Methods using mediation software for rapid health care support over a secured wireless network; methods of composition; and computer program products therefor

A health care-support method of using a specialized software application, operable on a server system communicably connectable to an information storage unit, which is accessible over a data communication network, comprising the steps of:

• executing said specialized software application using a server system to process a remote request that was transmitted over at least one secure wireless network, which was received from a requesting application other than one operated by a possible registrant who is the subject of said request;
• utilizing at least one resolution application to process some data of the request as a query to search said information storage unit, which data was abstracted at least partly from a raw sample of a biometric source of said registrant and was represented so as to prevent its reconstruction into raw biometric form;
• and
• extracting data to generate a result set by associating (i) some data of the request, with (ii) at least one accessible registrant-specific data file, using a biometric abstraction model, wherein said at least one accessible registrant-specific data file also became conditionally accessible from the storage device in case of an uncertain health event outside the control of said registrant and the operator of said server system.

A method of constraining access to information in a database in accordance with pre-defined constraints, comprising the steps of:

• receiving a remote request on an individual to query a personal information database, from a requester other than the individual, which request (i) has data at least partly derived from a biometric source of the individual, and (ii) was sent over a data communications network at least partly composed of a secure wireless network;
• enabling execution of a query using a rules database that stores a set of rules;
• and
• executing said query with a database mechanism to extract individual-specific information from said personal information database to produce a corresponding result having at least one data object;
• wherein said enabling execution of a query comprises a query formed from the data of said request, and wherein said set of rules comprises at least one rule that excludes from said result any portion of stored health data associated with the individual if said portion of the data does not satisfy all rules applicable to said portion of the data.

A method of composing specialized software of a biometric query resolution mediator (BQR Mediator) to expedite personalized health-care support, comprising:

• programming an executable application to be run using a processor-based system communicably connectable to a database, to receive a request concerning an individual over a data communications system, at least partly comprising a secure wireless network;
• and
• enabling said application to resolve a query that is formed using transformed biometric data transmitted by a remote request from a requesting application, other than one operated by the individual who is the subject of the request, by using at least one instruction set to search said database to produce an output of information associated with said individual;
• wherein said query comprises a query in a compatible form to prevent unauthorized reconstruction of any individual's raw biometric data, and that permits query validation by at least one biometric abstraction model accessible to said BQR Mediator.

A health care-support method of using a specialized software application, operable on a data processing system communicably connectable to an information storage unit, which is accessible over a data communication network, comprising the steps of:

• executing said software application using said data processing system to process a remote request that is transmitted over at least one secure wireless network, and which is received from a requesting application other than one operated by a person who is the biometric subject of said request;
• utilizing said software application to process some data of the request as an input to search said information storage unit, which said input is composed at least partly from a raw biometric sample of said person and is processed so as to prevent any unauthorized disclosure of said raw biometric sample;
• generating a key using a biometric abstraction model and associating (i) said input exclusively with (ii) said person, to access at least one data element of a health profile of said person;
• and
• enabling access to said at least one data element that expedites personalized health care management by using said key, such that said access thereto is consistent with at least one privacy rule previously condoned by said person, wherein the privacy rule comprise at least one privacy rule self-designated by said person, and said at least one privacy rule is paramount to all other programmatic rules that would allow processing.

A method of processing data in a request by a first responder to advance the provision of rapid health care support to an individual at risk in any location by using at least one local and one remote data processing system, comprising the steps of:

• communicating over at least one secure wireless network to transfer data between said systems;
• processing biometric data of said individual through said local system and a communicably connectable database, before transferring said request, so as to attain a key specific for said individual by comparing a fresh distorted template against a stored distorted template;
• receiving at said remote data processing system said request that is transmitted over a secure wireless network from said first responder;
• enabling the retrieval of at least one data element of said health profile of said individual by processing said key;
• extending protection to all data of said data processing systems communicably connectable to a database from unauthorized disclosure, in transit and at rest;
• and
• constraining any transmission of each data element of said health profile to protect data under each rule applicable to each data element of said individual, consistent with each privacy rule of said individual.

A method of information retrieval by processing a query from a wireless device at least in part by using a server with specialized software and a communicably connectable database that enables biometric resolution, comprising the server-side steps of:

• receiving a query from a wireless device transmitted over a secure wireless network on behalf of an individual, to enable finding information that is specific to said individual by processing a query;
• validating said query that contains an irreversibly transformed biometric at least partly derived from said individual's live raw biometric data sample, using at least one biometric abstraction model;
• and
• executing the query by using said specialized software to retrieve information specific to said individual, in a form protected using encryption, from the database, by associating (i) transmitted query data, with (ii) data that is at least partly derived from the individual's biometric data and that was stored, in case of an uncertain health event, accessibly to said database.

