Systems and methods for biometric authentication of transactions
Inventors
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-11170369-B2
Publication Date
2021-11-09
Expiration Date
Abstract
Systems and methods are provided for authorizing a user in connection with a transaction at a transaction terminal. The systems and methods described herein enable a series of operations whereby a user using a mobile device can capture a code that uniquely identifies a transaction terminal. In addition the mobile device can also capture a user's biometrics, generate a biometric identifier and biometrically verify the user's identity by comparing the biometric identifier to a previously generated biometric identifier. If the user is biometrically authenticated the mobile device can generate a transaction request including, a user identifier, a mobile device identifier, and the transaction terminal code and transmit the transaction request to a system server. Based on the transaction request, the system server can further authenticate the user and/or approve the requested transaction. If the user is authenticated, the system server can instruct the terminal to advance the financial transaction.
Core Innovation
The mobile device biometric transaction authorization system authorizes a user for an electronic transaction conducted using a transaction device. The system biometrically authenticates the user by capturing face biometrics on the mobile device to generate or verify a biometric identifier and by optionally performing liveness detection using non-vision sensor or behavioral signals. The system uses the biometric information to support biometric authentication and associates the authenticated result with the transaction request.
The system establishes a secure communication session between the mobile device and a system server over a communication network. During the process, the system server generates a code that is machine readable and valid for a pre-defined duration. The server associates the generated code with a transaction device identifier and stores the code in a computer readable storage medium associated with the transaction device identifier, then transmits the stored associated code for output by the transaction device.
After the transaction device outputs the code and the mobile device captures the output code, the system server receives a transaction request during the secure communication session. The server validates the received code by determining correspondence to the stored associated code and determining that the stored associated code is valid, and then creates a record of the authorized transaction in storage. In response to biometrically authenticating and authorizing the user, the server transmits an authorization notification that advances the transaction and maintains a transaction history for auditing and non-repudiation.
Claims Coverage
The document contains one independent claim covering a full server-centric authorization workflow. The independent claim includes nine inventive features.
Biometric authentication via server matching of received biometric information
biometrically authenticating a user by receiving, by a server computing device over a communication network from a mobile device being used by the user, biometric information for the user, and matching, by the server, the received biometric information to stored biometric information of the user
Secure communication session established between the mobile device and server computing device
establishing, by the mobile device and the server computing device over the communication network, a secure communication session between the server computing device and the mobile device, wherein the mobile device establishes the secure communication session in conjunction with the server computing device
Server-generated machine-readable code valid for a pre-defined duration
generating, by the server computing device, a code that is machine readable and that is valid for a pre-defined duration
Association and storage of the code with a transaction device identifier
receiving, by the server computing device, a transaction device identifier that identifies the transaction device; associating, by the server computing device, the generated code with the transaction device identifier; storing, by the server computing device, the code in a computer readable storage medium in association with the transaction device identifier
Server transmits the stored associated code for output by the transaction device
transmitting, by the server computing device to the transaction device over a connection medium, the stored associated code for output of the stored associated code by the transaction device
Transaction request includes received code captured from transaction device output
receiving, by the server computing device over the communications network from the mobile device during the secure communication session, a transaction request, wherein receiving the transaction request comprises a code output by the transaction device and captured by the mobile device (“received code”)
Validation of received code by correspondence and stored-code validity
authorizing, by the server computing device based on the received transaction request, the user to conduct the transaction at the transaction device, wherein the authorizing step comprises validating, by the server computing device, the received code by determining that the received code corresponds to the stored associated code and determining that the stored associated code is valid
Creating a record of the authorized transaction
creating, by the server computing device in the storage, a record of the authorized transaction
Authorization notification that advances the transaction
in response to biometrically authenticating the user and authorizing the user to conduct the transaction, transmitting, by the server computing device to the transaction device, an authorization notification that advances the transaction being conducted at the transaction device
Across the independent claim, authorization is achieved by server-side biometric authentication, a secure communication session with the mobile device, issuance of a time-limited machine-readable code associated with a transaction device identifier, validation of a transaction request using the received code and stored-code validity, creation of a record of the authorized transaction, and transmission of an authorization notification that advances the transaction.
Stated Advantages
Advances the transaction being conducted at the transaction device.
Creates a record of the authorized transaction and maintains transaction history for auditing and non-repudiation.
Documented Applications
Mobile-phone-based biometric transaction authorization for electronic transactions conducted using a transaction device such as an ATM/POS.
Interested in licensing this patent?