# US 10,484,373 B2 · Systems and methods for biometric authentication of certificate signing request processing

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,373 B2
- Document ID: US10484373B2
- Status: Granted
- Kind: B2
- Application number: 15/484,297
- Filed: 2017-04-11
- Published: 2018-10-11
- Granted: 2019-11-19
- Earliest claimed: 2017-04-11
- Assignees: Mastercard International Incorporated
- Applicants: MasterCard International Incorporated
- Inventors: Manoneet Kohli
- Web page: https://patentgrep.com/patent/US10484373B2

## CPC

- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- G06F 21/33: using certificates
- G06F 21/40: by quorum, i.e. whereby two or more security principals are required
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A biometric certification request authentication (BCRA) computing device is provided for authenticating a requestor undergoing a certificate signing request process. The BCRA computing device is communicatively coupled to a memory device. The BCRA computing device is configured to receive, from a requestor computing device, a service selection request message that identifies a certificate service type for which the requestor requires a certificate, identify a certificate authority computing device that corresponds to a certificate authority that generates certificates of the certificate service type, transmit, to the requestor computing device, a first biometric sample request message that prompts the requestor to provide a first biometric sample, authenticate the first biometric sample received from the requestor computing device by determining a match between the first biometric sample and a stored biometric sample for the requestor, and based on the authentication, initiate providing the certificate file to the requestor computing device.

## Claims

### Claim 1

A biometric certification request authentication (BCRA) computing device for authenticating a requestor undergoing a certificate signing request process, the BCRA computing device comprising:
a memory device; and
at least one processor in communication with the memory device;
the BCRA computing device configured to:
receive, from a requestor computing device, a service selection request message that identifies a certificate service type for which the requestor requires a certificate;
identify a certificate authority computing device that corresponds to a certificate authority that generates certificates of the certificate service type;
transmit, to the requestor computing device, a first biometric sample request message that prompts the requestor to provide a first biometric sample;
identify a supervising requestor computing device associated with a supervisor of the requestor;
authenticate the first biometric sample received from the requestor computing device by determining a match between the first biometric sample and a stored biometric sample for the requestor;
transmit a second biometric sample request message to the supervising requestor computing device;
receive a second biometric sample of the supervisor from the supervising requestor computing device;
authenticate the second biometric sample using a stored biometric sample for the supervisor;
store, in the memory device, i) a first authentication validation record for the requestor in association with the service selection request message and ii) a second authentication validation record for the supervisor in association with the service selection request message, wherein the second authentication validation record is chained to the first authentication validation record; and
based on the authentication, initiate providing a certificate file to the requestor computing device.

### Claim 2 (depends on 1)

A BCRA computing device in accordance with claim 1, further configured to:
based on the authentication, generate a certificate signing request, wherein the certificate signing request is in a format that corresponds to the certificate authority;
receive, from the certificate authority computing device, the certificate file that includes the certificate that corresponds to the certificate service type; and
transmit the certificate file to the requestor computing device.

### Claim 3 (depends on 1)

The BCRA computing device in accordance with claim 1, further configured to:
based on the identified certificate authority computing device, determine an approval policy associated with the certificate authority, wherein the approval policy requires a predetermined number of approvals before a certificate signing request is approvable;
generate an approval chain record using at least the first authentication validation record and the second authentication validation record;
determine that the approval chain record is at least equal to the predetermined number of approvals required by the approval policy; and
generate the certificate signing request based on the determination.

### Claim 4 (depends on 1)

The BCRA computing device in accordance with claim 1, further configured to:
transmit the first biometric sample to a third party biometric authentication service;
receive an authentication confirmation from the third party biometric authentication service; and
authenticate the first biometric sample received from the requestor computing device.

### Claim 5 (depends on 1)

The BCRA computing device in accordance with claim 1, further configured to:
determine that the first biometric sample does not match the stored biometric sample for the requestor; and
decline to generate a certificate signing request.

### Claim 6 (depends on 1)

The BCRA computing device in accordance with claim 1, further configured to:
generate an electronic pointer to the certificate file, wherein the electronic pointer includes a universal resource locator (URL);
transmit the URL to the requestor computing device; and
cause the requestor computing device to display the URL.

### Claim 7

A method of authenticating a requestor undergoing a certificate signing request process, the method implemented using a biometric certification request authentication (BCRA) computing device, the BCRA computing device being communicatively coupled to a memory device, the method comprising:
receiving, from a requestor computing device, a service selection request message that identifies a certificate service type for which the requestor requires a certificate;
identifying a certificate authority computing device that corresponds to a certificate authority that generates certificates of the certificate service type;
transmitting, to the requestor computing device, a first biometric sample request message that prompts the requestor to provide a first biometric sample;
identifying a supervising requestor computing device associated with a supervisor of the requestor;
authenticating the first biometric sample received from the requestor computing device by determining a match between the first biometric sample and a stored biometric sample for the requestor; and
transmitting a second biometric sample request message to the supervising requestor computing device;
receiving a second biometric sample of the supervisor from the supervising requestor computing device;
authenticating the second biometric sample using a stored biometric sample for the supervisor;
storing, in the memory device, i) a first authentication validation record for the requestor in association with the service selection request message and ii) a second authentication validation record for the supervisor in association with the service selection request message, wherein the second authentication validation record is chained to the first authentication validation record; and
based on the authentication, initiating providing a certificate file to the requestor computing device.

