System and method for authorizing access to access-controlled environments
Inventors
Hoyos, Hector • Braverman, Jason • Streit, Scott • Xiao, Geoffrey • Mather, Jonathan Francis
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-11210380-B2
Publication Date
2021-12-28
Expiration Date
Abstract
Systems and methods are provided for authorizing a user to access an access-controlled environment. The system includes a system server platform that communicates with fixed PC's, servers and mobile devices (e.g., smartphones) operated by users. The systems and methods described herein enable a series of operations whereby a user attempting to access an access-controlled environment is prompted to biometrically authenticate using the user's preregistered mobile device. Biometric authentication can include capturing images of the user's biometric features, encoding the features as a biometric identifier, comparing the biometric identifier to a previously generated biometric identifier and determining liveness. In addition, the authentication system can further authorize the user and electronically grant access to the access-controlled environment. In this manner the secure authentication system can, based on biometric authentication, authorize a user's access to devices, online services, physical locations or any networked environment that require user authorization.
Core Innovation
The patent describes a biometric access authorization system that securely authenticates a user operating a personal mobile computing device running a biometric authentication application. The system receives from the user computing device representations of the user’s identity and a representation of at least one component of the user computing device. The trusted server tests the representation of the user’s identity against a trusted set of user identification information to verify the user’s identity and provides a unique identifier assigned to the user based on verifying the user’s identity.
During user enrollment, the trusted server causes generation of a key-pair comprising a private key and a corresponding public key, where the private key is stored by a user device. The trusted server stores the public key in association with the assigned unique identifier to create a registered user identity instance as a function of verifying the user’s identity and generation of the key-pair.
For authentication, the trusted server receives a communication including information asserting an identity of one or more of the user and the user device, a representation of the private key, and a current biometric representation of the user’s biometric features captured by the user device using an associated biometric capture device. The trusted server identifies the user identity instance based on the received information, verifies that the representation of the private key corresponds to the public key, and confirms that the current biometric representation matches a registered biometric representation of the user previously stored by the server. After confirming authentication, the trusted server transmits a result of the authentication to one or more remote computing devices, including systems configured to authorize access at an access-controlled environment.
Claims Coverage
The document provides two independent claims: a method for securely authenticating a user and a corresponding system. Across these independent claims, the core coverage centers on a server-mediated enrollment and authentication flow combining user identity testing, a unique identifier, key-pair verification, and matching of current biometric representations to registered biometric representations.
Trusted server enrollment and registered user identity instance creation
providing a unique identifier assigned to the user based on verifying the user's identity; causing generation of a key pair comprising a private key and a corresponding public key, wherein the private key is stored by a user device; and storing the public key in association with the assigned unique identifier thereby creating a registered user identity instance as a function of verifying the user's identity and generation of the key-pair
Authentication via private-key correspondence verification and biometric matching
receiving from the user device a communication including information asserting an identity of one or more of the user and the user device, a representation of the private key, and a current biometric representation of the user's biometric features captured by the user device; authenticating by identifying, based on the received information, the user identity instance; verifying, based on the public key associated with the identified user identity instance, that the representation of the private key corresponds to the public key; and confirming that the current biometric representation matches a registered biometric representation previously stored in association with the identified user identity instance
Trusted-server transmission of authentication result to remote computing devices
transmitting, by the trusted server to one or more remote computing devices, a result of the authentication
System modules for secure mobile biometric authentication
an enrollment module configured to receive a representation of the user's identity, test the representation against a trusted set of user identification information, provide a unique identifier assigned to the user, and cause generation of a key pair comprising a private key and corresponding public key wherein the private key is stored by a user device; a database module configured to store the public key in association with the assigned unique identifier thereby creating a registered user identity instance; a communication module configured to receive a communication including an assertion of identity of one or more of the user and the user device, a representation of the private key, and a current biometric representation; and an authorization module configured to authenticate the user based on the received communication, including identifying the user identity instance, verifying private-key correspondence to the public key, confirming biometric matching, and transmitting a result of the authentication by a trusted server to one or more remote computing devices
The independent claims cover a trusted server-based enrollment that creates a registered user identity instance using a unique identifier and a key-pair with private key stored by the user device and public key stored in association with the unique identifier. Authentication is performed by receiving identity or device assertions plus a private-key representation and a current biometric representation, verifying correspondence to the associated public key, and confirming that the current biometric representation matches a registered biometric representation. The server then transmits an authentication result to remote computing devices.
Stated Advantages
Not explicitly described in patent.
Documented Applications
Not explicitly described in patent.
Interested in licensing this patent?