A method of expediting personalized healthcare without reducing confidentiality by protecting information specific to an individual by constraining access to a database, comprising the steps of:

• receiving a remote request to identify an individual by processing a query transmitted with said request by utilizing said database configured to store individual-specific data;
• verifying that said request was sent over at least one secure wireless channel from an application of a wireless device with an authorization code;
• validating the query if said application transfers compatible transformed biometric data using a biometric abstraction model,
• executing said query, if validated, to determine if at least part of said transformed biometric data can be resolved into a key using a stored biometric reference;
• and
• producing a key by said database to identify said individual, if not inconsistent with any rule of said database.

A method of employing biometric identification to expedite remote personalized healthcare management, comprising the steps of:

• processing at least one live raw biometric sample of an individual using a biometric information input unit communicably connectable to a wireless device;
• transforming irreversibly at least one part of said sample into a recognition biometric using a biometric abstraction model, and deleting said live raw biometric sample;
• transmitting, from said wireless device, said recognition biometric to a server to enable conducting biometric information analysis using a specialized software application;
• evaluating whether said analysis permits a sufficiently close association between a recognition biometric and a previously stored reference biometric of said individual to identify said individual, within a predetermined confidence interval, to attain an identifier;
• and
• attaining said identifier by said server, wherein said server relies on biometric information analysis that performs with a tested level of quality of service, and with continuous monitoring that allows an audit.

A computer implemented method to process a query for biometric identification for rapid healthcare service, comprising the steps of:

• receiving a remote request to identify an individual, from a wireless device employed on the behalf of said individual, over at least one wireless network securely;
• wherein said device also enables processing by utilizing a biometric abstraction model not incompatible with a biometric abstraction model used previously to enable reliable processing;
• processing said remote request by a computer, communicably connectable to a database, using specialized software;
• and
• executing a query with an irreversibly transformed biometric data transmitted by said remote request using at least one biometric abstraction model to search said database to produce an output associated with said individual.

A method of using a wireless open biometric authentication protocol on behalf of a wireless device to identify a remote individual using transformed biometrics to manage personalized healthcare rapidly, comprising the steps, on the host-node's side of a network, of:

• electronically receiving a prompt from said device to share host node challenge data, as needed, to engage in said host node's challenge-response protocol for authentication;
• electronically sharing host node challenge data with said device by specifying at least one acceptable mode of biometrics, and indicating that the challenge procedure entails processing a recognition biometric, derived from an irreversible transformation of live raw biometric data of an individual, by applying a biometric abstraction model;
• receiving over a secure wireless channel a response to the challenge, comprising at least information on the cryptographic algorithm specific to a recognition biometric being provided, and a set-up parameter from said host node challenge data not inconsistent with a rule database of said host node, wherein said response is digitally signed with a private key;
• and
• validating said response with a public key, and processing said recognition biometric transferred from said device with a reference biometric of said individual, which was previously stored accessibly to said host node, to attain an identifier for said individual.

A method of using a specially adapted wireless network communication protocol to employ biometric recognition to expedite personalized healthcare support, comprising the computer-implemented steps of:

• receiving from a wireless device at least:
• (a) a security code, as a first factor, and (b) an encoded representation of a live raw biometric sample of an individual that prevents reconstruction of raw biometric data, as a second factor;
• comparing said second factor with a prestored transformed biometric to attain biometric recognition, within a predetermined tolerance, under at least one biometric abstraction model that is not incompatible with a biometric abstraction model used previously to enable reliable recognition using an accessible transformed biometric data of said individual stored in case of an uncertain health-related event;
• and
• permitting subsequent communication, at least to transmit secured data with said device over a continuing session, upon attaining biometric recognition that produces an identifier that identifies said individual.

