Method and system for biometric identification and authentication having an exception mode

• US 7,613,929 B2
• Filed: 11/17/2005
• Issued: 11/03/2009
• Est. Priority Date: 11/19/2004
• Status: Expired due to Fees

• Current Assignee: Triad Biometrics LLC
• Original Assignee: Triad Biometrics LLC
• Inventors: Coby, Scott Stanley Allan, Cohen, Mark Sherman, Chirputkar, Shailesh
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): ZECHER, CORDELIA P K
• Application Number:
  US11/280,219
• Publication Number:
  US 20060112279A1
• Time in Patent Office: 1,447 Days
• Field of Search: 713/186
• US Class Current: 713/186
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/128 involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06V 10/95 structured as a network, e.g. client-server architectures
• CPC Class Codes: G06V 40/10 Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

Embodiments of the invention provide methods and systems for authenticating an enrolled user of a biometric authentication and/or identification system having an exception mode, in which the enrolled user submits a temporary password during authentication. The temporary password is only generated if the enrolled user'"'"'s identity is verified and the person authorizing a change to the exception mode submits a valid biometric identifier.

Claims

1. A method of authenticating the identity of an enrolled user of a biometric authentication and/or identification system having a set of user modes including an exception mode, the method comprising:

receiving a request from the enrolled user for switching a user mode of the enrolled user to the exception mode;

requesting identifying information from the enrolled user;

receiving the identifying information from the enrolled user;

verifying the enrolled user'"'"'s identity by determining if the identifying information received from the enrolled user matches identifying information of the enrolled user as stored in a user information database;

submitting to a template matching server a biometric template extracted from a biometric sample image of a biometric identifier of a person authorizing a switch in the enrolled user'"'"'s user mode to the exception mode;

if the template matching server finds a match between the biometric template of the person authorizing the switch in the enrolled user'"'"'s user mode to the exception mode and a pre-stored reference biometric template of the person authorizing the switch in the enrolled user'"'"'s user mode to the exception mode, switching the enrolled user'"'"'s user mode to the exception mode;

assigning to the user a temporary password having an expiration date;

storing the temporary password and said expiration date in the user information database;

setting a user exception mode authentication counter value stored in the user information database to a value corresponding to a number of allowed authentications with the temporary password;

transmitting the temporary password to the enrolled user by an out-of-band communication;

receiving a request from the enrolled user for access to a network application that requires biometric authentication;

sending a request for a user identification string previously assigned uniquely to the enrolled user and stored in the user information database and the temporary password;

receiving a user identification string from the enrolled user and a password from the enrolled user;

if the received user identification string matches the user identification string previously assigned uniquely to the enrolled user, the received password matches the temporary password, the temporary password has not expired, and the user exception mode authentication counter is greater than zero, authenticating the identity of the enrolled user;

decrementing the user exception mode authentication counter; and

if the template matching server finds a match between a biometric template extracted from a biometric image of a biometric identifier of the enrolled user in exception mode and a reference biometric template of the enrolled user, switching the enrolled user'"'"'s user mode.

2. The method of claim 1 further comprising repeating said receiving a request from the enrolled user for access to network, said sending a request for a user identification string, said receiving a user identification string, and said authenticating the identity of the enrolled user in the exception mode up to the number of times determined by the value of the user exception mode counter stored in the database when the enrolled user'"'"'s user mode is first switched to exception mode.

3. The method of claim 1 wherein the out-of-band communication for transmitting the temporary password comprises an email transmission.

4. The method of claim 1 wherein the out-of-band communication for transmitting the temporary password comprises a facsimile transmission.

5. The method of claim 1 wherein the identifying information received from the enrolled user includes the enrolled user'"'"'s answers to a series of questions regarding personal information about the enrolled user.

6. The method of claim 1 wherein the biometric identifier comprises a fingerprint.

7. A system for authenticating the identity of an enrolled user of a biometric authentication and/or identification system having a set of user modes including an exception mode, the system comprising:

one or more user information databases to store data records for all enrolled users, each data record including, but not limited to a uniquely assigned user identification string, a user mode indicator, a user exception mode authentication counter, reference biometric identifier templates for the enrolled user and a person authorizing a switch in a user mode of the enrolled user to the exception mode, information that identifies the enrolled user, and a temporary password having an expiration date and assigned exclusively to the enrolled user;

a client device, operatively associated with the user information database, to receive a request for switching the enrolled user'"'"'s user mode to the exception mode sent from the enrolled user;

to request identifying information from the enrolled user;

to receive information sent by the enrolled user;

if the information sent by the enrolled user matches the information that identifies the enrolled user stored in the user information database, to verify the enrolled user'"'"'s identity;

to submit to a template matching server, a biometric template extracted from a biometric sample image of a biometric identifier of the person authorizing the switch in the enrolled user'"'"'s user mode to the exception mode;

if the template matching server finds a match between the submitted biometric template and the reference biometric template of the person authorizing the switch in the enrolled user'"'"'s authentication mode to the exception mode, to switch the enrolled user'"'"'s user mode to the exception mode;

to assign the temporary password to the user;

to store the temporary password and the expiration date in the user information database;

to set the user exception mode authentication counter value stored in the user information database to a value corresponding to the number of allowed authentications with the temporary password; and

to transmit the temporary password to the first client device by the out-of band communication; and

a server, operatively associated with the user information database, to receive a request from the enrolled user for access to a network application that requires biometric authentication;

to receive, from the enrolled user, a user identification string and a password;

if the received user identification string matches the user identification string previously assigned uniquely to the enrolled user, the received password matches the temporary password, the temporary password has not expired, and the user exception mode authentication counter is greater than zero, to authenticate the identity of the enrolled user;

to decrement the user exception mode authentication counter by one; and

to, if the template matching server finds a match between a biometric template extracted from a biometric image of a biometric identifier of the enrolled user in exception mode and a reference biometric template of the enrolled user, switch the enrolled user'"'"'s user mode.

8. The system of claim 7 wherein the out-of band communications for transmitting the temporary password comprises an email transmission.

9. The system of claim 7 wherein the out-of-band communication for transmitting the temporary password comprises a facsimile transmission.

10. The system of claim 7 wherein the biometric identifier comprises a fingerprint.