Biometric authentication of mobile financial transactions by trusted service managers

• US 9,858,566 B2
• Filed: 10/31/2014
• Issued: 01/02/2018
• Est. Priority Date: 06/06/2008
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Inventors: Mardikar, Upendra S., Duprat, Eric
• Primary Examiner(s): Shaawat, Mussa A
• Assistant Examiner(s): KERRIGAN, MICHAEL V
• Application Number:
  US14/529,692
• Publication Number:
  US 20150056957A1
• Time in Patent Office: 1,159 Days
• CPC Class Codes: G06Q 20/1085 involving automatic teller machines [ATMs]
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3265 characterised by personalisation for use
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07F 7/0826 Embedded security module
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 : using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys
• CPC Class Codes: H04W 4/80 : Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

In one embodiment, a method comprises storing a biometric trait of a user in a data communication device of the user, comparing a biometric trait input into the device with the biometric trait stored in the device, generating a certificate authenticating the user within the device if the biometric trait input into the device matches the biometric trait stored in the device, and facilitating a financial transaction of the user using the certificate.

Claims

1. A user device unlocking system, comprising:

a processing system that is located in a user device;

a non-transitory memory system that is located in the user device and that stores instructions that, when executed by the processing system, provide an operating system;

a biometric trait data input device that is located on the user device;

tunnel circuitry that is coupled to the biometric trait data input device and configured to prevent access to biometric trait data captured by the biometric trait data input device and transmitted through the tunnel circuitry by non-authorized subsystems in the user device; and

a secure element that is located in the user device, that is coupled to the biometric trait data input device through the tunnel circuitry, and that stores biometric trait authentication data, wherein the secure element is configured to receive biometric trait data of a user directly from the biometric trait data input device through the tunnel circuitry and prevent capture of the biometric trait data by an application on the user device, verify the biometric trait data using the biometric trait authentication data and, in response to the verification of the biometric trait data, unlock the user device to provide access to the operating system.

2. The system of claim 1, wherein the tunnel circuitry is FIPS 140-2 level 3 compliant.

3. The system of claim 1, wherein the tunnel circuitry provides for encryption of the biometric trait data.

4. The system of claim 1, further comprising:

a communication module that is located in the user device and that is coupled to the processing system, wherein the communication module is configured to provide for communications over a network.

5. The system of claim 4, wherein the communication module is at least one of a Near Field Communication (NFC) communication module, a Bluetooth communication module, and an infrared communication module.

6. The system of claim 1, wherein the secure element verifying the biometric trait data using the biometric trait authentication data and unlocking the user device to provide access to the operating system includes the secure element generating a certificate that authenticates the user and providing the certificate to the processing system.

7. The system of claim 1, wherein the secure element is a first secure element, and wherein the authentication system further comprises:

a second secure element that is located in the user device and that includes the application, wherein the unlocking of the user device provides access to the application.

8. A method for unlocking a secure system, comprising:

reading, by a biometric reader that is coupled to a secured system, biometric data;

transmitting, to a secure portion of a secured system from the biometric reader and through tunnel circuitry that is configured to prevent capture of the biometric data captured by an application on a device, the biometric data;

authenticating, using biometric authentication data that is stored in the secure portion of the secured system, the biometric data;

transmitting, from the secure portion of the secured system to an unlocking subsystem of the secured system, an authentication confirmation in response to authenticating the biometric data; and

unlocking, by the unlocking subsystem of the secured system in response to receiving the authentication confirmation, the secured system to provide access to functionality provided by the secured system.

9. The method of claim 8, wherein the tunnel circuitry is FIPS 140-2 level 3 compliant.

10. The method of claim 9, further comprising:

encrypting, using the tunnel circuitry, the biometric data.

11. The method of claim 8, further comprising:

communicating, using a communication device coupled to the secured system, information over a network subsequent to providing access to the functionality provided by the secured system.

12. The method of claim 11, wherein the communication device is at least one of a Near Field Communication (NFC) communication device, a Bluetooth communication device, and an infrared communication device.

13. The method of claim 8, wherein the authenticating the biometric data and providing access to the functionality provided by the secured system further comprises:

generating, by the secure portion of the secured system, an authentication certificate and providing the authentication certificate to the unlocking subsystem of the secured system.

14. The method of claim 8, wherein the providing access to the functionality provided by the secured system further comprises:

providing access to the application included on a second secure portion of the secured system.

15. A non-transitory computer readable medium having stored thereon computer-readable instructions executable to cause a machine to perform operations comprising:

configuring a secure element in a lockable computer to receive and store biometric verification data;

configuring a biometric input system on the lockable computer to receive a biometric input and provide the biometric input to the secure element through tunnel circuitry that is configured to prevent capture of the biometric input captured by the biometric input system by an application on the lockable computer;

configuring the secure element to compare the biometric input to the biometric verification data to determine a match and provide an unlock instruction to the lockable computer in response to determining the match;

configuring the lockable computer to unlock in response to receiving the unlock instruction; and

configuring the lockable computer to provide access to an operating system in response to unlocking.

16. The non-transitory computer readable medium of claim 15, wherein the tunnel circuitry is FIPS 140-2 level 3 compliant.

17. The non-transitory computer readable medium of claim 15, wherein the operations further comprise:

configuring the tunnel circuitry to encrypt the biometric input.

18. The non-transitory computer readable medium of claim 15, wherein the operations further comprise:

configuring a communication system in the lockable computer to communicate information over a network subsequent to the unlocking of the lockable computer.

19. The non-transitory computer readable medium of claim 15, wherein the operations further comprise:

configuring the secure element to generate a certificate and provide the certificate to the lockable computer as part of the unlock instruction.

20. The non-transitory computer readable medium of claim 15, wherein the secure element is a first secure element, and wherein the operations further comprise:

configuring a second secure element in the lockable computer to provide access to the application included on the second secure element in response to the unlocking of the lockable computer.