Automated computer biometric identity assurance

In a method of biometric identity assurance, biometric data based on a biometric modality is stored in a memory of a first computer. The biometric data is converted into a biometric template which is transferred from the first computer memory to a memory of a second computer. The second computer determines an encryption key based on a combination of the biometric template with a biometric-hash file of the user. Multiple credential files previously distributed among multiple remote computers are assembled into a single user credential file at the second computer. The first computer receives the encryption key and the user credential file from the second computer and accesses user credentials stored in the user credential file based on decryption of the user credential file using the encryption key. Via the thus accessed user credentials, the first computer uses or accesses one or more digital resources of the user.

BACKGROUND OF THE INVENTION

Traditional computer and database security is mostly comprised of antivirus and malware software, firewalls, sometimes encryption, and the problematic user name, password or personal identification number. Cybercrime succeeds when they steal an individual or companies log in credentials. Developed over 50 years ago, user name, password and personal identification number are no longer an adequate method to secure information or confidently identify an individual requesting access to protected information. As information migrates to the Internet, confidently determining who is really who and whether they are authorized to remotely access protected accounts becomes critical. Online, everyone is anonymous and, thus, liabilities are enormous.

SUMMARY OF THE INVENTION

This invention, the fully automated biometric identity assurance, privilege and credential management, and access control service (Identity Service) provides an innovative way to identify people in the virtual world by biometrically authenticating an individual in real time from any computing device and manages an individual or entire group's specific user credentials, privileges and permissions to all their restricted digital resources. Digital resources are the digital files and applications that are stored and used on computers and network servers and include, but are not limited to, document files, spreadsheet files, picture files, audio files, video files, word processing applications, spreadsheet applications, database applications, internet browser applications, websites, and web-based applications, etc. Restricted Digital Resources are the digital resources that have access controls where an individual must provide and present their credentials to be granted permission to use or access the resource. Credentials are the data that the individual must know or have in order to be granted permission to access the Restricted Digital Resources and can include, but is not limited to, user name, password, personal identification numbers, face, fingerprint, hand geometry, iris, signature, vascular, and voice, etc.

Biometric identification has been available to large government agencies for decades in the form of large, costly and classified databases. This invention combines this time tested identification method with the Identity and Authorization Exchange Hub, which is a collection of network server software programs that provide a complete set of services to implement the fully automated biometric identity assurance, privilege and credential management, and access control function. These software programs operate on a network server, able to communicate with other network servers and client computers using a secure cryptographic communications protocol, which provides numerous services including, but not limited to, system administration, user management, customer services, and credential management, etc.

Biometric identification is the method used to authenticate an individual's identity based on one or several of the individual's biometric modalities. A Biometric Modality is any measurable biological or behavioral characteristic used to uniquely identify an individual and includes, but is not limited to, face, fingerprint, hand geometry, iris, signature, vascular, and voice. The data collected or captured by a biometric modality measuring device is called the Biometric Data. An example of a Biometric Data file is the scanned image of an individual's fingerprint. A biometric modality measuring device includes, but is not limited to, cameras, scanners, touch screens, or microphones.

In order to allow for further processing, the Biometric Data is converted into a Biometric Template. For example, a Biometric Template for a fingerprint could be a two dimensional array indicating various spatial features of the fingerprint. The Biometric Template is used to create the Biometric-Hash File. The Biometric-Hash File is the data file constructed by combining the Biometric Template with the randomly generated User Encryption Key, used to encrypt the individual's credentials. The User Encryption Key is the random data string used to encrypt the User Credential File and is not permanently stored on any computer memory, internal or external.

More specifically, disclosed is a method of biometric identity assurance comprising: (a) storing in a memory of a first computer biometric data that is based on a biometric modality of a user acquired at a first time; (b) converting the biometric data of step (a) into a Biometric Template stored on the first computer memory; (c) receiving the Biometric Template in a memory of a second computer; (d) the second computer determining a first instance of a User Encryption Key based on a combination of the Biometric Template with a Biometric-Hash file of the user; (e) assembling multiple credential files that were previously distributed among multiple remote computers into a single User Credential File at the second computer, wherein each distributed credential file includes at least one credential of the user and the User Credential File includes multiple credentials of the user; (f) the first computer receiving the first instance of the User Encryption Key and the User Credential File from the second computer; (g) the first computer accessing user credentials stored in the User Credential File based on decryption of the User Credential File using the first instance of the User Encryption Key; and (h) the first computer using the user credentials accessed in step (g) to use or access one or more digital resources of the user.

Each digital resource can include one of the following: a document file, a spreadsheet file, a picture file, an audio file, a video file, a word processing application, a spreadsheet application, a database application, an internet browser application, a website, and a web-based application.

