# US 10,873,578 B1 · Biometric authentication, decentralized learning framework, and adaptive security protocols in distributed terminal network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,578 B1 - Document ID: US10873578B1 - Status: Granted - Kind: B1 - Application number: 16/802,536 - Filed: 2020-02-26 - Granted: 2020-12-22 - Earliest claimed: 2019-12-09 - Applicants: Evan Chase Rose - Inventors: Evan Chase Rose - Web page: https://patentgrep.com/patent/US10873578B1 ## CPC - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - G06F 21/45: Structures or tools for the administration of authentication - G06N 3/045: Combinations of networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/098: Distributed learning, e.g. federated learning - G06N 20/00: Machine learning - G06Q 30/0185: {Product, service or business identity fraud} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 63/0272: {Virtual private networks} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/102: {Entity profiles} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/166: {at the transport layer} - H04L 63/168: {above the transport layer} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04W 12/72: Subscriber identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Biometric authentication, decentralized learning frameworks, and adaptive security protocols and services for a distributed operator terminals network are described. In some embodiments, the terminals may be hardware terminals, kiosks, or clients. In some embodiments, a security analysis may be performed, and security scores may be determined, for visitors requesting operations at terminals. Security scores may be determined by a vendor, in communication with the operator terminals, based on aggregation of a plurality of factors, wherein each factor may be weighted. The factors may incorporate operator settings or preferences. In one embodiment, the factors include one or more facial recognition factors. The one or more facial recognition factors may be used for biometric authentication. The vendor may use the security scores to determine user privileges or permissions for the operations. The vendor may deliver instructions or messages to the terminals based on the determinations. ## Claims ### Claim 1 A method for biometric authentication and securely handling, by a software service provider, an operation between a first visitor and an operator of a hardware terminal, the method comprising: creating a first user account for a first user, wherein creating the first user account comprises: receiving, by the software service provider, first data wherein the first data comprises identification document information associated with the first user; creating, by the software service provider, an account identifier for the first user; storing, by the software service provider, in association with the first user account, the account identifier in an at least one database or datastore; establishing a secure session between the software service provider and the hardware terminal; wherein the secure session is established using at least a secure socket layer (SSL) or transport layer security (TLS) protocol; wherein the secure session is established using a secured connection using a virtual private network (VPN); performing a first processing of the operation, wherein performing the first processing of the operation comprises: receiving, by the software service provider, an encrypted first payload; wherein the encrypted first payload is produced by encrypting a first payload, the first payload produced by the hardware terminal, and wherein the first payload comprises a phone number, the phone number received from the first visitor at the hardware terminal; wherein the encrypted first payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, an IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted first payload; sending, by the software service provider, an SMS verification code to the phone number; performing a second processing of the operation, wherein performing the second processing of the operation comprises: receiving, by the software service provider, an encrypted second payload; wherein the encrypted second payload is produced by encrypting a second payload, the second payload produced by the hardware terminal; wherein the encrypted second payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, the IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted second payload; identifying a first security factor associated with the first visitor, wherein the identifying the first security factor associated with the first visitor comprises: the software service provider forwarding a first HTTP/HTTPS request to at least one of a set of third party service providers, wherein the request is an age verification request, and wherein the first request comprises: a third payload; wherein the third payload comprises at least a portion of the first data; the software service provider receiving a first third party response from at least one of the set of third party service providers; performing a third processing of the operation, wherein performing the third processing of the operation comprises: receiving, by the software service provider, an encrypted fourth payload; wherein the encrypted fourth payload is produced by encrypting a fourth payload, the fourth payload produced by the hardware terminal, and wherein the fourth payload comprises at least second data; wherein the encrypted fourth payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, the IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted fourth payload; identifying a second security factor associated with the first visitor, wherein the identifying the second security factor associated with the first visitor comprises: the software service provider forwarding a second HTTP or HTTPS request to at least one of the set of third party service providers, wherein the second request comprises: a fifth payload; wherein the fifth payload comprises at least a portion of the second data; receiving a second third party response from at least one of the set of third party service providers; identifying a facial recognition factor associated with the first visitor, wherein the identifying the facial recognition factor associated with the first visitor comprises: receiving, by the software service provider, an encrypted sixth payload; wherein the encrypted sixth payload is produced by encrypting a sixth payload, the sixth payload produced by the hardware terminal, and wherein the sixth payload comprises at least one parameter associated with image or video data associated with the first customers face; wherein the encrypted sixth payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, the IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted sixth payload; determining, by the software service provider, a score associated with the first visitor based on the first factor and the second factor; in response to determining that the score is less than a threshold score or equal to an acceptable score: sending, by the software service provider, an encrypted seventh payload to the hardware terminal; wherein the encrypted seventh payload is produced by encrypting a seventh payload, the seventh payload produced by the software service provider, and wherein the seventh payload comprises at least a message to allow a completing of the operation; wherein the encrypted seventh payload is communicated to the hardware terminal from the software