to the device;

storing, by the server computer, the biometric digital artifact in the queue;

determining, by the server computer, that the predetermined period of time associated with the queue has expired;

retrieving, by the server computer, the biometric digital artifact from the queue based on the determination; and

updating, by the server computer, the user fraud profile with the retrieved biometric digital artifact.

2. The method of claim 1 further comprising sending the authentication result and the payment transaction data to a transaction completion device to complete the payment transaction.

3. The method of claim 1 wherein the updating further comprises adjusting a risk score based on a number of valid biometric digital artifacts received without fraudulent activity.

4. The method of claim 1 wherein the biometric digital artifact is a cryptographically generated value.

5. The method of claim 2 wherein the user fraud profile is stored within a database of the server computer.

6. The method of claim 1 wherein the biometric digital artifact comprises a digital representation that indicates whether there is a match or correlation between a first user voice sample and a second user voice sample.

7. The method of claim 1 wherein the biometrical digital artifact is generated by the device.

8. A server for authenticating a user for a payment transaction, comprising:

a processor; and

a non-transitory computer-readable storage medium, comprising code executable by the processor for implementing a method comprising;

storing a user fraud profile and a queue;

associating a predetermined period of time with the queue;

receiving, from a device, payment transaction data associated with the payment transaction and a biometric digital artifact;

comparing the biometric digital artifact to other biometric digital artifacts stored in the user fraud profile;

authenticating the payment transaction based on the comparison;

sending an authentication result to the device;

storing the biometric digital artifact in the queue;

determining that the predetermined period of time associated with the queue has expired;

retrieving the biometric digital artifact from the queue based on the determination; and

updating, by the server computer, the user fraud profile with the retrieved biometric digital artifact.

9. The server of claim 8 wherein the method further comprises sending the authentication result and the payment transaction data to a transaction completion device to complete a transaction.

10. The server of claim 8 wherein the updating further comprises adjusting a risk score based on a number of valid biometric digital artifacts received without fraudulent activity.

11. The server of claim 8 wherein the biometric digital artifact is a cryptographically generated value.

12. The server of claim 8, wherein the user fraud profile is stored within a database of the server.