# US 2021/0344487 A1 · Authentication processing service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344487 A1 - Document ID: US20210344487A1 - Status: Published application - Kind: A1 - Application number: 17/373,465 - Filed: 2021-07-12 - Published: 2021-11-04 - Earliest claimed: 2019-02-08 - Assignees: Keyless Technologies Limited - Applicants: Keyless Technologies Ltd - Inventors: Andrea Carmignani; Fabian Eberle; Giuseppe Ateniese; Jaroslav Sedenka; Paolo Gasti - Web page: https://patentgrep.com/patent/US20210344487A1 ## CPC - H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)} - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0869: {involving random numbers or seeds} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/3255: {using group based signatures, e.g. ring or threshold signatures} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 63/0478: {applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and computer-readable media for facilitating an authentication processing service are provided. ## Claims ### Claim 1 A method for authenticating a user of at least a first user electronic device and a second user electronic device using a network node, the method comprising: receiving, at the network node, from the first user electronic device, at a first moment in time, communication protocol information comprising: a restricted enrollment input corresponding to an unrestricted enrollment input that has been restricted by an enrollment biometric template indicative of user enrollment biometrics captured at an enrollment moment in time that is prior to the first moment in time; an unrestricted authentication input; and a transformed matching function that is operative to output a success key in response to successfully evaluating the transformed matching function using two inputs; receiving, at the network node, from the second user electronic device, at a second moment in time after the first moment in time, a restricted authentication input corresponding to the unrestricted authentication input that has been restricted by an authentication biometric sample indicative of user authentication biometrics captured at an authentication moment in time that is after the first moment in time but that is prior to the second moment in time; after the receiving the restricted authentication input, evaluating, at the network node, the transformed matching function using the restricted enrollment input and the restricted authentication input; and when the evaluating is successful, using, at the network node, the success key output by the transformed matching function to enable a secure operation. ### Claim 2 (depends on 1) The method of claim 1, wherein the second user electronic device is the first user electronic device. ### Claim 3 (depends on 1) The method of claim 1, wherein the enrollment biometric template is not accessible to the network node. ### Claim 4 (depends on 1) The method of claim 1, wherein the authentication biometric sample is not accessible to the network node. ### Claim 5 (depends on 4) The method of claim 4, wherein the enrollment biometric template is not accessible to the network node. ### Claim 6 (depends on 1) The method of claim 1, wherein: the communication protocol information further comprises doubly encrypted seed data comprising seed information that has been encrypted with an inner key and then encrypted with the success key; and the using the success key comprises: decrypting, at the network node, using the success key output by the transformed matching function, the doubly encrypted seed data to reveal singly encrypted seed data comprising the seed information that has been encrypted with the inner key; and after the decrypting, sending, from the network node, to a remote entity, the singly encrypted seed data for further enabling the secure operation. ### Claim 7 (depends on 6) The method of claim 6, wherein the remote entity is the first user electronic device. ### Claim 8 (depends on 6) The method of claim 6, wherein the remote entity is the second user electronic device. ### Claim 9 (depends on 6) The method of claim 6, wherein the communication protocol information further comprises encrypted inner key data comprising the inner key that has been encrypted with a public encryption key of the first user electronic device. ### Claim 10 (depends on 9) The method of claim 9, wherein: the second user electronic device is the first user electronic device; the unrestricted authentication input of the communication protocol information is encrypted with the inner key; and the method further comprises, after the receiving the communication protocol information, but before the receiving the restricted authentication input, sending, from the network node, to the first user electronic device, the encrypted inner key data and the unrestricted authentication input encrypted with the inner key. ### Claim 11 (depends on 6) The method of claim 6, wherein the seed information comprises at least a portion of a secret seed generated by the first user electronic device. ### Claim 12 (depends on 11) The method of claim 11, wherein the secret seed is not stored on the first user electronic device at the second moment in time. ### Claim 13 (depends on 6) The method of claim 6, wherein: the communication protocol information further comprises doubly encrypted enrollment biometric template data comprising enrollment biometric template information that has been encrypted with the inner key and then encrypted with the success key; and the using the success key further comprises: decrypting, at the network node, using the success key output by the transformed matching function, the doubly encrypted enrollment biometric template data to reveal singly encrypted enrollment biometric template data comprising the enrollment biometric template information that has been encrypted with the inner key; and after the decrypting, sending, from the network node, to the remote entity, the singly encrypted enrollment biometric template data. ### Claim 14 (depends on 6) The method of claim 6, wherein the remote entity is configured to use the seed information to authenticate a challenge from a third party subsystem. ### Claim 15 A method for authenticating a user of a user electronic device using a network node, the method comprising: obtaining, at the user electronic device, a seed; generating, at the user electronic device, an enrollment biometric template indicative of user enrollment biometric identifier information; identifying, at the user electronic device, a transformed matching function that is operative to output a success key in response to successfully evaluating the transformed matching function using a first input and a second input; generating, at the user electronic device, a restricted enrollment input by restricting the first input using the enrollment biometric template; encrypting, at the user electronic device, with the success key, seed information that comprises at least a portion of the seed; after the encrypting, deleting the seed from the user electronic device; and sending, from the user electronic device, to the network node, enrollment data comprising the encrypted seed information and the transformed matching function and the restricted enrollment input. ### Claim 16 (depends on 15) The method of claim 15, wherein: the method further comprises generating, at the user electronic device, an inner key; and the seed information comprises the at least a portion of the seed encrypted with the inner key. ### Claim 17 (depends on 15) The method of claim 15, further comprising: after the sending, receiving, at the user electronic device, from the network node, the seed information; recovering, at the user electronic device, the seed using the received seed information; and using, at the electronic device, the recovered seed to enable a secure operation. ### Claim 18 (depends on 15) The method of claim 15, further comprising: after the sending, generating, at the user electronic device, an authentication biometric sample indicative of user authentication biometric identifier information; generating, at the user electronic device, a restricted authentication input by restricting the second input using the authentication biometric sample; and transmitting, from the user electronic device, to the network node, the restricted authentication input. ### Claim 19 (depends on 15) The method of claim 15, further comprising: encrypting, at the user electronic device, with the success key, enrollment biometric template information that comprises at least a portion of the enrollment biometric template; and after both of the encrypting the enrollment biometric template information and the generating the restricted enrollment input, deleting the enrollment biometric template from the user electronic device, wherein the enrollment data further comprises the encrypted enrollment biometric template information. ### Claim 20 A non-transitory computer-readable storage medium storing at least one program, the at least one program comprising instructions, which, when executed by at least one processor of an electronic subsystem, cause the at least one processor to: receive, from a user electronic device, a restricted enrollment input corresponding to an unrestricted enrollment input that has been restricted by an enrollment biometric template indicative of user enrollment biometrics captured at an enrollment moment in time; receive, from the user electronic device, a restricted authentication input corresponding to an unrestricted authentication input that has been restricted by an authentication biometric sample indicative of user authentication biometrics captured at an authentication moment in time after the enrollment moment in time; receive, from the user electronic device, a transformed matching function that is operative to output a success key in response to successfully evaluating the transformed matching function using two inputs; evaluate the received transformed matching function using the received restricted enrollment input and the received restricted authentication input; and when the evaluation is successful, use the success key output by the transformed matching function to enable a secure operation.