The Biometric Template can be a multi-dimensional array of data corresponding to the acquired biometric modality.

The Biometric-Hash File of the user can be generated by combining biometric data that is based on a biometric modality of a user acquired at a second time prior to the first time with a second instance of the User Encryption Key which is randomly generated prior to generating the first instance of a User Encryption Key in step (d).

Step (b) can further include deleting the biometric data from the first computer memory.

Step (c) can further include deleting the biometric template from the first computer memory.

Lastly, step (f) can further include deleting the first instance of the User Encryption Key and the User Credential File from the second computer.

DETAILED DESCRIPTION OF THE INVENTION

The present invention will be described with reference to the accompanying figures where like reference numbers correspond to like elements.

Functional Component Description

Referring toFIGS. 1A-1C, the functional block diagram shows three major groups of components, designated as the Identity and Authorization Exchange Hub105(hereinafter “Hub105”), the Administrator Computer System310, and the User Computer System340. Each of these three major component groups is fundamentally comprised of a general-purpose computer comprised of at least one processing element, typically a central processing unit (CPU), and some form of memory, whose size and capabilities make it useful for operating the specialized software programs described herein, and is able to interface with peripheral devices that allow information to be retrieved from an external source. Each group is comprised of machine and software components. These components are connected to each other using various human-to-machine, machine-to-machine, and software-to-machine interfaces. Examples of suitable computers include, but are not limited to, a desktop computer, a laptop computer, a notebook computer, a tablet computer, a held-hand computer, a mobile phone, or a smart phone device, etc.

Hub105is a network server, which is a computer designed to process requests and deliver data to other (client) computers over a computer network. Hub105hosts multiple services used in this invention including, but is not limited to, a Customer Ordering Service120; a Customer Billing and Payment Service130; a Customer Support Service140; an Identity and Authorization Exchange Server Application150; an Identity Enrollment Program Installer Service160; a Card, User, Privilege, and Credentialing Management Database Service170; an Identity Logon Verification Program Installer Service180; and Program Live Update Service190.

The Administrator Computer System310and the User Computer System340are human interface devices (HID), which are computers designed to provide people with a human-to-machine means of exchanging information, and are able to interface with peripheral devices that allow information to be retrieved from an external source including, but is not limited to, cameras, scanners, touch screens, microphones, smart card readers, or external memory devices (e.g., USB memory stick), etc.

These major component groups (105,310, and340) are connected to each other via a computer network. The computer network can be as small as a local area network or as large as the Internet. Each solid lined arrow that runs from one element to another element inFIG. 1represents a computer network or internet communication channel. Information communicated through each network or internet channel can be secured by a cryptographic communications protocol such as, but not limited to, the Transport Security Layer or the Secure Socket Layer of the Open Systems Interconnection (OSI) model.

A Customer110can be any type of group (e.g., business entities) or an individual desiring to fully automate biometric identity assurance, privilege and credential management, and access control services, whether using the secure identification system in its entirety or specific individual components only. Customer110can order products and services from a Customer Ordering Service120; set up, configure and automatically execute payment transactions from a Customer Billing and Payment Service130; and access product and service support from a Customer Support Service140. An Administrator290and the User330are members or a subset of the Customer110.

Customer Ordering Service120provides the capability to Customer110to determine their specific order requirements, to place their order for an Identity Enrollment Installation Kit300, an Identity Logon Verification Installation Kit340, and a Credentialing Management Database Service170, to pay for their order, and to receive the necessary information, hardware, and instructions to initiate their implementation of services via an Internet browser.

Customer Billing and Payment Service130provides the capability to extract information from Credentialing Management Database Service170in order to generate and send periodical customer billing information to Customer110and to collect and record periodical payments from Customer110.

Customer Support Service140provides a help desk function for a User330and Administrator290. The help desk function includes, but is not limited to, trouble-shooting software and hardware issues, training, and billing and account issues.

Identity and Authorization Exchange Server Application150manages and coordinates the activities of Customer Ordering Service120, Customer Billing and Payment Service130, Customer Support Service140, Identity Enrollment Program Installer Service160, Credentialing Management Database Service170, Identity Logon Verification Program Installer Service180, and Program Live Update Service190in order to effectively provide fully automated biometric identity assurance, privilege and credential management, and access control services.

Hereinafter, the suffix “A” following a reference number, e.g.,250-A, indicates that the referenced element is associated with Administrator Computer System310. Similarly, except as is expressly described herein, the suffix “U” following a reference number, e.g.,250-U, indicates that the referenced element is associated with User Computer System340.