service provider during the secure session using the secured connection; logging, by the software service provider, the operation details in the at least one database or datastore wherein the logging comprises at least: storing, in association with the account, an operation parameter; storing, in association with the account, an operation date or time; and storing, in association with the account, the IP address associated with the operation. ### Claim 2 (depends on 1) The method of claim 1, further comprising: sending, by the software service provider, a machine learning model or machine learning model parameters to the hardware terminal, wherein the hardware terminal comprises an edge device. ### Claim 3 (depends on 2) The method of claim 2, further comprising: receiving new model parameters, by the software service provider, from the hardware terminal. ### Claim 4 (depends on 1) The method of claim 1, further comprising: wherein the third payload is a JSON encoded object. ### Claim 5 (depends on 1) The method of claim 1, further comprising: wherein the fifth payload is a JSON encoded object. ### Claim 6 (depends on 1) The method of claim 1, further comprising: wherein the first third party response comprises at least an age verification. ### Claim 7 (depends on 1) The method of claim 1, further comprising: wherein the second third party response comprises at least a score. ### Claim 8 A system comprising: one or more web servers; one or more processors; one or more databases or datastores; one or more non-transitory computer readable media storing instructions that, when executed, cause one or more processors to perform a method comprising: creating a first user account for a first user, wherein creating the first user account comprises: receiving, by the software service provider, first data wherein the first data comprises identification document information associated with the first user; creating, by the software service provider, an account identifier for the first user; storing, by the software service provider, in association with the first user account, the account identifier in a database or datastore; establishing a secure session between the software service provider and the hardware terminal; wherein the secure session is established using at least a secure socket layer (SSL) or transport layer security (TLS) protocol; wherein the secure session is established using a secured connection using a virtual private network (VPN); performing a first processing of the operation, wherein performing the first processing of the operation comprises: receiving, by the software service provider, an encrypted first payload; wherein the encrypted first payload is produced by encrypting a first payload, the first payload produced by the hardware terminal, and wherein the first payload comprises a phone number, the phone number received from the first visitor at the hardware terminal; wherein the encrypted first payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, an IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted first payload; sending, by the software service provider, an SMS verification code to the phone number; performing a second processing of the operation, wherein performing the second processing of the operation comprises: receiving, by the software service provider, an encrypted second payload; wherein the encrypted second payload is produced by encrypting a second payload, the second payload produced by the hardware terminal; wherein the encrypted second payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, the IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted second payload; identifying a first security factor associated with the first visitor, wherein the identifying the first security factor associated with the first visitor comprises: the software service provider forwarding a first HTTP/HTTPS request to at least one of a set of third party service providers, wherein the request is an age verification request, and wherein the first request comprises: a third payload; wherein the third payload comprises at least a portion of the first data; the software service provider receiving a first third party response from at least one of the set of third party service providers; performing a third processing of the operation, wherein performing the third processing of the operation comprises: receiving, by the software service provider, an encrypted fourth payload; wherein the encrypted fourth payload is produced by encrypting a fourth payload, the fourth payload produced by the hardware terminal, and wherein the fourth payload comprises at least second data; wherein the encrypted fourth payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, the IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted fourth payload; identifying a second security factor associated with the first visitor, wherein the identifying the second security factor associated with the first visitor comprises: the software service provider forwarding a second HTTP or HTTPS request to at least one of the set of third party service providers, wherein the second request comprises: a fifth payload; wherein the fifth payload comprises at least a portion of the second data; receiving a second third party response from at least one of the set of third party service providers; identifying a facial recognition factor associated with the first visitor, wherein the identifying the facial recognition factor associated with the first visitor comprises: receiving, by the software service provider, an encrypted sixth payload; wherein the encrypted sixth payload is produced by encrypting a sixth payload, the sixth payload produced by the hardware terminal, and wherein the sixth payload comprises at least one parameter associated with image or video data associated with the first customer's face; wherein the encrypted sixth payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, the IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted sixth payload; determining, by the software service provider, a score associated with the first visitor based on the first factor and the second factor; in response to determining that the score is less than a threshold score or equal to an acceptable score: sending, by the software service provider, an encrypted seventh payload; wherein the encrypted seventh payload is produced by encrypting a seventh payload, the seventh payload produced by the software service provider, and wherein the seventh payload comprises at least a message to the hardware terminal to allow a completing of the operation; wherein the encrypted seventh payload communicated to the hardware terminal from the software service provider during the secure session using the secured connection; logging the operation details in the one or more databases or datastores by the software service provider, wherein the logging comprises at least: storing, in association with the account, an operation parameter; storing, in association with the account, an operation date or time; and storing, in association with the account, the IP address associated with the operation. ### Claim 9 (depends on 8) The system of claim 8, further comprising: sending, by the software service provider, a machine learning model or machine learning model parameters to the hardware terminal, wherein the hardware terminal comprises an edge device. ### Claim 10 (depends on 9) The system of claim 9, further comprising: receiving new model parameters, by the software service