System and method for authorizing access to access-controlled environments

• US 9,996,684 B2
• Filed: 01/14/2016
• Issued: 06/12/2018
• Est. Priority Date: 05/13/2013
• Status: Active Grant

• Current Assignee: Veridium IP Limited (Harvard Investments LP)
• Original Assignee: Veridium IP Limited (Harvard Investments LP)
• Inventors: Hoyos, Hector, Braverman, Jason, Streit, Scott, Xiao, Geoffrey, Mather, Jonathan Francis
• Primary Examiner(s): Abrishamkar, Kaveh
• Application Number:
  US14/995,769
• Publication Number:
  US 20160205096A1
• Time in Patent Office: 880 Days
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07F 9/001 Interfacing with vending machines using mobile or wearable devices
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Systems and methods are provided for authorizing a user to access an access-controlled environment. The system includes a system server platform that communicates with fixed PC'"'"'s, servers and mobile devices (e.g., smartphones) operated by users. The systems and methods described herein enable a series of operations whereby a user attempting to access an access-controlled environment is prompted to biometrically authenticate using the user'"'"'s preregistered mobile device. Biometric authentication can include capturing images of the user'"'"'s biometric features, encoding the features as a biometric identifier, comparing the biometric identifier to a previously generated biometric identifier and determining liveness. In addition, the authentication system can further authorize the user and electronically grant access to the access-controlled environment. In this manner the secure authentication system can, based on biometric authentication, authorize a user'"'"'s access to devices, online services, physical locations or any networked environment that require user authorization.

Claims

1. A method for securely coordinating access to an access-controlled environment for a user operating a user computing device executing a biometric authentication application for confirming the user'"'"'s identity as a function of a biometric of the user, the method comprising:

receiving, by a trusted server from a user computing device, an application certificate that uniquely identifies a particular biometric authentication application executing on the user device, wherein the user computing device is the user'"'"'s personal mobile computing device;

verifying, by a trusted server, that the received application certificate is valid;

receiving, by the trusted server from the user computing device, a representation of the user'"'"'s identity and a representation of at least a component of the user computing device;

testing the representation of the user'"'"'s identity against a trusted set of user identification information to verify the user is authorized to access the access-controlled environment;

providing a unique identifier that is assigned for the user based on the representation of the user'"'"'s identity;

causing, by the trusted server during user enrollment, generation of a key pair comprising a private key and a corresponding public key, wherein the private key and the unique identifier is stored by the user device, and wherein the key-pair is generated as a function of verifying that the received application certificate is valid and establishing the user'"'"'s identity as a function of biometrics using the biometric authentication application,

storing, by the trusted server in a storage medium, the public key in association with the assigned unique identifier thereby creating a registered instance of a user identity, wherein the identity instance is created as a function of verifying the application certificate, verifying the user identity and generation of the key pair,

receiving, by the trusted server subsequent to creating the identity instance for the user, a request to access an access-controlled environment (ACE);

capturing, from the user, by the user device using an associated biometric capture device, a current biometric representation of the user'"'"'s biometric features;

confirming, by the user device using the biometric authentication application, that the current biometric representation captured by the user device matches a registered biometric representation of the user previously stored by the user device in a local storage medium;

receiving, by the trusted server from the user device, a communication including;

information asserting an identity of one or more of the user and the user device, a representation of the private key and the communication providing an indication that the user'"'"'s identity has been confirmed by the user device executing the biometric authentication application as a function of biometrics;

identifying, by the trusted server based on the identification information, the user instance;

verifying, by the trusted server based on the public key associated with the identified user instance, that the representation of the private key corresponds to the public key;

determining, by the trusted server based on the step of verifying using the public key, that the identity of the user has been confirmed by the user device executing the biometric authentication application as a function of biometrics;

based on the identifying, verifying and determining steps and the received access-control information, facilitating the user access to the access-controlled environment using the trusted server in conjunction with one or more remote computing devices.

2. The method of claim 1, wherein the key-pair is unique to the user device and the corresponding user identity instance stored on the back-end storage such that the private key is useable by the user device to securely assert the user identity and the public key is useable by the trusted server to identify the user identity.

3. The method of claim 1, wherein the user device is configured to assert a user identity only upon biometric authentication of the user.

4. The method of claim 1, wherein the key-pair is generated using one or more of the user device and the trusted server.

5. The method of claim 1, wherein at least the private key is encoded with a password known only to the user device used during enrollment of the user identity instance.

6. The method of claim 1, further comprising:

in response to the request to access the ACE, transmitting a prompt, by the trusted server to the user device, causing the user device to capture the user'"'"'s biometrics and biometrically authenticate the user using the biometric authentication application, and wherein the communication is received in response to the user device confirming the user'"'"'s identity as a function of the captured biometrics.

7. The method of claim 1, wherein the unique identifier is stored by the trusted server in the storage and is associated with a representation of an access account that is useable to provide the user access to the access-controlled environment.