Identity Enrollment Program Installer Service160provides the capability for Administrator290of the Customer110to transfer copies of an Identity Enrollment Program260-A, an Identity Logon Verification Program270-A, and a Biometric Data Converter Software280-A from Hub105to Administrative Computer System310using an Internet Web Browser220-A; and to activate and configure Credentialing Management Database Service170. Credentialing Management Database Service170manages Customer110information used to implement the automated biometric identity assurance, privilege and credential management, and access control services on Hub105. Customer110information includes, for each User380, but is not limited to, name user identification number, job title, employment status, authorized access list of restricted digital resources, and required credentialing information. A subset of Customer110information is a credential file for each User330. Each User credential file is a digital record of the User330credentials used to gain access to the User330Restricted Digital Resources, which includes, but is not limited to, user names, passwords, and personal identification numbers.

Credentialing Management Database Service170can store Customer110information on Hub105as a Customer110database. However, Credentialing Management Database Service170can store each User credential file on either Hub105, or disassemble and distribute the file to multiple Credentialing Servers350for more secure storage. Credentialing Management Database Service170, when requested, can retrieve and re-assemble each individual User Credential File stored on multiple Credentialing Servers350. In either storage location (Hub150or multiple Credentialing Servers350), each User Credential File is stored as an encrypted file.

Credentialing Management Database Service170can be accessed using a network or Internet connection using a secure cryptographic communications protocol by Identity Enrollment Programs260-A and260-U and Identity Logon Verification Programs270-A and270-U. The Customer110database stored on Credentialing Management Database Service170is also configurable by the Administrator290using the Identity Enrollment Program260-A.

The Identity Logon Verification Program Installer Service180provides the capability for Administrator290to transfer copies of the Identity Logon Verification Programs270-A and270-U, and the Biometric Data Converter Software280-A and280-U to Computers250-A and250-U from Hub105, using Internet Web Browser220-A and220-U.

Program Live Update Service190provides the capability to each of Administrator290and User330to manually or automatically update the Identity Enrollment Programs260-A and260-U or the Identity Logon Verification Programs270-A and270-U on Computers250-A and250-U through the computer network.

The Biometric Software Programs200-A and200-U are software applications residing on Biometric Storage Devices210-A and210-U of Administrator Computer System310and User Computer System340, respectively. These applications can re-generate a User Encryption Key used to encrypt the User Credential File of each User330by merging a Biometric Template with a Biometric-Hash File stored on Biometric Storage Devices210-A and210-U. Also or alternatively, a Biometric Software Program200-S can reside and operate on Hub105.

The Biometric Storage Devices210-A and210-U provide the capability of storing a Biometric-Hash File and executing the Biometric Software Programs200-A and200-U, and are each comprised of at least one processing element, and some form of memory (RAM, ROM, etc.). The Biometric Storage Devices210-A and210-U can be, but are not limited to, smart cards, memory sticks, or thumb drives. Also or alternatively, Biometric Storage Device's210-A and/or210-U functionality can be moved to Identity and Authorization Exchange Hub105by storing the corresponding Biometric-Hash File in Hub's105internal memory.

Internet Web Browsers220-A and220-U are software applications for retrieving, presenting, and transferring informational resources on the Internet, World Wide Web, private network servers, and file systems. These software applications reside and run on Computers250-A and250-U and provide the capability to access Hub105in order to access and use its services.

Biometric Data Input Devices230-A and230-U provide the capability to capture and record in a biometric data file unique biometric modalities of Administrator290and User330such as, but not limited to, face, fingerprint, hand geometry, iris, signature, vascular, and voice. The biometric data file recorded by Devices230-A and230-U are sent to corresponding Biometric Data Converter Software280-A and280-U to be analyzed and converted into a compressed file format, i.e., a Biometric Template.

Biometric Data Input & Storage Interfaces240-A and240-U provide the capability to allow Biometric Software Programs200-A and200-U, Biometric Storage Devices210-A and210-U, Biometric Data Input Devices230-A and230-U to communicate with Identity Enrollment Programs260-A and260-U, Identity Logon Verification Programs270-A and270-U, and/or Biometric Data Converter Software280-A and280-U running on Computers250-A and250-U, respectively. Biometric Data Input & Storage Interfaces240-A and240-U and Biometric Data Input Devices230-A and230-U, respectively, can be integrated into a single physical device.

Each Computer250-A and250-U can be a general-purpose computer comprised of at least one processing element, such as a central processing unit (CPU), and memory (RAM, ROM, and/or any other suitable and/or desirable computer memory known in the art), whose size and capabilities make it useful for Administrator290and/or User330, and are intended to be operated directly by Administrator290or User330with no intervening computer operator. Peripheral devices allow information to be retrieved from one or more external sources, and the result of operations saved and retrieved. Examples of Computers250-A and250-U include, but are not limited to, desktop computers, laptop computers, notebook computers, tablet computers, hand-held computers, mobile phones, or smart phone devices, etc.

