US 8,508,338 B1Granted

Method and system for defeat of replay attacks against biometric authentication systems

OwnerHoward Owen Fiddyinventor

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present invention is directed to a method and system for defeating replay attacks against biometric authentication systems by randomly prompting the subject to adjust a part of their body in some measurable way. The timing of these adjustments would be used to verify that the biometric input is coming from a live subject and not a recording. One embodiment of the design would include a commodity camera-equipped mobile device (130) connected to an authentication server (110) via the Internet (120). In this embodiment an encrypted video stream of the subject—for example his or her hand (140a)—would be established from the mobile device to the authentication server. The authentication server would generate a unique series of time delays, at which intervals a prompt—for example to extend or retract a specific finger—would be relayed from the server to the mobile device and subsequently the subject. The subject's coordinated response to these timed prompts—and only these timed prompts—would be measured by the authentication server. By comparing biometric features from the video stream—for example measurements of finger dimensions—to the known values for the subject in a database the authentication server will decide whether or not to authenticate the user.

Claims11

Dependent claims

A method for biometric authentication comprising:

a. providing a mobile device which is able to initiate an authentication session and transmit a continuous, uninterrupted live stream of biometric data collected from a user to a remote server during said authentication session;
b. providing an authentication server which is able to receive said biometric data stream, extract biometric features during said authentication session and determine whether said features were captured from the user within a predetermined confidence interval;
c. providing a random number generator which the authentication server can use to create a unique series of time-delayed prompts for the user to alter his appearance at random time intervals during said authentication session;
d. detecting the variations in said continuous, uninterrupted biometric data stream and comparing them to the nature and timing of said prompts during said authentication session;
e. the authentication server determining if the user is physically present at the mobile device during said authentication session according to the continuous validity of the biometric data and the validity of the continuous, uninterrupted biometric data stream based on the elapsed time between said detecting with respect to the prompts;
and
f. measuring the duration of the elapsed time between said detecting with respect to the prompts;
g. wherein the prompts are randomly generated at random intervals of time determined by the random number generator;
whereby the authentication server remotely authenticates the user and terminates said authentication session upon determining the validity of the physical presence of said user at said mobile device, protecting the user from being impersonated by unauthorized users unable to predict the unique series of time-delayed prompts.

6 more elements

A machine for biometric authentication comprising:

a. a remote server computer, initiating an authentication session;
b. a mobile device, said mobile device capable of collecting and transmitting a continuous, uninterrupted live stream of biometric data to said remote server computer during said authentication session;
c. an authentication server, said authentication server capable of receiving said continuous, uninterrupted live stream of biometric data during said authentication session;
d. wherein said authentication server is configured to extract biometric features and continuously determine whether said features were collected from said user during said authentication session within a predetermined confidence interval;
e. a random number generator, wherein said random number generator is employed by said authentication server to prompt the user to alter his or her appearance at a unique series of random intervals during said authentication session;
f. wherein said authentication server is configured to detect the variations in said continuous, uninterrupted biometric data stream during said authentication session and compare them to the nature and timing of said prompts;
and
g. wherein said authentication server is configured to determine the validity of the physical presence of said user at said mobile device according to the correctness of the response of said user in performing the action requested in said prompts during said authentication session;
h. wherein said authentication server terminates said authentication session upon determining the validity of the physical presence of said user at said mobile device.

6 more elements

Dependencies are inferred from the claim text.