A method of biometric public key encryption for wireless data communication by a processor and information retrieval by a wireless device over a wireless channel securely, using public key encryption for said wireless device and separate public key encryption for an individual to enable retrieval of individual-specific information, comprising the steps at said processor of:

• running specialized software to communicably connect said processor to a secure wireless channel to resolve a query from said wireless device, which contains irreversibly transformed biometric data of an individual derived from live raw biometric data, wherein said wireless device runs a client application that interfaces with a biometric information input unit and verifies liveness;
• comparing the query data with similarly transformed biometric data of a plurality of individuals prestored in a network-accessible database under at least one biometric abstraction model;
• executing a query to search said network-accessible database to generate an output derived from the comparison, within a predetermined confidence level, which output (i) comprises individual specific-information, protected by encryption, which is associated with said individual whose prestored data resolves the query, and (ii) enables the generation of a public key specific to said wireless device, for subsequent communications;
• sending an identifier of said individual from the output over a wireless channel securely, to said wireless device, wherein said identifier that enables said wireless device to attain a released private key of said individual previously generated for said individual that can be used to confer the signature of said individual as proof of permission for said wireless device to use the cryptokey of said individual to decrypt at least one data element of a health profile of said individual;
• transmitting to said wireless device, using said public key specific to said wireless device, said at least one data element over a wireless channel securely to expedite personalized healthcare support;
• and
• wherein said processor comprises a processor configured with continuous availability, reliability, non-repudiation, continuous monitoring, auditing, access control, fault avoidance, and intrusion protection, and also mediates access to encrypted health profile data of said individual, and said processor also lacks any means to decrypt the content of said encrypted health profile data.

A method of performing biometric identification as a service on behalf of an individual via a client application, comprising the steps of:

• utilizing a client application with accessible biometric information input means on behalf of an individual to employ biometric information analysis to enable obtaining an identifier of an individual over at least one secure wireless network;
• associating said identifier with personal health profile data of said individual to advance the provision of rapid healthcare support to said individual;
• and
• transmitting at least one data element of said health profile in a form encrypted with a cryptography key of said individual, wherein said cryptography key is recovered using said client application and said identifier.

A method of transforming a wireless channel to enable expedited access from a portable device to individual-specific information by employing a wireless open biometric authentication protocol of a server, comprising steps of said server of:

• enabling the initiation of a wireless session with a portable node by signaling said portable node to send authentication metadata that represents an irreversible transformation of a live raw biometric data sample of an individual as at least part of an authentication assertion;
• processing said metadata automatically using specialized software of said server to associate said metadata with a reference biometric, previously enrolled by said individual in network accessible storage in case of an uncertain event, to attain a key that identifies said individual;
• and
• attaining said key, using said specialized software consistently with a rule database and a biometric abstraction model, to permit subsequent communication over at least one secure wireless channel with said portable device.

A method of biometric identification by enabling an authentication protocol of a host node using two factors, even if from different sources, for a wireless device to expedite personalized healthcare to an individual, comprising the steps, on the host node-side of the network, of:

• electronically pre-processing data received from said device, by using an access server application communicably connectable to said host node, wherein said pre-processing data seeks a description of the kinds of data required to satisfy a challenge-response protocol of said host node for authentication;
• electronically sharing a description with said device that a challenge is met under at least one rule of said host-node by transferring a response comprising at least (i) a first factor, a security code, and (ii) a second factor, data representing an irreversible transformation of a live raw biometric data sample of an individual;
• electronically receiving said response with said security code that enables the authentication of said device to the network of said host node, and with ancillary data, as needed, under said at least one rule;
• and
• electronically receiving said second factor over a separate and secure wireless channel that enables the authentication of said device to said host node upon biometric identification.

A method to leverage the existing capabilities of a wireless communication network by using specialized software compatible with a host node, comprising the host-node steps of:

• receiving from a wireless device a request on behalf of an individual over at least one secure wireless channel to resolve a query containing a transformed biometric, comprised of irreversibly transformed live raw biometric data, by comparing said transformed biometric with a previously stored transformed biometric, to identify said individual;
• executing said query with specialized software to determine whether said transformed biometric and said stored reference biometric match within a predetermined tolerance;
• and
• linking an identifier of said individual, that results from executing said query, with at least one confidential data object of health profile data of said individual from a database that stores all confidential data objects in a form protected using encryption.

A method for providing secure wireless communication between a trusted server and a wireless device to enable securely transmitting individual-specific information stored using encryption to expedite personalized healthcare support, comprising the steps, by said trusted server, of:

• establishing an initial two-way secure wireless communication session with said wireless device using an access certificate;
• generating, during said initial session, an authentication certificate that includes received identification information based at least upon a credential of said wireless device and an irreversibly transformed live raw biometric data;
• transmitting said authentication certificate to said wireless device prior to terminating said initial session;
• processing machine-readable data comprising both (i) encoded information comprising an irreversibly transformed live raw biometric data sample that enables biometric identification under a biometric abstraction model, and (ii) said authentication certificate transferred from said wireless device;
• and
• establishing a subsequent two-way secure wireless communication session between said trusted server and said wireless device by using said authentication certificate with said encoded information if biometric information analysis renders an identifier of a specific individual.