Identity Enrollment Programs260-A and260-U provide the capability to configure and manage Credentialing Management Database Service170, to add and enroll new Users330or new Administrators290into the database stored on Credentialing Management Database Service170, to modify and change existing information in the database, to create and issue new Biometric Storage Devices210-A and210-U, and/or modify or change existing Biometric Storage Devices210-A and210-U. Identity Enrollment Programs260-A and260-U also provide the capability to manage the collection and conversion of raw biometric data, and transfer Biometric-Hash Files to Biometric Storage Devices210-A and210-U. Identity Enrollment Programs260-A and260-U also provide the capability to generate audit reports on User330and Administrator290activities, such as, but not limited to, log in times, Computers250-A and250-U identities, privileges and credentials accessed, and log off times.

Identity Logon Verification Programs270-A and270-U are operative for requesting Administrator290and User330to provide their respective Biometric Modalities to Biometric Data Input Devices230-A and230-U, respectively. The collected Biometric Modalities are submitted to the Biometric Data Converter Software Programs280-A and280-U where the collected Biometric Modalities are converted into Biometric Templates for Administrator290and User330, respectively. These Biometric Templates are then stored in Biometric Storage Devices210-A and210-U where Biometric Software Programs200-A and200-U can re-generate the User Encryption Keys by merging the Biometric Templates with the stored Biometric-Hash Files, respectively.

Identity Logon Verification Programs270-A and270-U send requests to Credentialing Management Database Service170to retrieve the User330Credential Files. Once received, Identity Logon Verification Programs270-A and270-U decrypt the User330Credential Files using the User Encryption Keys, and presents the Administrator290and User330credentials to the Restricted Digital Resource software to activate access.

Biometric Data Conversion Software Programs280-A and280-U can convert Biometric Data collected from Biometric Data Input Devices230-A and230-U into Biometric Templates that can be used to generate Administrator290and/or User330Biometric-Hash File(s) during the registration process or re-generate the Encryption Key during the authorized access process.

Administrator290is responsible for the maintenance of computer hardware and software of Customer110that comprises a computer network. This normally includes deploying, configuring, maintaining, and monitoring active network equipment.

Identity Enrollment Installation Kit300includes the necessary information, hardware, and software to set up Administrator290, Administrator Computer System310in order to initialize the fully automated biometric identity assurance, privilege and credential management, and access control services at the Customer110facility.

The User330is an individual whom Administrator290enrolls into the secure identification system which provides the biometric identity assurance, privilege and credential management, and access control services.

Identity Logon Verification Installation Kit345includes the necessary information, hardware, and software to set up User Computer System340in order to implement the fully automated biometric identity assurance, privilege and credential management, and access control services.

Each Credentialing Server350is a network server used by Credentialing Management Database Service170to store portions of a User Credential File.

Credentialing Server360is a collection of multiple Credentialing Servers350used by Credentialing Management Database Service170to store different portions of the User Credential File at different Credentialing Servers350.

Functional Description

The fully automated biometric identity assurance, privilege and credential management, and access control services (Identity Services) are implemented from Hub105running multiple service and application software programs. These services or applications include, but are not limited to, Customer Ordering Service120; Customer Billing and Payment Service130; Customer Support Service140; Identity and Authorization Exchange Server Application150; Identity Enrollment Program Installer Server160; Credentialing Management Database Service170; Identity Logon Verification Program Installer Service180, and Program Live Update Service190.

Customer110can fully access these services and applications from the Internet after the delivery of required hardware components of the secure identification system. The Identity Services are implemented by converting a User330unique Biometric Modality (e.g., fingerprint) into a Biometric Template that can be used either to generate a Biometric-Hash File which is stored on Biometric Storage Device210-U, (e.g., smart card) or used to re-generate the User Encryption Key from the Biometric-Hash File. The User330identity is verified if the correct User Encryption Key is re-generated that allows for granting access to User330Restricted Digital Resources. Access control is governed by Credentialing Management Database Service170which includes the User330personal information, the User330credentials and permissions, and the Restricted Digital Resources authorized for use by the customer Administrator290. Administrator290can manage and change the User330privileges and credentials in real time by accessing the specific customer database, which is accessed every time an individual attempts to access the Restricted Digital Resources.

A smart card is used as an example of each Biometric Storage Device210-A and210-U; and an integrated smart card reader and fingerprint scanner device is an example of each Biometric Data Input Devices230-A and230-U, and Biometric Data Input & Storage Interfaces240-A and240-U combined into respective single physical device, e.g., one device includes Biometric Data Input Device230-A and Biometric Data Input & Storage Interface240-A, and another device includes Biometric Data Input Device230-U and Biometric Data Input & Storage Interface240-U. The following paragraphs describe the process to implement the secure identity system and how the overall system operates.

