# US 2020/0401699 A1 · Secure fingerprint image system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0401699 A1
- Document ID: US20200401699A1
- Status: Published application
- Kind: A1
- Application number: 16/906,639
- Filed: 2020-06-19
- Published: 2020-12-24
- Earliest claimed: 2019-06-21
- Assignees: Analog Devices, Inc.
- Applicants: Analog Devices, Inc.
- Inventors: Patrick RIEHL; Tze Lei POO
- Web page: https://patentgrep.com/patent/US20200401699A1

## CPC

- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 21/83: input devices, e.g. keyboards, mice or controllers thereof
- G06F 21/1064: {Restricting content processing at operating system level}
- G06F 21/107: {License processing; Key processing}
- G06F 2221/031: Protect user input by software means
- G06F 2221/2149: Restricted operating environment
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Herein disclosed are approaches for protecting sensitive information within a fingerprint authentication system that can be snooped and utilized to access the device, secured information, or a secured application. The approaches can utilize encryption keys and hash functions that are unique to the device in which the fingerprint authentication is being performed to protect the sensitive information that can be snooped.

## Claims

### Claim 1

A device that is to implement fingerprint authentication, comprising:
an image sensor to capture an image of a fingerprint of a user for the fingerprint authentication; and
a readout integrated circuit (ROIC) coupled to the image sensor, the ROIC to utilize an encryption key or a hash function to perform encryption or hashing of the image, wherein the encryption key or the hash function is unique to the device.

### Claim 2 (depends on 1)

The device of claim 1, wherein the ROIC is to utilize the encryption key to perform encryption of the image.

### Claim 3 (depends on 2)

The device of claim 2, wherein a physically uncloneable function is to produce the encryption key.

### Claim 4 (depends on 2)

The device of claim 2, wherein the ROIC is to transmit the encryption key via an interface to a trusted execution environment, wherein the ROIC is to cause an irreversible procedure to be performed in response to transmission of the encryption key via the interface, and wherein the irreversible procedure prevents the ROIC from subsequent transmission of the encryption key via the interface.

### Claim 5 (depends on 4)

The device of claim 4, further comprising a fuse, wherein the irreversible procedure is to cause the fuse to be blown, and wherein the fuse being blown decouples the ROIC from the interface.

### Claim 6 (depends on 1)

The device of claim 1, wherein the ROIC is to utilize the hash function to perform hashing of the image.

### Claim 7 (depends on 6)

The device of claim 6, wherein a physically uncloneable function (PUF) is to produce the hash function.

### Claim 8 (depends on 7)

The device of claim 7, wherein the PUF is to be used to generate a random code, and wherein the hash function is based on the random code.

### Claim 9 (depends on 6)

The device of claim 6, wherein the hashing of the image via the ROIC is to produce a hashed image of the fingerprint, wherein the ROIC is to provide the hashed image to a trusted execution environment (TEE), and wherein the TEE is to utilize the hashed image as a control image for authentication of subsequent hashed images of fingerprints provided by the ROIC.

### Claim 10 (depends on 9)

The device of claim 9, wherein the hashed image is a first hashed image, wherein the fingerprint is a first fingerprint, wherein:
the ROIC is to:
produce a second hashed image of a second fingerprint captured by the image sensor; and
provide the second hashed image to the TEE; and
the TEE is to compare the second hashed image with the control image to determine whether to grant access to the device, secured information, or secured information based on the comparison of the second hashed image with the control image.

### Claim 11

One or more computer-readable media having instructions stored thereon, wherein the instructions, when executed by a device, cause the device to:
capture an image of a fingerprint;
encrypt or hash the image to produce an encrypted image or a hashed image, wherein an encryption key or a hash function utilized to encrypt or hash the image is unique to the device; and
provide the encrypted image or the hashed image for fingerprint authentication.

### Claim 12 (depends on 11)

The one or more computer-readable media of claim 11, wherein the encryption key or the hash function is generated based on a physically uncloneable function.

### Claim 13 (depends on 11)

The one or more computer-readable media of claim 11, wherein to encrypt or hash the image comprises to encrypt the image, wherein the encryption key is to be utilized to encrypt the image, and wherein the instructions, when executed by the device, further cause the device to:
provide the encryption key via an interface to a trusted execution environment (TEE); and
cause a fuse of the device to be blown subsequent to the encryption key being provided to the TEE to prevent the encryption key from being provided to the TEE at a subsequent time.

### Claim 14 (depends on 13)

The one or more computer-readable media of claim 13, wherein the encryption key is to be provided to the TEE during factory setup, and wherein the fuse is to be blown during the factory setup.

### Claim 15 (depends on 11)

The one or more computer-readable media of claim 11, wherein to encrypt or hash the image comprises to hash the image, wherein the hash function is to be utilized to hash the image, and wherein to provide the hashed image for fingerprint authentication includes to provide the hashed image to a trusted execution environment (TEE) to be utilized as a control image by the TEE for fingerprint authentication of subsequent hashed images provided to the TEE.

### Claim 16 (depends on 15)

The one or more computer-readable media of claim 15, wherein the hashed image comprises a first hashed image, wherein the fingerprint is a first fingerprint, and wherein the instructions, when executed by the device, further cause the device to:
capture an image of a second fingerprint;
hash the image of the second fingerprint with the hash function to produce a second hashed image; and
provide the second hashed image to the TEE, the TEE to utilize the control image to perform fingerprint authentication of the second hashed image.

### Claim 17

A device for fingerprint authentication, comprising:
a trusted execution environment (TEE) to determine a result of the fingerprint authentication; and
a readout integrated circuit (ROIC) to:
generate an encryption key or a hash function, the encryption key or the hash function being unique to the device; and
provide the encryption key or a hashed image of a fingerprint produced by the hash function to the TEE via an interface, the encryption key or the hashed image to be utilized for the fingerprint authentication.

### Claim 18 (depends on 17)

The device of claim 17, wherein to generate the encryption key or the hash function comprises to generate the encryption key, wherein to provide the encryption key or the hashed image to the TEE comprises to provide the encryption key to the TEE, and wherein the TEE is further to:
receive an encrypted image of a first fingerprint from the ROIC;
decrypt the encrypted image of the finger fingerprint with the encryption key to produce a control image to be utilized for the fingerprint authentication; and
generate, based on a comparison of the control image with an encrypted image of a second fingerprint received from the ROIC, an indication of whether to provide access to the device, secured information, or a secured application.

### Claim 19 (depends on 17)

The device of claim 17, wherein to generate the encryption key or the hash function comprises to generate the hash function, wherein the hashed image of the fingerprint is a hashed image of a first fingerprint, wherein:
the ROIC is further to:
perform a first hash operation on an image of a first fingerprint to produce the hashed image of the first fingerprint;
perform a second hash operation on an image of a second fingerprint to produce a hashed image of the second fingerprint; and
provide the hashed image of the second fingerprint to the TEE; and the TEE is further to:
store the hashed image of the first fingerprint as a control image for the fingerprint authentication; and
generated, based on a comparison of the control image with the hashed image of the second fingerprint, an indication of whether to provide access to the device, secured information, or a secured application.

### Claim 20 (depends on 17)

The device of claim 17, wherein to generate the encryption key or the hash function comprises to generate the encryption key or the hash function based on a physically uncloneable function.