Verification of authenticity and responsiveness of biometric evidence and/or other evidence

• US 9,673,981 B1
• Filed: 09/23/2016
• Issued: 06/06/2017
• Est. Priority Date: 11/30/2011
• Status: Active Grant

• Current Assignee: Biobex, LLC
• Original Assignee: Biobex, LLC
• Inventors: Joyce, III, Arthur W.
• Primary Examiner(s): KIM, TAE K
• Application Number:
  US15/274,065
• Time in Patent Office: 256 Days
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07C 9/25 using biometric data, e.g. fingerprints, iris scans or voice recognition
• CPC Class Codes: G07C 9/26 using a biometric sensor integrated in the pass
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Authenticity and responsiveness of evidence (e.g., biometric evidence) may be validated without regard for whether there is direct control over a sensor that acquired the evidence. In some implementations, only a data block containing evidence that is (1) appended with a server-generated challenge (e.g., a nonce) and (2) signed or encrypted by the sensor may validate that the evidence is responsive to a current request and belongs to a current session. In some implementations, trust may be established and/or enhanced due to one or more security features (e.g., anti-spoofing, anti-tampering, and/or other security features) being collocated with the sensor at the actual sampling site.

Claims

1. A system configured to acquire evidence that is to be provided for validation of the authenticity and responsiveness of the evidence, the system comprising:

a sensor configured to acquire one or more samples;

one or more hardware processors communicatively coupled with the sensor and configured by machine-readable instructions to;

receive a request for evidence from an external client computing platform, the evidence to include one or more samples or a representation of one or more samples, the request for evidence including a challenge;

obtain individual ones of the one or more samples acquired by the sensor;

combine the evidence and a response to the challenge into a signed or encrypted unit of data;

wherein combining the evidence and the response to the challenge into the signed or encrypted unit of data includes;

packing the evidence and the response to the challenge into two or more data blocks;

obtaining hashes of the two or more data blocks; and

obtaining another data block that includes the hashes of the two or more data blocks;

effectuate transmission of the signed or encrypted unit of data to a server by way of a client computing platform communicatively coupled with the sensor.

2. The system of claim 1, wherein the challenge includes a nonce, the nonce including a random number generated by a given hardware processor, the random number being indiscernible prior to its generation except by the given hardware processor.

3. The system of claim 1, wherein the one or more hardware processors are further configured by machine-readable instructions to perform one or more anti-tampering checks to determine whether the sensor has been tampered with.

4. The system of claim 3, wherein the one or more hardware processors are further configured by machine-readable instructions to effectuate transmission of an indication that the sensor has been tampered with responsive to the one or more anti-tampering checks resulting in a positive determination.

5. The system of claim 3, wherein the one or more hardware processors are further configured by machine-readable instructions to record an indication that the sensor has been tampered with.

6. The system of claim 1, wherein individual ones or the one or more samples acquired by the sensor include a biometric sample obtained for one or more of biometric authentication, identification, verification, and/or enrollment.

7. The system of claim 1, wherein the one or more hardware processors are further configured by machine-readable instructions to extract a template associated with a given sample acquired by the sensor, the template including measurement data from the given sample.

8. The system of claim 1, wherein a given sample includes an image of a body part of a user.

9. The system of claim 1, wherein the one or more hardware processors are further configured by machine-readable instructions to effectuate transmission of an indication that the given sample was obtained from one or more of a false representation of a sample acquired by the sensor, a surrogate feature, or a prosthetic feature, the indication being transmitted responsive to the one or more anti-spoofing checks resulting in a positive determination.

10. The system of claim 1, wherein the request for evidence is received responsive to a request to access a protected resource, the protected resource including one or both of protected information or a protected device.

11. The system of claim 1, further comprising a display apparatus configured to present a transaction identifier to a user.

12. The system of claim 1, wherein the one or more hardware processors are further configured by machine-readable instructions to determine a first quality metric associated with a first sample, the first quality metric including a description of one or more measureable aspects of the first sample.

13. The system of claim 1, wherein the one or more hardware processors are further configured by machine-readable instructions to perform one or more anti-spoofing checks to determine whether a given sample was obtained from one or more of a false representation of a sample acquired by the sensor, a surrogate, or a prosthetic.

14. The system of claim 1, wherein the one or more hardware processors are further configured by machine-readable instructions to provide a digital signature for the signed or encrypted unit of data, the digital signature being associated with a private key.

15. The system of claim 11, wherein the transaction identifier is presented as one or more of an image, an icon, or text.

16. The system of claim 12, wherein the one or more hardware processors are further configured by machine-readable instructions to determine, whether the first sample is to be rejected for inclusion in the evidence based on the first quality metric not breaching a threshold.

17. The system of claim 14, wherein the private key is associated with a public key infrastructure certificate, the public key infrastructure certificate identifying one or more of a manufacturer of the sensor, a vendor of the sensor, a sensor type, a sensor model, a serial number, a security feature, or a security level.

18. A hardware processor-implemented method, the method comprising:

receiving a request for evidence from an external client computing platform, the evidence to include one or more biometric samples or a representation of one or more biometric samples, the request for evidence including a challenge;

obtaining individual ones of one or more biometric samples, the one or more biometric samples being acquired by a sensor, the sensor being communicatively coupled with a client computing platform, the client computing platform being configured to receive the request for evidence;

combining the evidence and a response to the challenge into a signed or encrypted unit of data;

wherein combining the evidence and the response to the challenge into the signed or encrypted unit of data includes;

packing the evidence and the response to the challenge into two or more data blocks;

obtaining hashes of the two or more data blocks; and

obtaining another data block that includes the hashes of the two or more data blocks;

and

effectuating transmission of the signed or encrypted unit of data to a server by way of the client computing platform.

19. The method of claim 18, further comprising:

performing one or more anti-tampering checks to determine whether the sensor has been tampered with.

20. The method of claim 19, further comprising:

effectuating transmission of an indication that the sensor has been tampered with responsive to the one or more anti-tampering checks resulting in a positive determination.