After Customer110places an order for the Identity Services, Administrator290of Customer110receives the Identity Enrollment Installation Kit300as ordered by Customer110from Hub105using the Customer Ordering Service120. This kit contains at least two integrated smart card reader and fingerprint scanner devices230-A and230-U with their own device driver software, one generic administration smart card210-A, one set of instructions, and any number of blank smart cards210-U ordered. Administrator290connects the two scanner devices230-A and230-U to Computer250-A via two interface ports (e.g., USB ports) and installs the scanner device drivers on computer250-A as necessary.

Administrator290, via Computer250-A and Internet Web Browser220-A, connects to Hub105, logs into a new customer enrollment page at Hub105, inserts generic administrator smart card210-A into smart card reader and scanner device230-A as requested, and initiates Identity Enrollment Program Installer Service160residing on Hub105to download to Administrator Computer System310from Hub105Identity Enrollment Program260-A, Identity Logon Verification Program270-A, and Biometric Data Converter Unit280-A for use by Computer250-A.

Identity Enrollment Program Installer Service160creates a customer specific database using Credentialing Management Database Service170from information provided by Administrator290during an initial enrollment process. This database is hosted on Hub105and is accessible by Identity Enrollment Program260-A or260-U and Identity Logon Verification Program270-A or260-U running on computers250-A and250-U, respectively.

Administrator290removes and re-inserts the generic administrator smart card210-A from and to scanner device230-A to launch Identity Logon Verification Program270-A and Identity Enrollment Program260-A via Identity Enrollment Program260-A. Administrator290enrolls himself to create a unique smart card210-U with the Administrator290stored Biometric-Hash File by inserting a blank smart card210-U into the second connected card reader and scanner device230-U. Administrator290can further configure the customer specific database as necessary before creating smart card210-U for the first User330.

To enroll each User330and create a unique smart card210-U for said User330, the Administrator290inserts smart card210-A, including Administrator290enrollment privilege and credential, into the first device210-A attached to Computer250-A, and provides his unique Biometric Modality to activate Identity Enrollment Program260-A. After selecting the add new user option of Identity Enrollment Program260-A, Administrator290inserts a blank smart card210-U into the second device230-U attached to Computer250-A, enters the new User330information including, but not limited to, his permitted privileges and credentials.

Next, via Identity Enrollment Program260-A, Administrator290collects the required Biometric Data from User330to create a Biometric Template for the User, which is merged with a randomly generated User Encryption Key to generate a Biometric-Hash File for the User which is stored on the smart card210-U. The User Encryption Key is used to encrypt a User Credential File which is stored either on Hub105or across multiple Credentialing Servers350. This process is repeated for every new User330enrolled.

Next, Administrator290disconnects smart card reader and scanner device230-U from Computer250-A, connects smart card reader and scanner device230-U to the Computer250-U, and installs device drivers on Computer250-A as necessary.

Via User Computer250-U and Internet Web Browser220-U, administrator290securely connects to Hub105and initiates Identity Logon Verification Program Installer Service180to download Identity Logon Verification Program270-U and Biometric Data Converter Software280-U into Computer250-U.

Next, User330inserts his enrolled smart card210-U into device230-U to activate Identity Logon Verification Program270-U on Computer250-U to activate User's unique privileges and credentials as stored in the User specific database for User330hosted by Credentialing Management Database Service170on Hub105, or stored across multiple Credentialing Servers350and re-assembled by Credentialing Management Database Service170.

Administrator290via Identity Enrollment Program260-A can change the information in User330customer specific database in real-time and expect the changes to be implemented on the next User330access transaction.

Program Live Update Service190can manually or automatically update Identity Enrollment Programs260-A and260-U and Identity Logon Verification Programs270-A and270-U from Hub105.

Customer Billing and Payment Service130provides a monthly service usage report, a monthly billing statement, and automatic payment method for Customer110.

First Embodiment Flow Chart

Smart Card Stored Biometric with Credentials Stored on Multiple Servers

Referring now to the flow diagram shown in.FIGS. 2A-2Dand with continuing reference toFIGS. 1A-1C, at510, User330launches Identity Logon Verification Program270-U by inserting his unique pre-configured smart card210-U into Biometric Data Input Device230-U. Each smart card210includes an embedded microchip that can store programs and data and execute the stored programs, such as the User's Biometric-Hash File and Biometric Software Program200-U, in the form of a smart card reader

Identity Logon Verification Program270-U provides an extremely strong and secure sign-on function by requiring User330to provide one or multiple biometric modalities and distributing User330credentials among credentialing servers350interconnected by a communication network using a secure cryptographic communications protocol.