provider, from the hardware terminal. ### Claim 11 (depends on 8) The system of claim 8, further comprising: wherein the third payload is a JSON encoded object. ### Claim 12 (depends on 8) The system of claim 8, further comprising: wherein the fifth payload is a JSON encoded object. ### Claim 13 (depends on 8) The system of claim 8, further comprising: wherein the first third party response comprises at least an age verification. ### Claim 14 (depends on 8) The method of claim 8, further comprising: wherein the second third party response comprises at least a score. ### Claim 15 One or more non-transitory computer readable media storing instructions that, when executed, cause one or more processors to perform a method comprising: creating a first user account for a first user, wherein creating the first user account comprises: receiving, by the software service provider, first data wherein the first data comprises identification document information associated with the first user; creating, by the software service provider, an account identifier for the first user; storing, by the software service provider, in association with the first user account, the account identifier in a database or datastore; establishing a secure session between the software service provider and the hardware terminal; wherein the secure session is established using at least a secure socket layer (SSL) or transport layer security (TLS) protocol; wherein the secure session is established using a secured connection using a virtual private network (VPN); performing a first processing of the operation, wherein performing the first processing of the operation comprises: receiving, by the software service provider, an encrypted first payload; wherein the encrypted first payload is produced by encrypting a first payload, the first payload produced by the hardware terminal, and wherein the first payload comprises a phone number, the phone number received from the first visitor at the hardware terminal; wherein the encrypted first payload communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, an IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted first payload; sending, by the software service provider, an SMS verification code to the phone number; performing a second processing of the operation, wherein performing the second processing of the operation comprises: receiving, by the software service provider, an encrypted second payload; wherein the encrypted second payload is produced by encrypting a second payload, the second payload produced by the hardware terminal; wherein the encrypted second payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, the IP address-associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted second payload; identifying a first security factor associated with the first visitor, wherein the identifying the first security factor associated with the first visitor comprises: the software service provider forwarding a first HTTP/HTTPS request to at least one of a set of third party service providers, wherein the request is an age verification request, and wherein the first request comprises: a third payload; wherein the third payload comprises at least a portion of the first data; the software service provider receiving a first third party response from at least one of the set of third party service providers; performing a third processing of the operation, wherein performing the third processing of the operation comprises: receiving, by the software service provider, an encrypted fourth payload; wherein the encrypted fourth payload is produced by encrypting a fourth payload, the fourth payload produced by the hardware terminal, and wherein the fourth payload comprises at least second data; wherein the encrypted fourth payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, the IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted fourth payload; identifying a second security factor associated with the first visitor, wherein the identifying the second security factor associated with the first visitor comprises: the software service provider forwarding a second HTTP or HTTPS request to at least one of the set of third party service providers, wherein the second request comprises: a fifth payload; wherein the fifth payload comprises at least a portion of the second data; receiving a second third party response from at least one of the set of third party service providers; identifying a facial recognition factor associated with the first visitor, wherein the identifying the facial recognition factor associated with the first visitor comprises: receiving, by the software service provider, an encrypted sixth payload; wherein the encrypted sixth payload is produced by encrypting a sixth payload, the sixth payload produced by the hardware terminal, and wherein the sixth payload comprises at least one parameter associated with image or video data associated with the first customer's face; wherein the encrypted sixth payload is communicated to the software service provider from the hardware terminal during the secure session using the secured connection; identifying, by the software service provider, the IP address associated with the VPN; allowing, by software service provider, traffic from the VPN based on the IP address; and decrypting, by the software service provider, the encrypted sixth payload; determining, by the software service provider, a score associated with the first visitor based on the first factor and the second factor; in response to determining that the score is less than a threshold score or equal to an acceptable score: sending, by the software service provider, an encrypted seventh payload; wherein the encrypted seventh payload is produced by encrypting a seventh payload, the seventh payload produced by the software service provider, and wherein the seventh payload comprises at least a message to the hardware terminal to allow a completing of the operation; wherein the encrypted seventh payload is communicated to the hardware terminal from the software service provider during the secure session using the secured connection; logging the operation details in a data storage by the software service provider, wherein the logging comprises at least: storing, in association with the account, an operation parameter; storing, in association with the account, an operation date or time; and storing, in association with the account, the IP address associated with the operation. ### Claim 16 (depends on 15) The one or more non-transitory computer readable media of claim 15, further comprising: sending, by the software service provider, a machine learning model or machine learning model parameters to the hardware terminal, wherein the hardware terminal comprises an edge device. ### Claim 17 (depends on 16) The one or more non-transitory computer readable media of claim 16, further comprising: receiving new model parameters, by the software service provider, from the hardware terminal. ### Claim 18 (depends on 15) The one or more non-transitory computer readable media of claim 15, further comprising: wherein the third payload is a JSON encoded object. ### Claim 19 (depends on 15) The one or more non-transitory computer readable media of claim 15, further comprising: wherein the fifth payload is a JSON encoded object. ### Claim 20 (depends on 15) The one or more non-transitory computer readable media of claim 15, further comprising: wherein the first third party response comprises at least an age verification.