A method of using a biometric identification open server protocol to provide authentication of a client application so as to enable said client application to securely retrieve at least one portion of health profile data specific to an individual, comprising the steps, by an authentication server, of:

• receiving, from a wireless device using said client application, an access certificate issued from a compatible access server and transmitted over a wireless session that terminates after transmittal;
• establishing, by said authentication server, a secure bidirectional wireless communication session with said device, and receiving from said device authentication information that permits specifying an association between (i) an irreversibly encoded biometric of an individual representing a raw biometric sample of said individual and (ii) an access certificate that has not been revoked;
• generating, by said authentication server, an authentication certificate that is unique to said association, upon determining that said encoded biometric of said individual is decoded by said authentication server using at least one reference biometric of said individual previously stored under a pre-tested biometric abstraction model, and
• authenticating said client application of said device upon receiving said authentication certificate from said device, provided that processing said encoded biometric yields an identifier that identifies said individual, wherein said identifier conditionally enables secure access by said wireless device to confidential health profile data of said individual stored using encryption and which said authentication server lacks means to decrypt.

A method of using biometric recognition protocol initiated by third-party client application of a wireless device to locate a previously stored reference biometric of an individual to attain an identifier that identifies said individual and facilitates retrieval of associated health profile data, comprising the server-side steps of:

• receiving a query that contains a transformed biometric derived from a live raw biometric of said individual, sent over said wireless network securely from a wireless device, to enable associating metadata of said transformed biometric of said individual with a previously enrolled transformed biometric of said individual,
• using a specialized application to process said metadata to find an associated recognition biometric corresponding to a pattern of said metadata to enable biometric identification preprocessing of a query with an automatic extraction mechanism by using a directory to locate a reference biometric of said individual among a plurality of reference biometrics, within a predetermined confidence interval, and
• invoking the pointer to retrieve over a wireless channel securely said reference biometric maintained accessibly with continuous availability, subsequent to being previously stored in case of an uncertain health-related event, which is identifiable from a communicably connectable storage device owned and controlled by said individual by using said metadata consistently under a rule database.

A data communication method using a wireless open biometric authentication protocol for a wireless device to connect with a server, comprising the steps, at said device, of:

• initiating wireless data communication to signal said server to share server challenge data required to satisfy said server's challenge-response protocol for authentication;
• generating a recognition biometric, derived from an irreversible transformation of live raw biometric data of an individual, by employing a biometric abstraction model;
• transmitting, to said server over an initial secure channel, a response to the challenge that includes at least one set-up parameter from said server challenge data, wherein said response is digitally signed with a private key;
• and
• enabling said server with a rule database to validate said response using a public key, to decode data, and to associate said recognition biometric transferred from said device with an accessible reference biometric of said individual, which was previously stored accessibly, to attain an identifier that identifies said individual.

A method using a client application to connect with a server application for biometric identification, comprising steps by said client application of:

• transforming a live raw biometric data of an individual into a transformed biometric and formulating a query to include at least one portion of said transformed biometric;
• sending a request on behalf of said individual that transports said query to said server application that is communicably connectable to a database that protects all individual-specific information by using encryption;
• receiving a response with a reference biometric that said server application associated with said at least one portion of said transformed biometric sent securely, wherein said stored reference biometric was previously made continuously accessible by said server in case of an uncertain health event;
• and
• attaining an identifier of said individual, upon associating said transformed biometric with said reference biometric, within a predetermined tolerance, to improve personalized rapid healthcare support, wherein said client application prevents the storage, wireless transmission, and reconstruction of any raw biometric data.

A method of using a client application to connect with a server application for biometric identification, comprising steps at said client application of:

• transforming a live biometric sample of an individual into an irreversibly transformed biometric;
• sending an irreversibly transformed biometric to said server application over at least one secure wireless network;
• requesting said server application to identify said individual by processing said transformed biometric;
• and
• receiving an identifier associated with transformed biometric, which identifier identifies said individual, within a predetermined confidence level.

A wireless device for communicating on a network, said wireless device comprising:

• a biometric input interface for obtaining information representing biometric data of an individual;
• a processor, configured to transform a biometric data input from the biometric input interface into biometric metadata, compatibly with a biometric abstraction model that previously enabled storing matching metadata or said individual, within a predetermine tolerance, in case of an uncertain health-related event;
• a specialized application that (i) processes a message for biometric identification of said individual compatibly with a rule database and (ii) that prevents reconstruction of any raw biometric data;
• and
• a transceiver configured to transmit at least a portion of said biometric metadata on a wireless data network securely.