Back to results
US 9,961,077 B2Granted
System and method for biometric authentication with device attestation
AssigneeNok Nok Labs, Inc.
InventorRolf Lindemann
Life of this patent
Estimating the term…
Abstract
A system, apparatus, method, and machine readable medium are described for biometric device attestation. For example, one embodiment of an apparatus includes: a biometric device to read biometric authentication data from a user and determine whether to successfully authenticate the user based on a comparison with biometric reference data; and a cryptographic engine to establish communication with a relying party and to attest to the model and/or integrity of the biometric device to the relying party.
Claims21
An apparatus for remotely attesting to authenticator integrity comprising:
- an authenticator to read biometric authentication data from a user and determine whether to successfully authenticate the user based on a comparison with biometric reference data, a score being generated from the comparison;
- and
- a cryptographic engine comprising a processor and non-transitory machine-readable medium having program code, which, when executed by the processor, causes the cryptographic engine to:
- receive a challenge from a relying party that is outside of a physical enclosure of the apparatus, the challenge comprising a randomly generated nonce,
- sign the challenge and the score using an attestation key to generate an attestation signature, wherein the attestation key is established after an endorsement key certificate is generated, using a product line, specifically for the relying party, wherein the product line extracts a public endorsement key from an endorsement key pair to generate and return the endorsement key certificate to the cryptographic engine, and wherein the endorsement key certificate corresponds to the attestation key, and
- send a user identifier (ID), the score, and the attestation signature to the relying party, wherein the relying party verifies that the attestation signature is valid using a key corresponding to the endorsement key certificate, and wherein the score is used to determine whether the authentication of the user is successful.
3 more elements
A method for remotely attesting to authenticator integrity comprising:
- reading biometric authentication data from a user and determining whether to successfully authenticate the user based on a comparison with biometric reference data, a score being generated from the comparison, wherein the reading and determining are performed by an authenticator;
- and
- protecting communication with a relying party that is outside of a physical enclosure of the authenticator;
- and
- performing an attestation transaction with the relying party to attest to the integrity of the authenticator to the relying party, the attestation comprising:
- receiving a challenge from the relying party, the challenge comprising a randomly generated nonce;
- signing the challenge and the score using an attestation key to generate an attestation signature, wherein the attestation key is established after an endorsement key certificate is generated, using a product line specifically for the relying party, wherein the product line extracts a public endorsement key from an endorsement key pair to generate and return the endorsement key certificate for signing the challenge and the score, and wherein the endorsement key certificate corresponds to the attestation key;
- and
- sending a user identifier (ID), the score, and the attestation signature to the relying party, wherein the relying party verifies that the attestation signature is valid using a key corresponding to the endorsement key certificate, and wherein the score is used to determine whether the authentication of the user is successful.
6 more elements
A non-transitory machine-readable medium having program code stored thereon which, when executed by a machine, causes the machine to perform:
- reading biometric authentication data from a user and determining whether to successfully authenticate the user based on a comparison with biometric reference data, a score being generated from the comparison, wherein the operations of reading and determining are performed by an authenticator;
- and
- protecting communication with a relying party that is outside of a physical enclosure of the authenticator;
- and
- performing an attestation transaction with the relying party to attest to integrity of the authenticator to the relying party, the attestation comprising:
- receiving a challenge from the relying party, the challenge comprising a randomly generated nonce;
- signing the challenge and the score using an attestation key to generate an attestation signature, wherein the attestation key is established after an endorsement key certificate is generated, using a product line, specifically for the relying party, wherein the product line extracts a public endorsement key from an endorsement key pair to generate and return the endorsement key certificate for signing the challenge and the score, and wherein the endorsement key certificate corresponds to the attestation key;
- and
- sending a user identifier (ID), the score, and the attestation signature to the relying party, wherein the relying party verifies that the attestation signature is valid using a key corresponding to the endorsement key certificate, and wherein the score is used to determine whether the authentication of the user is successful.
6 more elements
Dependencies are inferred from the claim text.