8. The method of claim 1, wherein each user identity instance, links a device and a an access account, whereby communications from the user device that are encoded using the private key securely asserts the user identity to the trusted server and is useable to identify the associated access account.

9. A method for securely coordinating a user'"'"'s access to an access-controlled environment using a user computing device executing a biometric authentication application for confirming the user'"'"'s identity as a function of a biometric of the user and using a remote server computing device, the method comprising:

providing, at a user computing device having a processor that is configured by executing instructions in the form of one or more software modules including a biometric authentication application stored in a storage medium of the user device, user identification information, wherein the user identification information includes at least one of;

information identifying the user, information identifying a component of the user device, information identifying an access account used by the user to access the access-controlled environment, and wherein the user device is the user'"'"'s personal mobile computing device;

verifying the identity of the user based on the user identification information, wherein verification is performed using the mobile device in conjunction with a trusted server device in communication with the mobile device over a network and having access to stored user identification information;

registering, by the user device executing the biometric authentication application, a representation of the user'"'"'s biometric features that is useable to authenticate the user identity as a function of biometrics locally at the mobile device, and wherein registering the biometric representation of the user identity comprises;

capturing, with the processor executing the biometric authentication application, the representation of the biometrics of the user,

generating, with the processor executing the biometric authentication application, a biometric template for the user identity, and

storing, by the processor in the storage medium, the biometric template;

transmitting, with the user device over a network to a trusted server, a certificate asserting the authenticity of the biometric authentication application executing on the user device, and wherein the certificate is provided for verification by the trusted server,

causing, by the user device, the enrollment of a user account with the trusted server, wherein enrollment includes;

generating a unique identifier associated with the user account being enrolled with the trusted server and stored in a database,

generating a cryptographic key-pair comprising a private key and public key, wherein the key-pair is generated specifically for the user account as a function of verification of the certificate by the trusted server, and verification of the user identity as a function of the user identification information,

storing, by the user device in the storage medium, the private key in association with the unique identifier identifying the user account, and

storing the public key by the trusted server in the database, wherein the public key is stored by the trusted server in association with the unique identifier;

capturing, from the user, by the user device using an associated biometric capture device, a current biometric representation of the user'"'"'s biometric features;

determining, by the user device using the biometric authentication application, that the current biometric representation captured by the user device matches the registered biometric representation for the user identity associated with the enrolled user account and stored in the storage medium of the user device;

transmitting, by user device to the trusted server, a request to access the access controlled environment, the request including a user identifier and a representation of the private key asserting the user identity and providing confirmation that the user identity associated with the user account has been confirmed using the biometric authentication application as a function of biometrics;

authorizing the user, by the trusted server based on the received request, wherein the authorizing step comprises;

retrieving, by the trusted server from the database, the public key associated with the received user identifier,

verifying, by the trusted server, that the representation of the private key corresponds to the public key, and

determining, by the trusted server based on the step of verifying using the public key, that the identity of the user has been confirmed by the user device executing the biometric authentication application as a function of biometrics; and

receiving, by the processor from the trusted server, a notification that the user has been authorized to access the access controlled environment by the trusted server.

10. The method of claim 9, wherein enrollment of the user account is completed as a function of verification of the certificate by the trusted server, verification of the user identity as a function of the user identification information and enrolling the user biometrics by the user device processor.

11. The method of claim 9, wherein each user identity instance, links a device and an access account, whereby communications from the user device that are encoded using the private key securely asserts the user identity to the trusted server and is useable to identify the associated access account.

12. The method of claim 9, wherein the stored private key and unique identifier provide the only link between the user identity and the access account.

13. The method of claim 9, wherein the request is transmitted to the trusted server over a secured communications channel.

14. The method of claim 13, wherein the intervening computing devices include one or more of:

a transaction terminal configured to process an electronic transaction;

another user computing device used by the user to access a secure electronic system.

15. The method of claim 9, wherein the request causes the trusted server to, based on authorization of the user account, retrieve access account information associated with the user account from a trusted data store and provide the access account information to a remote computing device associated with the access-controlled environment.

16. The method of claim 9, wherein the private key is accessible to the user device processor only as a result of successful authentication of the user identity as a function of biometrics.

17. The method of claim 9, wherein enrolling the user biometrics comprises:

capturing, with the user device processor executing the biometric authentication application, a representation of the user'"'"'s biometric features, and recording a biometric template in the storage medium of the user device, wherein the biometric template is useable to authenticate the user as a function of biometrics.

18. The method of claim 9, wherein the private key is stored in a secure segment of the storage medium and wherein the private key is accessible to the user device processor only upon successful authentication of the user identity associated with the private key as a function of biometrics.

19. The method of claim 9, further comprising:

receiving, by the user device from the user, information identifying the user account;

comparing the captured representation against the stored biometric representation associated with the selected user account;

based on successful biometric authentication, accessing the private key associated with the user account; and

encoding at least a portion of the request using the private key associated with the user account.