# US 2023/0412367 A1 · Systems and methods for trustworthy electronic authentication using a computing device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0412367 A1
- Document ID: US20230412367A1
- Status: Published application
- Kind: A1
- Application number: 18/240,522
- Filed: 2023-08-31
- Published: 2023-12-21
- Earliest claimed: 2021-11-18
- Inventors: James E. Bennison
- Web page: https://patentgrep.com/patent/US20230412367A1

## CPC

- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- H04L 9/0656: {Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes}
- H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 2463/082: applying multi-factor authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method, system, and digital recording medium provides for convenient and trustworthy user authentication with a computing device combining four authentication factors through use of a remote authentication system (RAS). An identity token (Device-ID) cryptographically bound to the user's computing device is generated as a first authentication factor. A password known only to the user is a second factor. Cryptographic signatures generated from the user's biometric minutiae is a third factor. A random challenge received from the RAS is a fourth factor. An encryption key-generation key is created cryptographically using the Device-ID and stored locally, which together with the user's cryptographic signatures are encrypted with a one-time-pad encryption key obtained from the RAS on a communication channel different from that used for other communication between the device and the RAS to provide perfect secrecy, then transmitted from the device to the RAS on a connection therebetween to register said shared-secrets.

## Claims

### Claim 1

A method for registering a user and their biometric identifiers with at least one remote authentication system, the method further comprising:
obtaining a unique user identity token from the remote authentication system;
obtaining values detected by trusted sensor mechanism(s) associated with the computing device to acquire biometric minutiae corresponding to each individual character of a secret password or passwords known to the user;
storing the biometric minutiae in a machine readable data storage mechanism associated with the computing device;
performing cryptographic operations on the biometric minutiae associated with each secret password character entered by the user in order to generate biometric digital-signatures for each of said password characters, whereby a combination of password characters and their associated biometric identifiers comprising the second and third factors in a multi-factor authentication method are created;
storing the unique user identity token and biometric minutiae with their corresponding biometric digital-signatures in a machine readable data storage mechanism associated with the computing device;
encrypting at least the user's biometric digital-signatures on the computing device using a portion of the high-entropy one-time-pad encryption key;
transmitting at least the unique user identity token and the user's encrypted biometric digital-signatures from the computing device to the remote authentication system over a network communicatively coupled to the computing device;
storing the received user's unique identity token and the plurality of the user's biometric digital-signatures in a user registration database associated with the remote authentication system containing a plurality of records associated with (i.e., keyed with) each user's unique identity token where the association between the user and their biometric data is registered with at least one remote authentication system, whereby the user's biometric digital-signatures corresponding to their password characters facilitating their utilization as two user identity factors in future multi-factor authentication transactions with the remote authentication system is provided.

### Claim 2 (depends on 1)

The method of claim 1 wherein confidentiality of the data encrypted with the high-entropy one-time-pad shared-secret encryption key is provided by,
encrypting the device-unique encryption key-derivation key using a portion of arbitrary length of the high-entropy one-time-pad encryption key;
encrypting optional other sensitive shared-secret data such as the user's biometric digital identifiers with the remaining portion of the key;
transmitting together or separately said encryption key-derivation key and/or optionally other sensitive data encrypted with the high-entropy one-time-pad encryption key to the remote authentication system over a network communicatively coupled to the computing device, whereby information-theoretical perfect secrecy of the transmitted shared-secret key-derivation key and biometric data is provided;
registering the received device-unique encryption key-derivation key on the remote authentication system in a device registration database associated with the device-unique identity token; and
registering the received biometric identifiers on the remote authentication system in a user registration database associated with (i.e., keyed with) the user's identity token.

### Claim 3 (depends on 1)

The method of claim 1 wherein the method further registers a unique user identity token and the associated user's verified identity details with at least one remote authentication system, the method further comprising:
performing identity proofing of the user by examination and verification of physical identity documents issued by third-parties or by verifying knowledge from the user only they would know to produce user identity data, thereby providing independent verification of the user's identity;
generating a unique user identity token on the remote authentication system for each user by cryptographically operating on some portion of the user's verified identity data to create cryptographic binding of the user identity token to the user's authenticated legal identity and identity details;
storing said user identity token with the user's legal identity details in a user registration database associated with the remote authentication system, whereby registration of the user identity token and the user's verified identity details with the remote authentication system is provided;
receiving said unique user identity token from the remote authentication system and entering it into the computing device;
storing said user identity token in the machine readable data storage associated with the computing device.

### Claim 4 (depends on 3)

The method of claim 3 wherein a user's authorization to access accounts at financial institutions is registered with the remote authentication system by utilizing the user's unique identity token comprising;
obtaining the user's unique identity token from machine readable data storage of the computing device;
obtaining the user's financial account information by capturing an image of a payment card, account statement, QR code or other credential with the trusted camera or other input method associated with the computing device;
transmitting the user's unique identity token and the account information to the remote authentication system over a network communicatively coupled to the computing device;
transmitting the legal identity information associated with the user stored in the user registration database from the remote authentication system to the financial institution associated with the account; and
establishing the user's authorization to access said account by comparing the verified identity information received from the computing device via the remote authentication system with information on file at the financial institution, whereby protection from fraudulent use of an account belonging to another is provided.