At520, Identity Logon Verification Program270-U responds to the insertion of smart card210-U into Biometric Data Input Device230-U by providing a graphical user interface on a display of computer250-U requesting User330to enter one or more Biometric Modalities (depending on the Administrator290requirements) using Biometric Data Input Device230-U. Computer250-U converts the entered one or more Biometric Modalities into User's350Biometric Data.

Depending on Computer250-U, capabilities or additional biometric capturing devices attached, these Biometric Modalities can include, but are not limited to, face, fingerprint, hand geometry, iris, signature, vascular, and voice. Identity Logon Verification Program270-U does not permanently store or save the User330Biometric Data on the Computer250-U, smart card reader230-U, or smart card210-U.

At530, Identity Logon Verification Program270-U determines if the User330Biometric Data was successfully captured and temporarily stores this Biometric Data on Computer250-U internal memory.

At540, if the User330Biometric Data was not successfully captured in step530, Identity Logon Verification Program270-U will make additional request to User330to re-submit his Biometric Modalities. Identity Logon Verification Program270-U is pre-configured to make this request n-number of times before reporting User330failure to the Administrator290and automatically disabling User330ability to use Identity Logon Verification Program270-U until intervention by Administrator290.

At550, Identity Logon Verification Program270-U determines if the additional request exceeds the counter or not. If not, flow returns to step520. Otherwise, flow advances to step570where Identity Logon Verification Program270-U sends an event log to Hub105and terminates User330session.

If, in step530, the User330Biometric Data was successfully captured and stored, at560, Biometric Data Converter Software Program280-U converts the captured User330Biometric Data into User330Biometric Template, temporarily stores the User330Biometric Template in Computer250-U internal memory, and deletes the User's Biometric Data from Computer250-U internal memory.

At580, Identity Logon Verification Program270-U sends the Biometric Template to the Biometric Software Program200-U that resides on smart card210-U and sends a request for the User Credential File of User330to Hub105.

At590, Identity Logon Verification Program270-U deletes the User330Biometric Template from Computer250-U internal memory, whereupon the User Biometric Template now only resides on smart card210-U.

At600, Biometric Software Program200-U merges the Biometric Template residing on smart card210-U with the Biometric-Hash File previously stored on smart card210-U to re-generate the User Encryption Key that was used to initially encrypt the User Credential File for the User's Restricted Digital Resources.

By way of background, the User's Biometric-Hash File stored on smart card210-U is generated by combining the User330Biometric Template with User Encryption Key during User330registration. The User Encryption Key is randomly generated by Computer250-U when the User's Restricted Digital Resource credentials are registered and configured by Hub105. Recall that Restricted Digital Resources are digital resources that have access controls where a User must provide and present their credentials to be granted permission to use or access the resource.

At610, Hub105, in response to a request for the User Credential File by Identity Logon Verification Program270-U, assembles the previously distributed, encrypted user credential files from multiple Credentialing Servers350into a single, encrypted User Credential File. The User Credential File is the complete collection of credentials used by User330to access his complete set of Restricted Digital Resources. Recall that User Credentials are data that the User must know or have in order to be granted permission to access the User's Restricted Digital Resource(s) and can include, but is not limited to, user name, password, personal identification numbers, face, fingerprint, hand geometry, iris, signature, vascular, and voice, etc.

At630, Biometric Software Program200-U residing on smart card210-U sends the encrypted User Encryption Key re-generated in step600to Identity Logon Verification Program270-U.

At640, the encrypted User Credential File re-generated in step610is sent from Hub105to Identity Logon Verification Program270-U.

At650, Biometric Software Program200-U running on smart card210-U deletes the Biometric Template and the User Encryption Key from smart card210-U.

At660, Identity Logon Verification Program270-U using the User Encryption Key decrypts the User Credential File to obtain the User's credentials and presents the User's credentials to one or more of the User's requested Restricted Digital Resource to gain access or retrieve the same.

At670, the User Credential Files, partial and complete, are deleted from the memory of the network server hosting Hub105.

At680, Identity Logon Verification Program270-U presents a menu to User330listing the complete list of Restricted Digital Resources, and User330selects a desired Restricted Digital Resource.

At690, in response to User330selecting the desired Restricted Digital Resource, Identity Logon Verification Program270-U activates the selected Restricted Digital Resource and enters the User330credentials in order to gain access to said Restricted Digital Resource. The activation process implemented and executed by the Identity Logon Verification Program270-U includes, but is not limited to: launching the Internet Web Browser220-U, entering the Restricted Digital Resource URL address, navigating to the logon webpage, and entering the User330user name, password or personal identification number; or launching the application, and entering the User330user name, password or personal identification number.

