Biometric-based system and method for enabling authentication of electronic messages sent over a network

• US 20030135740A1
• Filed: 02/10/2003
• Published: 07/17/2003
• Est. Priority Date: 09/11/2000
• Status: Active Grant

• Current Assignee: Sentrycom Limited
• Original Assignee: Sentrycom Limited
• Inventors: Talmor, Rita, Talmor, Alon, Talmor, Eli
• Granted Patent: US 7,689,832 B2
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3249 using RSA or related signature schemes, e.g. Rabin scheme

Abstract

A network based mechanism for real time verification and authentication of data and user identities. The present invention enables a method whereby biometric elements, such as voice prints, are utilized to enhance the Public Key Infrastructure as a means to decrypt data and verify data authenticity, such that the user'"'"'s private key is authenticated remotely on a one-time basis. The present invention comprises an authentication server (25) with various software modules that enable authentication of user identity, secure user access to data, digital signatures, secure messaging and secure online transactions.

Claims

1. A system for enhancing data and user authentication using biometric means, comprising:

i. at least one network enabled client device for sending data to a network;

ii. at least one biometric data input mechanism on said client device for capturing biometric data; and

iii. an authentication server for enabling remote real time data and user authentication at said authentication server side and at said client device side.

2. The system of claim 1, wherein said authentication server further comprises:

a) a web-server component for serving HTTP requests;

b) a business logic application for matching between biometric data to be verified and stored biometric data; and

c) at least one database for storing the system data.

3. The system of claim 1, wherein said authentication server includes:

a. a registration module for enabling secure remote registration to the authentication server; and

b. a secure access module for enabling secure access to data stored on a network, said secure access enabling one-time user authentication, following said secure remote registration.

4. The system of claim 3, wherein said secure access module further comprises a three tier identification mechanism, such that said three tiers include a biometric sample, a unique device identity and a PIN.

5. The system of claim 3, further comprising a digital signature module for enabling one-time authentication of said data.

6. The system of claim 5, wherein said digital signature module further comprises a three tier identification mechanism, such that said three tiers include a biometric sample, a unique device identity and a PIN.

7. The system of claim 3, further comprising a secure messaging module for enabling secure messaging between at least two network-enabled client devices, said secure messaging enabling one-time user authentication.

8. The system of claim 7, wherein said secure messaging module further comprises a three tier identification mechanism, such that said three tiers include a biometric sample, a unique device identity and a PIN.

9. The system of claim 3, further comprising a secure transactions module for enabling secure network-based transactions between said client devices and network-based commercial entities, said transactions requiring one-time user authentication.

10. The system of claim 9, wherein said secure transactions module further comprises a three tier identification mechanism, such that said three tiers include a biometric sample, a unique device identity and a PIN.

11. The system of claim 1, further comprising at least one additional network-enabled client device for receiving data from first said at least one network-enabled client device and from said authentication server.

12. A method for enhancing data and user authentication using a biometric mechanism, comprising the steps of:

i. enabling secure biometric remote registration by at least one user; and

ii. authenticating user identity, by an authentication server, by means of a secure data access procedure.

13. The method of claim 12, further comprising accessing said authentication server from a plurality of devices, said devices selected from the group consisting of PCs, laptops, PDAs, smart phones, cellular phones, wireline phones and mobile computers.

14. The method of claim 12, further comprising iii. execution of a digital signature verification procedure, by said authentication server, to authenticate digital signature of said authenticated user.

15. The method of claim 12, wherein said authenticating said user identity includes the steps of:

a. registering personal details with an authentication server, by said user;

b. registering at least one biometric characteristic with said authentication server, by said user;

c. sending a secret number to said user, by an authentication server;

d. logging in to said authentication server, using said secret number, a computer device ID and at least one biometric characteristic, by said user; and

e. verifying said user in real time, by comparing said login data with said registered information, such that said registered information includes said computer device ID and at least one said biometric characteristic.

16. The method of claim 13, wherein said accessing said authentication server from a plurality of devices includes the steps of:

a) authenticating said user;

b) creating a roaming diskette for said user; and

c) performing authentication actions on a computing device that is compatible with said diskette, using said diskette.