### Claim 8 (depends on 7)

The method in accordance with claim 7, further comprising:
based on the authentication, generating a certificate signing request, wherein the certificate signing request is in a format that corresponds to the certificate authority;
receiving, from the certificate authority computing device, the certificate file that includes the certificate that corresponds to the certificate service type; and
transmitting the certificate file to the requestor computing device.

### Claim 9 (depends on 7)

The method in accordance with claim 7, further comprising:
based on the identified certificate authority computing device, determining an approval policy associated with the certificate authority, wherein the approval policy requires a predetermined number of approvals before a certificate signing request is approvable;
generating an approval chain record using at least the first authentication validation record and the second authentication validation record;
determining that the approval chain record is at least equal to the predetermined number of approvals required by the approval policy; and
generating the certificate signing request based on the determination.

### Claim 10 (depends on 7)

The method in accordance with claim 7, further comprising:
transmitting the first biometric sample to a third party biometric authentication service;
receiving an authentication confirmation from the third party biometric authentication service; and
authenticating the first biometric sample received from the requestor computing device.

### Claim 11 (depends on 7)

The method in accordance with claim 7, further comprising:
determining that the first biometric sample does not match the stored biometric sample for the requestor; and
declining to generate a certificate signing request.

### Claim 12

A non-transitory computer readable medium that includes computer executable instructions for authenticating a requestor undergoing a certificate signing request process, wherein when executed by a biometric certification request authentication (BCRA) computing device coupled to a memory device, the computer executable instructions cause the BCRA computing device to:
receive, from a requestor computing device, a service selection request message that identifies a certificate service type for which the requestor requires a certificate;
identify a certificate authority computing device that corresponds to a certificate authority that generates certificates of the certificate service type;
transmit, to the requestor computing device, a first biometric sample request message that prompts the requestor to provide a first biometric sample;
identify a supervising requestor computing device associated with a supervisor of the requestor;
authenticate the first biometric sample received from the requestor computing device by determining a match between the first biometric sample and a stored biometric sample for the requestor; and
transmit a second biometric sample request message to the supervising requestor computing device;
receive a second biometric sample of the supervisor from the supervising requestor computing device;
authenticate the second biometric sample using a stored biometric sample for the supervisor;
store, in the memory device, i) a first authentication validation record for the requestor in association with the service selection request message and ii) a second authentication validation record for the supervisor in association with the service selection request message, wherein the second authentication validation record is chained to the first authentication validation record; and
based on the authentication, initiate providing a certificate file to the requestor computing device.

### Claim 13 (depends on 12)

The non-transitory computer readable medium in accordance with claim 12, wherein the computer-executable instructions further cause the BCRA computing device to:
based on the authentication, generate a certificate signing request, wherein the certificate signing request is in a format that corresponds to the certificate authority;
receive, from the certificate authority computing device, the certificate file that includes the certificate that corresponds to the certificate service type; and
transmit the certificate file to the requestor computing device.

### Claim 14 (depends on 12)

The non-transitory computer readable medium in accordance with claim 12, wherein the computer-executable instructions further cause the BCRA computing device to:
based on the identified certificate authority computing device, determine an approval policy associated with the certificate authority, wherein the approval policy requires a predetermined number of approvals before a certificate signing request is approvable;
generate an approval chain record using at least the first authentication validation record and the second authentication validation record;
determine that the approval chain record is at least equal to the predetermined number of approvals required by the approval policy; and
generate the certificate signing request based on the determination.

### Claim 15 (depends on 12)

The non-transitory computer readable medium in accordance with claim 12, wherein the computer-executable instructions further cause the BCRA computing device to:
transmit the first biometric sample to a third party biometric authentication service;
receive an authentication confirmation from the third party biometric authentication service; and
authenticate the first biometric sample received from the requestor computing device.

### Claim 16 (depends on 12)

The non-transitory computer readable medium in accordance with claim 12, wherein the computer-executable instructions further cause the BCRA computing device to:
determine that the first biometric sample does not match the stored biometric sample for the requestor; and
decline to generate a certificate signing request.

### Claim 17 (depends on 12)

The non-transitory computer readable medium in accordance with claim 12, wherein the computer-executable instructions further cause the BCRA computing device to:
generate an electronic pointer to the certificate file, wherein the electronic pointer includes a universal resource locator (URL);
transmit the URL to the requestor computing device; and
cause the requestor computing device to display the URL.