Web-based user authentication techniques and applications

• US 10,326,761 B2
• Filed: 05/15/2017
• Issued: 06/18/2019
• Est. Priority Date: 05/02/2014
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Yang, Ka
• Primary Examiner(s): Traore, Fatoumata
• Application Number:
  US15/595,460
• Publication Number:
  US 20170250982A1
• Time in Patent Office: 764 Days
• Field of Search: None
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06V 40/172 Classification, e.g. identification
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A system, apparatus, method, and machine readable medium are described for performing user authentication. For example, one embodiment of a system comprises: media capture logic implemented as a component within a browser executed on a client, the media capture logic configured to capture a user'"'"'s voice from a microphone on a client or images of the user'"'"'s face or other portion of the user'"'"'s body from a camera on the client, the media capture logic exposing an application programming interface (API); and a web authentication application implemented as another component within the browser for communicating with an authentication server to perform biometric authentication of a user, the web authentication application making calls to the API of the media capture logic to capture raw biometric data comprising the user'"'"'s voice from the microphone and/or images of the user'"'"'s face or other portion of the user'"'"'s body from the camera, the web authentication application to implement a biometric authentication process to authenticate the user with the raw biometric data.

Claims

1. A system comprising:

an authentication server of a relying party;

a client communicatively coupled to the authentication server, the client receiving a request from a user to perform a transaction with the relying party which requires user authentication, the client comprising a secure transaction service to establish a secure communication channel between the authentication server and a web browser (browser) executed on the client;

media capture logic implemented as a component within the browser, the media capture logic configured to capture a user'"'"'s voice from a microphone on a client or images of the user'"'"'s face or other portion of the user'"'"'s body from a camera on the client, the media capture logic exposing an application programming interface (API); and

a web authentication application implemented as another component within the browser for communicating with the authentication server to perform biometric authentication of a user, the web authentication application making calls to the API of the media capture logic to capture raw biometric data comprising the user'"'"'s voice from the microphone and/or images of the user'"'"'s face or other portion of the user'"'"'s body from the camera, the web authentication application to implement a biometric authentication process to authenticate the user with the raw biometric data.

2. The system as in claim 1 wherein the biometric authentication process comprises:

initiating an authentication transaction with the authentication server through the secure communication channel;

receiving an authentication request from the authentication server through the secure communication channel; and

providing the raw biometric data to the authentication server through the secure communication channel, the authentication server comprising a matcher module to compare the raw biometric data with biometric reference data associated with the user to determine a correlation between the raw biometric data and the biometric reference data.

3. The system as in claim 2 wherein a successful authentication is defined based on the correlation being above a specified threshold value.

4. The system as in claim 2 wherein the authentication server further comprises a feature extraction module to extract one or more specified features from the raw biometric data, wherein the matcher module compares the extracted features against corresponding features from the biometric reference data.

5. The system as in claim 4 wherein in response to the authentication server generating a successful authentication indication, the user is provided with access to one or more resources managed by the relying party.

6. The system as in claim 2 wherein the web authentication application is further configured to register with the authentication server using a registration process comprising:

providing the raw biometric data to the authentication server through the secure communication channel;

a feature extraction module on the authentication server extracting specified features of the raw biometric data to generate biometric reference data; and

storing the biometric reference data in a secure storage accessible by the authentication server.

7. The system as in claim 1 wherein the web authentication application comprises a matcher module to compare the raw biometric data with biometric reference data associated with the user to determine a correlation between the raw biometric data and the biometric reference data.

8. The system as in claim 7 wherein a successful authentication is defined based on the correlation being above a specified threshold value, wherein an indication of a successful authentication is transmitted from the web authentication application to the authentication server.

9. The system as in claim 7 wherein the web authentication application further comprises a feature extraction module to extract one or more specified features from the raw biometric data, wherein the matcher module compares the extracted features against corresponding features from the biometric reference data.