17. The method of claim 12, wherein said secure data access procedure includes the following steps:

a) providing a memory unit for storing information including a stored voice print and an identity of each of a plurality of individuals, said stored voice print of each of said plurality of individuals being generated from corresponding voice data thereof;

b) collecting information provided by said user, said information being for verifying that said user is a specific individual from among said plurality of individuals;

c) processing temporary voice data collected from said user into a temporary voice print;

d) comparing said temporary voice print with said stored voice print of each of at least a portion of said plurality of individuals including said specific individual; and

e) granting access to site to said user, only if said temporary voice print is most similar to said stored voice print of said specific individual.

18. The method of claim 17, wherein when a recipient opens a digitally signed message, an authentication server sends a transaction certificate to said recipient, said certificate including information selected from the group consisting of a sender'"'"'s email, date stamp, time stamp, gender, first name, last name, service provider name, public key of said transaction, and a digital signature signed by a Business Registrar.

19. The method of claim 14, wherein said execution of a digital signature verification procedure includes the steps of:

I. entering, by a sender, a location of an information source to be signed;

II. requesting said sender to enter a user PIN number and entering prompted combinations;

III. obtaining an envelope for said document, such that said envelop facilitates hashing of said document;

IV. encrypting said document using said hashing mechanism;

V. sending said encrypted document to at least one receiver; and

VI. combining said encrypted document and said prompted combinations to form said user'"'"'s digital signature of a message.

20. The method of claim 19, further including the steps of:

VII. receiving said message, with said encrypted document as an attachment thereof;

VIII. opening said attachment, and starting a DSM application to decrypt received digital signature and verify sender'"'"'s authenticity; and

IX. if said voice and hash match, validating said received message, and receiving sender user/personal details from an Authentication server.

21. The method of claim 19, wherein step VI. further comprises storing said digital signature as user proof-of-purchase.

22. The method of claim 12 further comprising execution of a secure messaging verification procedure.

23. The method of claim 22, wherein said execution of a secure messaging verification procedure includes:

A. authenticating a voice sample of a message receiver in real time;

B. matching recipient personal information with information specified by a sender; and

C. opening said message.

24. The method of claim 23, wherein recipient voice sample authentication further comprises the steps of:

a—

sending a token of a request number to a message sender, by said server;

b—

generating a random symmetric encryption key and sending said key to said server, by said message sender;

c—

if recipient voice authentication is verified by said server, sending said token of request number from said recipient to said server; and

d—

sending said symmetric encryption key corresponding to said request, by said server.

25. The method of claim 23, wherein said information specified by said sender includes a plurality of recipients.

26. The method of claim 12, further comprising the step of executing a secure biometric transactions procedure.

27. The method of claim 26, wherein said executing of said secure biometric transactions procedure includes the steps of:

a. entering a biometric sample into an input mechanism, such that said sample is digitized and sent to an authentication server;

b. if said sample matches a pre-registered sample, authenticating an identity of said user in real time;

c. encrypting said sample to form a one-time biometric key, such that said biometric key is prepared in a format accepted by escrow companies;

d. inserting said biometric key into a purchase form at a merchant site, and submitting said purchase form for authorization;

e. receiving said purchase form and processing at least one transaction, by a merchant;

f. sending said transaction to a card issuer, by said merchant, in order to receive clearance;

g. matching said biometric key from said merchant and said user, by said authentication server; and

h. charging said transaction to a real credit card number of said user.

28. The method of claim 27, wherein said biometric key is used by said merchant as a proof-of-purchase.

29. The method of claim 28, wherein said using of user proof-of-purchase is affected by steps including:

a. clearing transaction details using an existing Clearing-House Infrastructure, by an escrow service; and

b. matching said biometric key from said merchant with said biometric key from said card issuer.

30. The method of claim 28, wherein said proof-of-purchase key is in the form of a multiple-digit key numerically related to a user voice print at a time of a transaction.

31. A method for digital signature verification by a message sender, comprising the steps of:

a. voice signing a message for sending to a network, wherein the message sender executes a Voice Authentication session;

b. connecting a Request number from said session to the message sender'"'"'s PCID, PIN and Voice print;

c. receiving said Request number as a number identifying a present signing session, by the message sender, using a Digital Signature module;

d. sending said request number as a token to the message sender, to initiate a signing session;

e. executing private key sealing and public key unsealing of a Hash Digest, by the message sender;

f. using a one-time private key to digitally sign and seal said Hash Digest, by the message sender;

g. sending a public key to an authentication server, by the message sender; and

h. computing a session encryption key out of an authenticated signer'"'"'s voice print password, encrypting and decrypting a whole document envelope.

