Back to results
US 12,732,372 B2Granted
Use of biometrics and privacy preserving methods to authenticate account holders online
AssigneeVisa International Service Association
InventorsJason Blackhurst, Kim Wagner, John F. Sheets, Chunxi Jiang, Sunpreet Singh Arora
Life of this patent
Estimating the term…
Abstract
Embodiments are directed to a method for securely performing biometric authentication online. The method described can be used to securely perform biometric authentication on a mobile device. For protecting the privacy of the user's biometric data, a cryptographic comparison protocol can be used to perform matching of encrypted templates. For example, the cryptographic comparison protocol may involve Fuzzy Extractors (FE), Homomorphic Encryption (HE), and/or Secure Multi-Party Computation (SMPC).
Claims19
A computer-implemented method, comprising:
- performing an enrollment process using an authentication application executed on a mobile device of a user by:
- initiating the enrollment process for enrolling the user in an authentication program;
- capturing a biometric enrollment sample of the user using the mobile device;
- generating a biometric enrollment template using the biometric enrollment sample of the user;
- and
- storing the biometric enrollment template locally or at an authentication computer;
- and
- receiving, by a resource provider application executing on the mobile device of the user, a selection for conducting a transaction that triggers an authentication process, wherein the resource provider application is a merchant application;
- performing the authentication process using the resource provider application executing on the mobile device of the user by:
- obtaining a biometric authentication sample captured by the mobile device;
- generating a biometric authentication template of the user from the biometric authentication sample;
- retrieving the biometric enrollment template from the authentication application or the authentication computer;
- authenticating the user of the mobile device based on the biometric authentication template without retrieving the biometric enrollment sample of the user, authenticating including:
- generating, by the resource provider application, a first cryptographic key and a public value from the biometric authentication template and a first function,
- generating, by the resource provider application, a second cryptographic key from the biometric enrollment template, the public value, and a second function, and
- using, by the resource provider application, the first and second cryptographic keys to authenticate the user by comparing the first cryptographic key representing the biometric authentication template to the second cryptographic key representing the biometric enrollment template;
- and
- executing at least one operation in response to the user being authenticated.
15 more elements
A user device comprising:
- one or more biometric capture devices;
- one or more processors;
- and
- one or more memories storing a resource provider application, an authentication application, and computer-executable instructions, wherein executing the computer-executable instructions by the one or more processors causes the user device to:
- perform an enrollment process using the authentication application executed on the user device of a user by:
- initiating the enrollment process for enrolling the user in an authentication program;
- capturing a biometric enrollment sample of the user using the user device;
- generating a biometric enrollment template using the biometric enrollment sample of the user;
- and
- storing the biometric enrollment template locally or at an authentication computer;
- and
- receiving, by the resource provider application executing on the user device of the user, a selection for conducting a transaction that triggers an authentication process, wherein the resource provider application is a merchant application;
- perform the authentication process using the resource provider application executing on the user device of the user by:
- obtaining a biometric authentication sample captured by the user device;
- generating a biometric authentication template of the user from the biometric authentication sample;
- retrieving the biometric enrollment template from the authentication application or the authentication computer;
- authenticating the user of the user device based on the biometric authentication template without retrieving the biometric enrollment sample of the user, authenticating including:
- generating a first cryptographic key and a public value from the biometric authentication template and a first function,
- generating a second cryptographic key from the biometric enrollment template, the public value, and a second function, and
- using the first and second cryptographic keys to authenticate the user by comparing the first cryptographic key representing the biometric authentication template to the second cryptographic key representing the biometric enrollment template;
- and
- execute at least one operation in response to the user being authenticated.
19 more elements
A computer-implemented method, comprising:
- performing an enrollment process using an authentication application executed on a mobile device of a user by:
- initiating the enrollment process for enrolling the user in an authentication program;
- capturing a biometric enrollment sample of the user using the mobile device;
- generating a biometric enrollment template using the biometric enrollment sample of the user;
- and
- storing the biometric enrollment template locally or at an authentication computer;
- and
- performing an authentication process using a resource provider application executing on the mobile device of the user by:
- obtaining a biometric authentication sample captured by the mobile device;
- generating a biometric authentication template of the user from the biometric authentication sample;
- authenticating the user of the mobile device based on the biometric authentication template without retrieving the biometric enrollment sample of the user, authenticating including:
- receiving an obfuscated circuit and information about the obfuscated circuit;
- generating an obfuscated authentication result using the biometric authentication template, the obfuscated circuit, and the information about the obfuscated circuit:
- providing, by the resource provider application, the obfuscated authentication result to an obfuscated matching circuit, wherein the obfuscated matching circuit determines a match result between the obfuscated authentication result and an obfuscated enrollment result generated using the obfuscating circuit and the biometric enrollment template, wherein the biometric enrollment template is previously generated at the mobile device using a previously obtained biometric enrollment sample of the user captured using the mobile device;
- receiving a notification of the match result;
- and
- executing at least one operation in response to the user being authenticated.
14 more elements
Dependencies are inferred from the claim text.