# US 12,008,568 B1 · Systems and methods for an authorized identification system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,008,568 B1
- Document ID: US12008568B1
- Status: Granted
- Kind: B1
- Application number: 17/718,044
- Filed: 2022-04-11
- Granted: 2024-06-11
- Earliest claimed: 2018-02-15
- Assignees: Wells Fargo Bank, N.A.
- Applicants: Wells Fargo Bank, N.A.
- Inventors: Michael Chang; Traci Nguyen; Cong Phan; Marria Rhodriquez; Darrell L Suen; Paul Vittimberga
- Web page: https://patentgrep.com/patent/US12008568B1

## CPC

- G06Q 20/3829: {involving key management}
- G06Q 20/325: {using wireless networks}
- G06Q 20/388: {using mutual authentication without cards, e.g. challenge-response}
- G06Q 20/401: {Transaction verification}
- G06Q 20/40145: {Biometric identity checks}
- G06Q 20/4093: {Monitoring of device authentication}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3297: {involving time stamps, e.g. generation of time stamps}
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An example method includes receiving an encrypted biometric enrollment data and user identifier data. The encrypted biometric enrollment data includes at least one biometric enrollment sample from a user encrypted using an encryption key. The encryption key is generated based on a user secret and the user identifier is associated with the user. The user identifier is matched with a stored user secret. A decryption key is generated based on the stored user secret. The encrypted biometric enrollment data is decrypted using the decryption key. The at least one biometric enrollment sample is retrieved from the decrypted biometric enrollment data. The at least one biometric enrollment sample is processed using a biometric processing algorithm to generate a biometric reference template. A biometric reference template identifier uniquely identifying the biometric reference template is generated. An encryption key is generated based on the stored user secret and encrypts an enrollment confirmation message.

## Claims

### Claim 1

A method, comprising:
receiving, by a computing system from an aggregator computing system, an access request of an account at a financial institution, wherein the access request comprises a user identifier and encrypted authentication information, the user identifier associated with a user of the account, and wherein the aggregator computing system has previously received a first account information of the account during a prior access request, wherein the encrypted authentication information comprises user device data and a token identifier;
decrypting, by the computing system, the encrypted authentication information;
deriving, by the computing system, a device identifier of the user device data from the decrypted authentication information;
verifying, by the computing system, that the derived device identifier and the token identifier contained in the decrypted authentication information correspond to a stored authentication information associated with the user identifier;
querying, by the computing system, a mobile network operator for updated data about the derived device identifier;
receiving, by the computing system, from the mobile network operator, the updated data;
verifying, by the computing system, the updated data against the user device data;
identifying, by the computing system, the first account information provided during the prior access request;
transmitting, by the computing system to the aggregator computing system, a challenge question to the aggregator computing system, the challenge question comprising a request for the previously provided first account information;
receiving, by the computing system from the aggregator computing system, a challenge answer to the challenge question;
comparing, by the computing system, the challenge answer to the first account information;
authenticating, by the computing system, the aggregator computing system based on the challenge answer matching the first account information and based on the verification of the decrypted authentication information; and
providing, by the computing system, an authentication decision to the aggregator computing system, the authentication decision enabling the aggregator computing system to access and display information of the account to the user.

### Claim 2 (depends on 1)

The method of claim 1, wherein the challenge question is a first challenge question, and wherein authenticating the aggregator computing system further comprises:
transmitting, by the computing system to a user device, a device query comprising a second challenge question of at least one of the user device being active and an active connection between the user device and the aggregator computing system; and
receiving, by the computing system from the user device, a device query answer responsive to the second challenge question, wherein the aggregator computing system is given access to a user account of the user if at least one of the user device being active and active connection between the user device and the aggregator computing system is correct.

### Claim 3 (depends on 1)

The method of claim 1, further comprising verifying, by the computing system, an origin of the access request, wherein verifying the origin includes at least one of completion of an authenticated key exchange and identification of a status of a user device associated with the user.

### Claim 4 (depends on 3)

The method of claim 3, wherein verifying the origin of the access request further comprises:
transmitting, to the aggregator computing system, a challenge action, the challenge action requiring the aggregator computing system to access the account through the user device;
receiving, by the computing system from the user device, a challenge action response, the challenge action response responsive to the challenge action and originated by the aggregator computing system; and
transmitting, by the computing system and to the aggregator computing system, financial data of the account.

### Claim 5 (depends on 3)

The method of claim 3, wherein data of the user device is used as an input to a password of the authenticated key exchange.

### Claim 6 (depends on 1)

The method of claim 1, wherein the encrypted authentication information in encrypted by a password authenticated key exchange protocol.

### Claim 7 (depends on 6)

The method of claim 6, wherein the password authenticated key exchange protocol uses an encryption key generated using a Diffie-Hellman encryption algorithm.

