Biometric template handling

Patent metadata

Field	Value
Publication number	US-11308190-B2
Application number	US-201816763620-A
Country	US
Kind code	B2
Filing date	Nov 9, 2018
Priority date	Nov 24, 2017
Publication date	Apr 19, 2022
Grant date	Apr 19, 2022

Abstract

A method for handling biometric templates is disclosed for an authenticating device applying biometric authentication. The method comprises acquiring a set of biometric data associated with a prospect user, and acquiring a decryption key (associated with an encrypted biometric template associated with an enrolled user of the authenticating device) from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device. The method also comprises retrieving, from a storage medium, at least a part of the encrypted biometric template associated with the enrolled user, decrypting the retrieved part of the biometric template using the acquired decryption key and performing an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template.

First claim

The invention claimed is:

1. A method for handling biometric templates for an authenticating device applying biometric authentication, the method comprising:
acquiring, via a biometric reader, a set of biometric data associated with a prospect user of the authenticating device;
acquiring a decryption key from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device, wherein the decryption key is associated with an encrypted biometric template associated with an enrolled user of the authenticating device;
retrieving, from a storage medium, at least a part of the encrypted biometric template associated with the enrolled user;
decrypting the retrieved part of the biometric template using the acquired decryption key; and
performing an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template,
wherein the authenticating device keeps a communication key pair comprising a public communication key and a private communication key, and wherein acquiring the decryption key comprises:
transmitting the public communication key to the key carrying device;
receiving a challenge message from the key carrying device;
transmitting a response message to the key carrying device;
receiving the decryption key from the key carrying device when the transmitted response message is correct, wherein the decryption key is encrypted by the public communication key; and
decrypting the decryption key using the private communication key.

2. The method of claim 1 wherein the decryption key comprises an open identifier of the key carrying device and wherein acquiring the decryption key comprises reading the open identifier from the key carrying device.

3. The method of claim 1 wherein the decryption key comprises a protected key and wherein acquiring the decryption key comprises:
providing a password to the key carrying device; and
in response thereto, receiving the protected key from the key carrying device.

4. A method for handling biometric templates for an authenticating device applying biometric authentication, the method comprising:
acquiring, via a biometric reader, a set of biometric data associated with a prospect user of the authenticating device;
acquiring a decryption key from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device, wherein the decryption key is associated with an encrypted biometric template associated with an enrolled user of the authenticating device;
retrieving, from a storage medium, at least a part of the encrypted biometric template associated with the enrolled user;
decrypting the retrieved part of the biometric template using the acquired decryption key;
performing an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template; and
when the attempt to authenticate the prospect user as the enrolled user is successful:
locally storing the decrypted part of the biometric template;
allowing further attempts to authenticate the prospect user as the enrolled user based on the locally stored decrypted part of the biometric template; and
discarding the locally stored decrypted part of the biometric template when a discarding event occurs.

5. The method of claim 1 further comprising transferring at least a portion of the encrypted biometric template to:
one or more other authenticating devices; and/or
a biometric template server for retrieval by one or more other authenticating devices.

6. The method of claim 1 wherein the biometric template is a fingerprint template and the acquired set of biometric data is indicative of one or more fingerprint features.

7. The method of claim 1 wherein the biometric template is an iris template and the acquired set of biometric data is indicative of one or more iris features.

8. The method of claim 1 further comprising discarding the acquired decryption key as soon as the attempt to authenticate the prospect user as the enrolled user is completed.

9. The method of claim 1 wherein the storage medium is comprised in the authenticating device.

10. The method of claim 1 wherein the storage medium is comprised in a cloud-based server external to the authenticating device.

11. The method of claim 1 wherein the part of the biometric template comprises the entire biometric template.

12. The method of claim 1 further comprising enrolling a user of the authenticating device by:
acquiring, via the biometric reader, an enrolment set of biometric data associated with the user to be enrolled;
acquiring an encryption key from the key carrying device associated with the user to be enrolled, wherein the encryption key is associated with the decryption key of the key carrying device;
encrypting, using the acquired encryption key, a biometric template created based on the acquired enrollment set of biometric data; and
storing the encrypted biometric template in the storage medium.

13. A computer program product comprising a non-transitory computer readable medium, having thereon a computer program comprising program instructions, the computer program being loadable into a data processing unit and configured to cause execution of the method according to claim 1 when the computer program is run by the data processing unit.

14. An arrangement for handling biometric templates for an authenticating device applying biometric authentication, the arrangement comprising a controller configured to cause:
acquisition, via a biometric reader, of a set of biometric data associated with a prospect user of the authenticating device;
acquisition of a decryption key from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device, wherein the decryption key is associated with an encrypted biometric template associated with an enrolled user of the authenticating device;
retrieval, from a storage medium, of at least a part of the encrypted biometric template associated with the enrolled user;
decryption of the retrieved part of the biometric template using the acquired decryption key; and
performance of an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template,
wherein the authenticating device keeps a communication key pair comprising a public communication key and a private communication key, and wherein the controller is configured to cause acquisition of the decryption key by causing:
transmission of the public communication key to the key carrying device;
reception of a challenge message from the key carrying device;
transmission of a response message to the key carrying device;
reception of the decryption key from key carrying device when the transmitted response message is correct, wherein the decryption key is encrypted by the public communication key; and
decryption of the decryption key using the private communication key.

15. The arrangement of claim 14 wherein the decryption key comprises an open identifier of the key carrying device and wherein the controller is configured to cause acquisition of the decryption key by causing reading of the open identifier from the key carrying device.

16. The arrangement of cl

Assignees

• Fingerprint Cards Ab
• Fingerprint Cards Anacatum Ip Ab

Inventors

• Andersson Markus
• Nilsson Jan
• Khullar Anders

Classifications

• H04L9/0819

  Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062) · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/3231

  Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861) · CPC title

• G06F21/32 Primary

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title