10. The system as in claim 9 wherein in response to the web authentication application generating a successful authentication indication, the user is provided with access to one or more resources managed by a relying party.

11. The system as in claim 7 wherein the web authentication application is further configured to register with the authentication server using a registration process, wherein the web authentication application comprising a feature extraction module to extract specified features of the raw biometric data during registration to generate biometric reference data, the biometric reference data being stored within a secure storage accessible by the matcher module.

12. The system as in claim 11 wherein the registration process further comprises:

generating a public/private key pair on the client; and

transmitting a public key of the key pair to the authentication server through the secure communication channel, wherein the authentication server associates the public key with an account of the user and stores the public key in a secure storage.

13. A method to perform web-based user authentication, the method comprising:

implementing media capture logic as a component within a web browser (browser) executed on a client;

implementing a web authentication application as another component within the browser for communicating with an authentication server of a relying party to perform biometric authentication of a user;

receiving, at the client, a request from the user to perform a transaction with the relying party, the transaction requiring user authentication;

establishing a secure communication channel between the web authentication application and the authentication server via a secure transaction service of the client;

initiating an authentication transaction with the authentication server by the web authentication application through the secure communication channel;

receiving an authentication request from the authentication server by the web authentication application through the secure communication channel;

using the media capture logic to capture the user'"'"'s voice from a microphone on a client or images of the user'"'"'s face or other portion of the user'"'"'s body from a camera on the client, the media capture logic exposing an application programming interface (API); and

making calls to the API of the media capture logic from the web authentication application to capture raw biometric data comprising the user'"'"'s voice from the microphone and/or images of the user'"'"'s face or other portion of the user'"'"'s body from the camera, the web authentication application to implement a biometric authentication process to authenticate the user with the raw biometric data.

14. The method as in claim 13, further comprising:

providing the raw biometric data to the authentication server through the secure communication channel, the authentication server comprising a matcher module to compare the raw biometric data with biometric reference data associated with the user to determine a correlation between the raw biometric data and the biometric reference data.

15. The method as in claim 14 wherein a successful authentication is defined based on the correlation being above a specified threshold value.

16. The method as in claim 14 wherein the authentication server further comprises a feature extraction module to extract one or more specified features from the raw biometric data, wherein the matcher module compares the extracted features against corresponding features from the biometric reference data.

17. The method as in claim 16 wherein in response to the authentication server generating a successful authentication indication, the user is provided with access to one or more resources managed by a relying party.

18. The method as in claim 16 wherein the web authentication application is further configured to register with the authentication server using a registration process comprising:

providing the raw biometric data to the authentication server;

a feature extraction module on the authentication server extracting specified features of the raw biometric data to generate biometric reference data; and

storing the biometric reference data in a secure storage accessible by the authentication server.

19. The method as in claim 13 wherein the web authentication application comprises a matcher module to compare the raw biometric data with biometric reference data associated with the user to determine a correlation between the raw biometric data and the biometric reference data.

20. The method as in claim 19 wherein a successful authentication is defined based on the correlation being above a specified threshold value, wherein an indication of a successful authentication is transmitted from the web authentication application to the authentication server.

21. The method as in claim 19 wherein the web authentication application further comprises a feature extraction module to extract one or more specified features from the raw biometric data, wherein the matcher module compares the extracted features against corresponding features from the biometric reference data.

22. The method as in claim 21 wherein in response to the web authentication application generating a successful authentication indication, the user is provided with access to one or more resources managed by a relying party.

23. The method as in claim 19 wherein the web authentication application is further configured to register with the authentication server using a registration process, wherein the web authentication application comprising a feature extraction module to extract specified features of the raw biometric data during registration to generate biometric reference data, the biometric reference data being stored within a secure storage accessible by the matcher module.

24. The method as in claim 23 wherein the registration process further comprises:

generating a public/private key pair on the client; and

transmitting a public key of the key pair to the authentication server, wherein the authentication server associates the public key with an account of the user and stores the public key in a secure storage.