At700, if access is not granted to the selected Restricted Digital Resource because the correct User Encryption Key was not generated, then the Biometric Software Program200-U is directed to request the User330Biometric Modalities again up to x-times.

At705, if the Identity Logon Verification Program270fails to grant access to a User330Restricted Digital Resource, the Identity Logon Verification Program270-U will make additional requests to the User330to re-submit his Biometric Modalities. The Identity Logon Verification Program270-U is pre-configured to make this request x-number of times before reporting the User330failure to the Administrator290and automatically disabling the User330ability to use the Identity Logon Verification Program270-U until intervention by the Administrator290.

At710, the Identity Logon Verification Program270-U attempts to access or logon to the User330desired Restricted Digital Resource, and records if the access was successful or not.

At720, if the decrypted User Credentials fail to grant access to the User330Restricted Digital Resource after x-times, then the Identity Logon Verification Program270-U sends an event log to Hub105, which notifies the Administrator290of the failure and terminates the session.

At730, if the decrypted User Credentials succeed in granting access to the User Restricted Digital Resource, then the Identity Logon Verification Program270-U sends an event log to Hub105.

At740, the Identity Logon Verification Program270-U pauses, while the User330uses his Restricted Digital Resource.

At750, after using the Restricted Digital Resource, the User330decides to terminate or pause use of the Restricted Digital Resource.

At760, the User330decides to return to the Identity Logon Verification Program270-U menu to activate another Restricted Digital Resource or not. If not, flow returns to step680. Otherwise, flow advances to step770.

At770, the User330decides to either manually terminate the Restricted Digital Resources (e.g., log-off) and removes the smart card210-U from the smart card reader230-U to terminate the Identity Logon Verification Program270-U, or removes the smart card210-U from the smart card reader230-U to terminate the Identity Logon Verification Program270-U and automatically terminates access to the Restricted Digital Resources.

Second Embodiment Flow Chart

Server Stored Biometric with Credentials Stored on Multiple Servers

The second embodiment differs from the first embodiment by the absence or removal of the Biometric Storage Devices210-A and210-U including the internally stored Biometric-Hash File and Biometric Software Programs200-A and200-U, and the addition of Biometric Software Program200-S residing and operating on Hub105.

Referring toFIGS. 3A-3Dand with ongoing reference toFIGS. 1A-1C, at1010, User330operates Computer250-U to launch Identity Logon Verification Program270-U by either clicking on an associated screen icon displayed on a display of Computer250-U that is linked to the software executable file or other means to activate the software executable file.

Identity Logon Verification Program270-U provides an extremely strong and secure sign-on function by requiring User330to provide one or more biometric modalities and distributing User330credentials among multiple credentialing servers350interconnected by a communication network using a secure cryptographic communications protocol.

At1020, in response to step1010, Identity Logon Verification Program270-U provides a graphical user interface on Computer250-U requesting User330to submit one or multiple Biometric Modalities (depending on the Administrator290requirements) using the Biometric Data Input Device230-U.

Depending on Computer250-U, capabilities or additional biometric capturing devices attached, these Biometric Modalities can include, but are not limited to, face, fingerprint, hand geometry, iris, signature, vascular, and/or voice. Identity Logon Verification Program270-U does not permanently store or save User330Biometric Data on Computer250-U. Computer250-U converts the entered Biometric Modality or Modalities into User330Biometric Data.

At1030, Identity Logon Verification Program270-U determines if the User330Biometric Data was successfully captured and temporarily stores the User's Biometric Data on Computer250-U internal memory.

At1040, if User330Biometric Data was not successfully captured, Identity Logon Verification Program270-U will make additional requests to User330to re-submit his one or more Biometric Modalities. Identity Logon Verification Program270-U is pre-configured to make this request n-number of times before reporting User330failure to the Administrator290and automatically disabling User330ability to use Identity Logon Verification Program270-U until intervention by Administrator290.

At1050, Identity Logon Verification Program270-U determines if the additional request exceeds the counter or not. If not, flow returns to step1020. Otherwise, flow advances to step1070where Identity Logon Verification Program270-U sends the event log to Hub105and terminates User330session.

If, in step1030, the User's300Biometric Data was successfully captured and stored, at1060, Biometric Data Converter Software Program280-U converts the captured User's Biometric Data into a User's Biometric Template, temporarily stores the User's Biometric Template in Computer250-U internal memory, and deletes the Biometric Data from the Computer250-U internal memory.