### Claim 8

A system comprising:
a network interface structure to facilitate data transmission over a network;
an accounts database including a plurality of user identifiers and associated encrypted authentication information; and
a server system comprising a processor and instructions stored in non-transitory machine-readable media, the instructions configured to cause the server system to:
receive, from an aggregator computing system, an access request of an account at a financial institution, wherein the access request comprises at least one of the plurality of user identifiers and the encrypted authentication information, the at least of the plurality of user identifiers associated with a user of the account, and wherein the aggregator computing system has previously received a first account information of the account during a prior access request, wherein the encrypted authentication information comprises user device data and a token identifier;
decrypt the encrypted authentication information;
derive a device identifier of the user device data from the decrypted authentication information;
verify that the derived device identifier and the token identifier contained in the decrypted authentication information correspond to a stored authentication information associated with the at least one of the plurality of user identifiers;
query a mobile network operator for updated data about the derived device identifier;
receive, from the mobile network operator, the updated data;
verify the updated data against the user device data;
identify the first account information provided during the prior access request;
transmit, to the aggregator computing system, a challenge question to the aggregator computing system, the challenge question comprising a request for the previously provided first account information;
receive, from the aggregator computing system, a challenge answer to the challenge question;
compare the challenge answer to the first account information;
authenticate the aggregator computing system based on the challenge answer matching the first account information and based on the verification of the decrypted authentication information; and
provide an authentication decision to the aggregator computing system, the authentication decision enabling the aggregator computing system to access and display information of the account to the user.

### Claim 9 (depends on 8)

The system of claim 8, wherein the challenge question is a first challenge question, and wherein the instructions further cause the server system to:
transmit, to a user device, a device query comprising a second challenge question of at least one of the user device being active and an active connection between the user device and the aggregator computing system; and
receive, from the user device, a device query answer responsive to the second challenge question, wherein the aggregator computing system is given access to a user account of the user if at least one of the user device being active and active connection between the user device and the aggregator computing system is correct.

### Claim 10 (depends on 8)

The system of claim 8, wherein the instructions further cause the server system to verify an origin of the access request, wherein verifying the origin includes at least one of completion of an authenticated key exchange and identification of a status of a user device associated with the user.

### Claim 11 (depends on 10)

The system of claim 10, wherein the instructions further cause the server system to:
transmit, to the aggregator computing system, a challenge action, the challenge action requiring the aggregator computing system to access the account through the user device;
receive, from the user device, a challenge action response, the challenge action response responsive to the challenge action and originated by the aggregator computing system; and
transmit, to the aggregator computing system, financial data of the account.

### Claim 12 (depends on 10)

The system of claim 10, wherein data of the user device is used as an input to a password of the authenticated key exchange.

### Claim 13 (depends on 8)

The system of claim 8, wherein the encrypted authentication information in encrypted by a password authenticated key exchange protocol.

### Claim 14 (depends on 13)

The system of claim 13, wherein the password authenticated key exchange protocol uses an encryption key generated using a Diffie-Hellman encryption algorithm.

### Claim 15

A non-transitory computer readable media having computer-executable instructions embodied therein that, when executed by a computing system, cause the computing system to perform operations comprising:
receiving, from an aggregator computing system, an access request of an account at a financial institution, wherein the access request comprises a user identifier and encrypted authentication information, the user identifier associated with a user of the account, and wherein the aggregator computing system has previously received a first account information of the account during a prior access request, wherein the encrypted authentication information comprises user device data and a token identifier;
decrypting the encrypted authentication information;
deriving a device identifier of the user device data from the decrypted authentication information;
verifying that the derived device identifier and the token identifier contained in the decrypted authentication information correspond to a stored authentication information associated with the user identifier;
querying a mobile network operator for updated data about the derived device identifier;
receiving from the mobile network operator, the updated data;
verifying the updated data against the user device data;
identifying the first account information provided during the prior access request;
transmitting, to the aggregator computing system, a challenge question to the aggregator computing system, the challenge question comprising a request for the previously provided first account information;
receiving, from the aggregator computing system, a challenge answer to the challenge question;
comparing the challenge answer to the first account information;
authenticating the aggregator computing system based on the challenge answer matching the first account information and based on the verification of the decrypted authentication information; and
providing an authentication decision to the aggregator computing system, the authentication decision enabling the aggregator computing system to access and display information of the account to the user.

### Claim 16 (depends on 15)

The computer readable media of claim 15, wherein the challenge question is a first challenge question, and wherein the instructions further cause the computing system to:
transmit, to a user device, a device query comprising a second challenge question of at least one of the user device being active and an active connection between the user device and the aggregator computing system; and
receive, from the user device, a device query answer responsive to the second challenge question, wherein the aggregator computing system is given access to a user account of the user if at least one of the user device being active and active connection between the user device and the aggregator computing system is correct.

### Claim 17 (depends on 15)

The computer readable media of claim 15, wherein the instructions further cause the computing system to verify an origin of the access request, wherein verifying the origin includes at least one of completion of an authenticated key exchange and identification of a status of a user device associated with the user.

### Claim 18 (depends on 17)

The computer readable media of claim 17, wherein the instructions further cause the computing system to:
transmit, to the aggregator computing system, a challenge action, the challenge action requiring the aggregator computing system to access the account through the user device;
receive, from the user device, a challenge action response, the challenge action response responsive to the challenge action and originated by the aggregator computing system; and
transmit, to the aggregator computing system, financial data of the account.

### Claim 19 (depends on 17)

The computer readable media of claim 17, wherein data of the user device is used as an input to a password of the authenticated key exchange.

### Claim 20 (depends on 15)

The computer readable media of claim 15, wherein the encrypted authentication information in encrypted by a password authenticated key exchange protocol.