Two-level authentication for secure transactions

An apparatus for electronic authentication comprising:

• a biometric reader adapted to receive a biometric input;
• a receiver/decoder circuit adapted to wirelessly receive a biometric profile sample from a personal digital key (PDK) over a wireless channel, wherein the biometric profile sample comprising transformed information is based on less than the entirety of a biometric profile stored in a memory of a personal digital key (PDK), wherein the biometric profile is uniquely associated with an individual;
• a processor coupled to the receiver/decoder circuit and the biometric reader, the processor adapted to compare the biometric profile sample to the biometric input, and indicate that a transaction should be authorized responsive to determining that the biometric profile sample matches the biometric input;
• and
• a network interface coupled to the processor and to the receiver/decoder circuit, the network interface adapted to establish the secure communication channel with a remote registry with which the PDK is registered, transmit PDK information uniquely associated with the PDK to the remote registry using the secure communication channel and receive a validation decision from the remote registry using the secure communication channel indicating whether the remote registry determines if the PDK is valid or invalid, wherein the processor determines whether to authorize the transaction using the validation decision and comparing the biometric profile sample to the biometric input.

A personal digital key (PDK) comprising:

• a memory adapted to store a biometric profile comprising transformed biometric information in a tamper-proof format, wherein the biometric profile is uniquely associated with an individual, adapted to store a biometric profile sample, the biometric profile sample associated with the biometric profile and based on less than the entirety of the biometric profile, and adapted to store a unique PDK ID in a tamperproof format, the PDK ID comprising information identifying the PDK among other PDKs;
• a transceiver coupled to the memory, the transceiver adapted to wirelessly receive over a secure wireless channel data based at least in part on a biometric input, the biometric input received from an external device and wirelessly transmit the PDK ID over a secure wireless channel to the external device;
• and
• a control logic to coordinate a comparison of data based at least in part on a biometric input to a set of transformed information comprising the biometric profile sample.

A method for secure authentication using a physical, portable key (PDK) comprising:

• storing a biometric profile in a tamper-proof memory, wherein the biometric profile is uniquely associated with an individual and comprises transformed biometric information;
• storing a biometric profile sample associated with the biometric profile and based on less that the entirety of the biometric profile;
• wirelessly receiving data based at least in part on a biometric input from an external;
• and
• responsive to receiving data based at least in part on a biometric input, the external device authorizes a transaction based on (a) a comparison between the biometric profile sample and the data based at least in part on the biometric input acquired from the individual performed by the PDK and (b) a validation decision received from a remote registry using a secure communication channel, wherein the validation decision authenticates the PDK based at least in part on whether the PDK is registered with the remote registry.

A method for secure electronic authentication comprising:

• wirelessly receiving uniquely identifying information from a personal digital key (PDK);
• transmitting the uniquely identifying information from the PDK to a remote registry with which the PDK is registered;
• receiving a validation decision from the remote registry using a secure communication channel, the validation decision indicating whether the PDK is valid based at least in a part on the uniquely identifying;
• receiving profile information from the PDK indicating types of profiles stored in the PDK;
• determining if the types of profiles are compatible with allowable authentication types;
• performing one or more authentication tests to determine if a profile is valid, wherein performing the one or more authentication tests includes wirelessly receiving a biometric profile sample from the PDK, wherein the
• biometric profile sample is associated with a biometric profile and is based on less than the entirety of the biometric profile and wherein the biometric profile is uniquely associated with an individual,
• acquiring a biometric input and
• determining that the profile is valid responsive to the acquired biometric input matching the received biometric profile sample;
• and
• authorizing a transaction responsive to determining that the PDK is valid, determining that the types of profiles are compatible, and determining that the profile is valid.