Method and System for Providing Password-free, Hardware-rooted, ASIC-based Authentication of a Human to a Mobile Device using Biometrics with a Protected, Local Template to Release Trusted Credentials to Relying Parties

摘要

Biometric data, which may be suitably transformed are obtained from a biometric input device contained within a stand-alone computer or a mobile device, which may contain an ASIC chip connected to or incorporated within the stand-alone computer or mobile device and which includes the capability for capturing one or more biometric samples and for biometric feature extraction, matching and encryption. For extra security, the biometric matching is used in conjunction with a PIN to authenticate the user to the stand-alone computer or mobile device. The biometric template and other sensitive data residing on the mobile device are encrypted using hardware elements of the mobile device (or the ASIC) together with the PIN hash and/or the Password hash. An obfuscated version of the Password, stored on the ASIC or the mobile device is de-obfuscated and released to the mobile device authentication mechanism, including a Trusted Platform Module if present, in response to a successfully decrypted template and matching biometric sample and PIN. A de-obfuscated password is used to authenticate the user to the mobile device and the same or a different de-obfuscated password may be used to authenticate the user to a remote computer using the SSL/TLS or a process based upon a symmetric encryption algorithm. The locally generated password may be used to encrypt data at rest on the mobile device or ASIC and the remote authentication password may be used to encrypt data in transit to and from a remote computer. This creates a trusted relationship between the stand-alone computer or mobile device and the remote computer. The system also eliminates the need for the user to remember and enter complex passwords on the mobile device or for secure transmission of data. A similar method may be used, with the signature/sign biometric modality to determine whether the holder of an IC chip card is, in fact the card owner.

主权项

1. A mobile device incorporating; a processor, memory, signed software, at least one sensor, capable of capturing biometric data and an ASIC, contained within or connected to said mobile device and dedicated to causing certain biometric authentication and encryption operations to take place: said mobile device incorporating signed software code, said signed software code incorporating: a means of capturing biometric signature/sign input from a human; a means of capturing biometric sensor input from a human; a means of acquiring PIN input from a human; a means of capturing password input from a human and a means of password authentication; said ASIC to incorporate a processor, a non-volatile storage area containing authentication parameters, at least one encrypted biometric template, credential information and an obfuscated password; said ASIC memory also containing a non-volatile software code storage unit containing software code; said code defining a method of generating a hardware ID from characteristics of hardware components: a method of obtaining a hashed PIN value by one of a) generating said hashed PIN value from said hardware ID and b) generating said hashed value from said PIN value entered on the mobile device; a method of obfuscating and de-obfuscating a password using said hashed value of said PIN and said hardware ID; a method of storing said obfuscated password in said memory of said ASIC; said ASIC software code capable of transforming biometric sample data to a consistent angle of inclination, biometrically enrolling and verifying the identity of mobile device users by matching the biometric samples captured from said biometric sensor with at least one biometric template stored in encrypted form in the said ASIC memory; a method of generating a template encryption key using at least said obfuscated password and said hashed PIN; a method of encrypting and decrypting said biometric template using said encryption key; a method of de-obfuscating said password and submitting it to one of the said mobile device authentication process, including a Trusted Platform Module and the server authentication process, in response to the successful decryption of the said biometric template and the successful matching of said biometric sample to said biometric template, thereby relieving the user of the need to enter a complex password for the purposes of mobile device access and encryption.