Universal secure registry

• US 8,577,813 B2
• Filed: 09/20/2011
• Issued: 11/05/2013
• Est. Priority Date: 02/21/2006
• Status: Active Grant

• Current Assignee: Universal Secure Registry LLC
• Original Assignee: Universal Secure Registry LLC
• Inventors: Weiss, Kenneth P.
• Primary Examiner(s): CHEUNG, CALVIN K
• Application Number:
  US13/237,184
• Publication Number:
  US 20120130904A1
• Time in Patent Office: 777 Days
• Field of Search: 705/64, 705 71- 79
• US Class Current: 705/76
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/206 comprising security or operator identification provisions, e.g. password entry
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3676 Balancing accounts
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 50/22 Social work
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/26 : using a biometric sensor integrated in the pass
• CPC Class Codes: G07C 9/27 : with central registration
• CPC Class Codes: G16H 10/60 : for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: H04L 2209/56 : Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 : Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 : using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3271 : using challenge-response

Abstract

A device is configured to allow a user to select any of a plurality of accounts to employ in a financial transaction. The user device includes a biometric sensor configured to receive a biometric input, a user interface configured to receive a user input including secret information known to the user and identifying information concerning an account selected by the user from the plurality of accounts. The user device includes a communication link configured to communicate with a secure registry, and a processor coupled to the biometric sensor to receive information concerning the biometric input, the user interface, and the communication link. The processor is configured to generate a non-predictable value and encrypted authentication information from the non-predictable value, the identifying information, and at least one of the information concerning the biometric input and the secret information, and communicate the authentication information via the communication link to the secure registry.

Claims

1. An electronic ID device configured to allow a user to select any one of a plurality of accounts associated with the user to employ in a financial transaction, comprising:

a biometric sensor configured to receive a biometric input provided by the user;

a user interface configured to receive a user input including secret information known to the user and identifying information concerning an account selected by the user from the plurality of accounts;

a communication interface configured to communicate with a secure registry;

a processor coupled to the biometric sensor to receive information concerning the biometric input, the user interface and the communication interface, the processor being programmed to activate the electronic ID device based on successful authentication by the electronic ID device of at least one of the biometric input and the secret information, the processor also being programmed such that once the electronic ID device is activated the processor is configured to generate a non-predictable value and to generate encrypted authentication information from the non-predictable value, information associated with at least a portion of the biometric input, and the secret information, and to communicate the encrypted authentication information via the communication interface to the secure registry; and

wherein the communication interface is configured to wirelessly transmit the encrypted authentication information to a point-of-sale (POS) device, and wherein the secure registry is configured to receive at least a portion of the encrypted authentication information from the POS device.

2. The electronic ID device of claim 1, wherein the electronic ID device comprises a discrete code associated with the electronic ID device.

3. The electronic ID device of claim 1, wherein at least a portion of the biometric input received by the biometric sensor is communicated to the secure registry for authentication prior to generation of the encrypted authentication information.

4. The electronic ID device of claim 1, wherein the secret information includes the identifying information.

5. The electronic ID device of claim 1, further comprising a memory coupled to the processor, wherein the memory stores information employed by the electronic ID device to authenticate the biometric received by the biometric sensor.

6. The electronic ID device of claim 5, wherein the electronic ID device does not permit the entry of the user input if the biometric input received by the biometric sensor is determined to not belong to an authorized user of the electronic ID device.

7. The electronic ID device of claim 6, wherein the secret information known to the user includes a PIN, and wherein the authentication of both the secret information and the biometric input activate the electronic ID device for a financial transaction.

8. The electronic ID device of claim 7, further comprising a memory coupled to the processor, wherein data stored in the memory is unavailable to an individual in possession of the electronic ID device until the electronic ID device is activated.

9. The electronic ID device of claim 8, wherein the data is subject to a mathematical operation that acts to modify the data such that it is unintelligible until the electronic ID device is activated.

10. The electronic ID device of claim 7, further comprising a memory coupled to the processor and configured to store an electronic serial number of the electronic ID device, wherein the processor is configured to generate a seed using at least two of the electronic serial number, a discrete code associated with the electronic ID device, the PIN, a time value, and the biometric input to generate the encrypted authentication information, and wherein the seed is employed by the processor to generate the non-predictable value.

11. The electronic ID device of claim 1, wherein the biometric sensor is configured to receive and process at least one of a fingerprint, a speech/voice input, an iris scan, a retina scan, a facial scan, written information and a DNA input.

12. The electronic ID device of claim 11, wherein the processor is configured to generate account identifying information for the respective one of the plurality of accounts, wherein the account identifying information does not identify an account number of the respective one of the plurality of accounts.

13. The electronic ID device of claim 1, wherein the processor is configured to display indicators for the plurality of accounts in the user interface, and the user interface is configured to accept user selection of a respective one of the plurality of accounts.

14. The electronic ID device of claim 1, wherein the user interface is configured to display options for purchase.

15. The electronic ID device of claim 14, wherein the user interface is configured to accept selection of at least one product or service.

16. A method of generating authentication information comprising acts of:

authenticating an identity of a user to an electronic ID device based on at least one of biometric data received by the electronic ID device from the user and secret information known to the user and provided to the electronic ID device;

activating the electronic ID device based on successful authentication;

generating, responsive to activating, a non-predictable value with the electronic ID device;

receiving, in a user interface, identifying information from the user concerning a selected one of a plurality of user accounts;

generating encrypted authentication information from the non-predictable value, information associated with at least a portion of the biometric data, and the secret information; and

communicating, by a communication interface, the encrypted authentication information from the electronic ID device to a secure registry via a point-of-sale (POS) device to authenticate the electronic ID device with the secure registry.

17. The method of claim 16, further comprising an act of displaying, on the user interface indicators for the plurality of user accounts stored in a memory of the electronic ID device.

18. The method of claim 16, further comprising an act of de-activating the electronic ID device without generating the encrypted authentication information if the identity of the user is not successfully authenticated to the electronic ID device.

19. The method of claim 16, further comprising an act of generating a seed from which the authentication information is generated by employing at least two of the biometric data, the secret information known to the user, and an electronic serial number of the electronic ID device.

20. The method of claim 16, further comprising an act of generating encrypted authentication information in a manner that allows the identification of the user and the selected one of the plurality of user accounts by a secure registry.

21. The method of claim 16, further comprising an act of generating an account identifier for the selected one of the plurality of user accounts that does not include an account number, and wherein the act of generating encrypted authentication information includes using the account identifier for the identifying information.

22. The method of claim 16, further comprising displaying options for purchase on the user interface.

23. The method claim 22, further comprising selecting with the user interface at least one product or service for purchase.

24. A method of controlling access to a plurality of accounts, the method comprising acts of:

generating, with an electronic ID device, a non-predictable value;

generating, with the electronic ID device, encrypted authentication information from the non-predictable value generated by the electronic ID device, information associated with at least a portion of a biometric of the user received by the electronic ID device, and secret information provided to the electronic ID device by the user;

communicating the encrypted authentication information from the electronic ID device to a secure registry via a point-of-sale (POS) device to authenticate or not authenticate the electronic ID device with the secure registry;

authorizing the POS device to initiate a financial transaction involving a transfer of funds to or from the account selected by the user when the encrypted authentication information is successfully authenticated; and

denying the POS device from initiation of the financial transaction involving a transfer of funds to or from the account selected by the user when the encrypted authentication information is not successfully authenticated.

25. The method of claim 24, further comprising displaying options for purchase on the user interface.

26. The method claim 25, further comprising selecting with the user interface at least one product or service for purchase.