At1080, Identity Logon Verification Program270-U sends the User's Biometric Template to Biometric Software Program200-S on Hub105and sends a request for the User Credential File to Hub105. Recall in this second embodiment that Biometric Software Programs200-A and200-U and Biometric-Hash Files stored on Biometric Storage Devices210-U and210-A in the first embodiment, have been relocated in this second embodiment to Hub105, and that Biometric Storage Devices210-A and210-U are no longer part of Administrator Computer System310and User Computer System340.

At1090, Identity Logon Verification Program270-U deletes the User's Biometric Template from Computer250-U internal memory.

At1100, Biometric Software Program200-S merges the User's Biometric Template from Identity Logon Verification Program270-U with the User's Biometric-Hash File previously stored on Hub105to re-generate the User Encryption Key used to encrypt the User Credential File for Restricted Digital Resources.

In this embodiment, the User's Biometric-Hash File is generated by combining the User330Biometric Template with the User's Encryption Key during the User330registration process. The same User Biometric Modality or Modalities are utilized to create the User's Biometric Templates during User registration and when the User wishes to access the User's Restricted Digital Resource(s). The User's Encryption Key is randomly generated by computer250-U when User's Restricted Digital Resource credentials are registered and configured by Hub105.

At1110, Hub105, in response to a request for the User Credential File by Identity Logon Verification Program270-U, assembles the previously distributed, encrypted User Credential File from multiple Credentialing Servers350into a single, encrypted User Credential File. The User Credential File is the complete collection of credentials used by the User330to access his complete set of Restricted Digital Resources.

At1130, the Biometric Software Program200-S sends the User Encryption Key re-generated in step1100to the Identity Logon Verification Program270-U.

At1140, the encrypted User Credential File re-generated in step1110is sent from Hub105to the Identity Logon Verification Program270-U.

At1150, the Biometric Template and User Encryption Key are deleted from Hub105memory.

At1160, the Identity Logon Verification Program270-U using the User Encryption Key decrypts the User Credential File for his Restricted Digital Resources and presents the User's credentials to one or more of the User's requested Restricted Digital Resource to gain access or retrieve the same.

At1170, the User Credential Files, partial and complete, are deleted from the memory of the network server hosting Hub105.

At1180, Identity Logon Verification Program270-U presents a menu to User330listing the complete list of Restricted Digital Resources, and User330selects a desired Restricted Digital Resource.

At1190, in response to selecting the desired Restricted Digital Resource Identity Logon Verification Program270-U activates the selected Restricted Digital Resource and enters the User330credentials in order to gain access to said Restricted Digital Resource. The activation process implemented and executed by the Identity Logon Verification Program270-U includes, but is not limited to: launching Internet Web Browser220-U, entering the Restricted Digital Resource URL address, navigating to the logon webpage, and entering the User330user name, password or personal identification number; or launching the application, and entering the User330user name, password or personal identification number.

At1200, if access is not granted to the selected Restricted Digital Resource because the correct User Encryption Key was not generated, then the Identity Logon Verification Program270-U is directed to request the User330Biometric Modalities again up to x-times.

At1205, if the Identity Logon Verification Program270-U fails to grant access to a User330Restricted Digital Resource, the Identity Logon Verification Program270-U will make additional requests to the User330to re-submit his Biometric Modalities. The Identity Logon Verification Program270-U is pre-configured to make this request x-number of times before reporting the User330failure to the Administrator290and automatically disabling the User330ability to use the Identity Logon Verification Program270-U until intervention by the Administrator290.

At1210, the Identity Logon Verification Program270-U attempts to access or logon to the User330desired Restricted Digital Resource, and records if the access was successful or not.

At1220, if the decrypted User Credentials fail to grant access to the User330Restricted Digital Resource after x-times, then the Identity Logon Verification Program270-U sends an event log to Hub105, which notifies the Administrator290of the failure and terminates the session.

At1230, if the decrypted User Credentials succeed in granting access to the User Restricted Digital Resource, then the Identity Logon Verification Program270-U sends an event log to Hub105.

At1240, the Identity Logon Verification Program270-U pauses, while the User330uses his Restricted Digital Resource.

At1250, after using the Restricted Digital Resource, the User330decides to terminate or pause use of the Restricted Digital Resource.

At1260, the User330decides to return to the Identity Logon Verification Program270-U menu to activate another Restricted Digital Resource or not. If not, flow returns to step1180. Otherwise, flow advances to step1270.

At1270, the User330decides to either (1) manually terminate the Restricted Digital Resources (e.g., log-off) and terminates the Identity Logon Verification Program270-U or (2) terminates the Identity Logon Verification Program270-U, which automatically terminates the Restricted Digital Resources.

The present invention has been described with reference to the accompanying figures. Obvious modifications and alterations will occur to others upon reading and understanding the preceding detailed description. It is intended that the invention be construed as including all such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.