Biometric electronic signature authenticated key exchange token

Patent metadata

Field	Value
Publication number	US-12301566-B2
Application number	US-202318394883-A
Country	US
Kind code	B2
Filing date	Dec 22, 2023
Priority date	May 31, 2016
Publication date	May 13, 2025
Grant date	May 13, 2025

Abstract

A biometric electronic signature authenticated key exchange (“BESAKE”) token processing system. The system includes a storage location having a plurality of biometric reference templates. The system further includes an authentication computing system having a processor and instructions. The instructions configured to cause the authentication computing system to receive a signing party identifier and the BESAKE token from a signing party. The BESAKE token having a biometric sample encrypted using an encryption key. The instructions further configured to generate a decryption key and decrypt the encrypted biometric sample from the BESAKE token. The instructions further configured to match the biometric sample with a biometric reference template and transmit to a biometric service provider computing system a match request. The instructions further configured to determine a signing party identity via a binary match value. The binary match value relating to a result of matching the biometric sample with the biometric reference template.

First claim

What is claimed is:

1. A method, comprising:
generating a first cryptographic key using a first knowledge factor corresponding to an identifier identifying a signing party;
decrypting a biometric electronic signature authenticated key exchange (“BESAKE”) token using the first cryptographic key, wherein the BESAKE token is encrypted using a second cryptographic key derived using a second knowledge factor;
determining a biometric sample and the second knowledge factor from the decrypted BESAKE token; and
authenticating the signing party in response to determining that the biometric sample matching a biometric reference template and in response to verifying a timestamp corresponding to the BESAKE token.

2. The method of claim 1 , wherein the BESAKE token is decrypted via a same encryption algorithm used by the signing party to encrypt the BESAKE token.

3. The method of claim 1 , further comprising:
sending a request to a biometric service provider (“BSP”) computing system, the request comprising the biometric sample; and
receiving a value indicating whether the biometric sample matches the biometric reference template associated with the identifier.

4. The method of claim 1 , wherein the BESAKE token comprises a record for the biometric sample, the record is encrypted using the second cryptographic key.

5. The method of claim 1 , wherein the signing party is authenticated in response to determining that the second knowledge factor matching the first knowledge factor.

6. The method of claim 1 , wherein the second knowledge factor fails to match the first knowledge factor.

7. A system, comprising at least one memory and at least one processor, wherein the at least one processor is configured to:
generate a first cryptographic key using a first knowledge factor corresponding to an identifier identifying a signing party;
decrypt a biometric electronic signature authenticated key exchange (“BESAKE”) token using the first cryptographic key, wherein the BESAKE token is encrypted using a second cryptographic key derived using a second knowledge factor;
determine a biometric sample and the second knowledge factor from the decrypted BESAKE token; and
authenticate the signing party in response to determining that the biometric sample matching a biometric reference template and in response to verifying a timestamp corresponding to the BESAKE token.

8. The system of claim 7 , wherein the BESAKE token is decrypted via a same encryption algorithm used by the signing party to encrypt the BESAKE token.

9. The system of claim 7 , wherein the at least one processor is further configured to:
sending a request to a biometric service provider (“BSP”) computing system, the request comprising the biometric sample; and
receiving a value indicating whether the biometric sample matches the biometric reference template associated with the identifier.

10. The system of claim 7 , wherein the BESAKE token comprises a record for the biometric sample, the record is encrypted using the second cryptographic key.

11. The system of claim 7 , wherein the signing party is authenticated in response to determining that the second knowledge factor matching the first knowledge factor.

12. The system of claim 7 , wherein the second knowledge factor fails to match the first knowledge factor.

13. At least one non-transitory processor readable medium comprising processor-readable instructions, such that, when executed, causes at least one processor to:
generate a first cryptographic key using a first knowledge factor corresponding to an identifier identifying a signing party;
decrypt a biometric electronic signature authenticated key exchange (“BESAKE”) token using the first cryptographic key, wherein the BESAKE token is encrypted using a second cryptographic key derived using a second knowledge factor;
determine a biometric sample and the second knowledge factor from the decrypted BESAKE token; and
authenticate the signing party in response to determining that the biometric sample matching a biometric reference template and in response to verifying a timestamp corresponding to the BESAKE token.

14. The non-transitory processor readable medium of claim 13 , wherein the BESAKE token is decrypted via a same encryption algorithm used by the signing party to encrypt the BESAKE token.

15. The non-transitory processor readable medium of claim 13 , wherein the at least one processor is further caused to:
sending a request to a biometric service provider (“BSP”) computing system, the request comprising the biometric sample; and
receiving a value indicating whether the biometric sample matches the biometric reference template associated with the identifier.

16. The non-transitory processor readable medium of claim 13 , wherein the BESAKE token comprises a record for the biometric sample, the record is encrypted using the second cryptographic key.

17. The non-transitory processor readable medium of claim 13 , wherein the signing party is authenticated in response to determining that the second knowledge factor matching the first knowledge factor.

18. The non-transitory processor readable medium of claim 13 , wherein the second knowledge factor fails to match the first knowledge factor.

Assignees

• Wells Fargo Bank Na

Inventors

• Griffin Phillip H
• Stapleton Jeffrey J

Classifications

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title