32. The method of claim 31, wherein said digital signing and sealing are effected using an algorithm selected from the group consisting of RSA, MD5, SHA-1 and RC4.

33. A method for authenticating user identity of a remote user in real time, comprising the steps of:

i. authenticating a user in real time;

ii. creating a roaming diskette for said user; and

iii. performing authentication actions in real time on any compatible computing device, using said diskette.

34. A method for enabling an authenticated user to access data securely, comprising the steps of:

i. providing a memory unit for storing information, said information including a stored voice print and an identity of each of a plurality of individuals, said stored voice print of each of said plurality of individuals being generated from corresponding voice data thereof;

ii. collecting information provided by a user, said information being for verifying that said user is identified as a specific individual among said plurality of individuals;

iii. processing temporary voice data collected from said user into a temporary voice print;

iv. comparing said temporary voice print with said stored voice print of each of at least a portion of said plurality of individuals including said specific individual; and

v. granting said user one-time access to content, only if said temporary voice print is similar to said stored voice print of said specific individual.

35. A method for enabling verification of a digital signature in real time, comprising the steps of.

i. entering the filename of the document to be signed;

ii. requesting of a user to enter said user PIN number and to say prompted number combinations;

iii. obtaining an envelope for said document, such that said envelop facilitates hashing of said document;

iv. sending encrypted document; and

v. combining said encrypted hash and said voice print to become said user'"'"'s digital signature of a message.

36. A method for enabling secure messaging by biometric means, comprising the steps of:

i. authenticating a voice sample of a message receiver in real time;

ii. one-time matching of recipient personal information with information specified by said sender; and

iii. opening said message.

37. A method for enabling the execution of secure network-based transactions, using existing Clearing-House Infrastructure, comprising the steps of:

i. entering a biometric sample into an input mechanism, such that said sample is digitized and sent to an authentication server;

ii. if said sample matches pre-registered sample, executing a one-time authentication of a user identity;

iii. encrypting said sample to form a biometric key, such that said biometric key is prepared in a format accepted by Credit Card companies;

iv. inserting said biometric key into purchase form on a merchant site, and submitting form for authorization;

v. receiving said purchase form by a merchant, and processing transaction;

vi. sending said transaction to a card issuer, by said merchant, in order to receive clearance;

vii. matching said biometric key from said merchant and said user;

viii. charging said transaction to a real credit card number of said user.

38. The method of claim 37, wherein step v. further comprises storing the biometric key as user proof-of-purchase, to be used in repudiation disputes.

39. A method for enabling secure access to network based data, said secure access being achieved without the need to incorporate application specific software or hardware, comprising the steps of:

i. submitting a phone number in a relevant Web page, using a network enabled computing device, by a user;

ii. calling said user on said phone number, and requesting said user to perform a voice authentication procedure;

iii. if the authentication is successful, receiving a one-time password, by said user, said password being delivered by the means selected from the group consisting of voice or SMS.

iv. entering said one-time password in a Web page;

v. accessing the network based data, from said network enabled computing device.

40. A system for enhancing the PKI security infrastructure, comprising:

i. a client-server architecture; and

ii. a public key and private key pair, said pair being certified in real-time for each transaction, said PKI security infrastructure including a biometric authentication procedure.

41. A method for enhancing the PKI data security infrastructure, comprising the steps of:

i. encrypting a message using a symmetric key, such that said symmetric key can be used to decrypt said message;

ii. encrypting said message and said symmetric key using a recipients public key, in order for a sender to identify a recipient, such that said encryption is the asymmetric pair of said private key of said recipient;

iii. digitally signing said message using said sender'"'"'s private key, such that said private key is the asymmetric pair of said public key of said sender;

iv. certifying sender'"'"'s private/public key pair in real-time, for each time said sender remotely authenticates said sender'"'"'s identity, using biometric means.

v. acknowledging said digital signature of a sender of a message, using said sender'"'"'s public key, by said receiver;

vi. decrypting said message and a symmetric key; and

vii. decrypting original message with said symmetric key.