Patent Description:
The disclosed subject matter relates to methods, systems, and media for authenticating users using biometric signatures.

People often want to connect to networks, such as a local area network or a wide area network with their user devices. In some facilities, this may require entering information, accepting an agreement, verifying the user's identity, etc. However, this process may not be secure, for example, in a public facility.

Accordingly, it is desirable to provide new methods, systems, and media for authenticating users using biometric signatures.

According to its abstract, <CIT> describes a biometric authentication system which may include a centralized database including stored biometric signature information for authenticating a user of one or more external systems.

According to its abstract, <CIT> describes recording a user's biometric features and generating an identifier representative of the user's biometric features using mobile device such as a smartphone. The systems and methods described are said to enable a series of operations whereby a user using a mobile device can capture imagery of a user's face, eyes and periocular region.

According to its abstract, <CIT> describes authorizing a user to access an access-controlled environment. The system includes a system server platform that communicates with mobile devices (e.g., smartphones) and on-board vehicle computing devices accessed by users. A series of operations is described whereby a user accessing a vehicle is prompted to biometrically authenticate using the user's smartphone or on-board vehicle computer.

According to its abstract, <CIT> describes system and method for authentication a user's identity via biometrics is disclosed. The system includes client software, an authentication server, and an independent biometric services server.

Advantageous features are described in the dependent claims. Methods, systems, and media for authenticating users using biometric signatures are provided. In accordance with some embodiments of the disclosed subject matter, methods for authenticating users using biometric signatures are provided, the methods comprising: receiving, from a user device, an indication that the user device is to be connected to a communication network; in response to receiving the indication, causing a user interface to be presented on the user device that receives a username corresponding to a user of the user device; receiving, from the user device, a biometric sample corresponding to the user of the user device; determining whether the biometric sample matches a stored biometric sample associated with the username; and in response to determining that the biometric sample matches the stored biometric sample associated with the user name, causing the user device to be connected to the communication network.

In accordance with some embodiments of the disclosed subject matter, systems for authenticating users using biometric signatures are provided, the systems comprising: a hardware processor that is programmed to: receive, from a user device, an indication that the user device is to be connected to a communication network; in response to receiving the indication, cause a user interface to be presented on the user device that receives a username corresponding to a user of the user device; receive, from the user device, a biometric sample corresponding to the user of the user device; determine whether the biometric sample matches a stored biometric sample associated with the username; and in response to determining that the biometric sample matches the stored biometric sample associated with the user name, cause the user device to be connected to the communication network.

In accordance with some embodiments of the disclosed subject matter, non-transitory computer-readable media containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for authenticating users using biometric signatures, the method comprising: receiving, from a user device, an indication that the user device is to be connected to a communication network; in response to receiving the indication, causing a user interface to be presented on the user device that receives a username corresponding to a user of the user device; receiving, from the user device, a biometric sample corresponding to the user of the user device; determining whether the biometric sample matches a stored biometric sample associated with the username; and in response to determining that the biometric sample matches the stored biometric sample associated with the user name, causing the user device to be connected to the communication network.

In accordance with various embodiments, mechanisms (which can include methods, systems, and media) for authenticating users using biometric signatures are provided.

In some embodiments, the mechanisms described herein can grant a user access to a network, such as a Local Area Network (LAN) or Wide Area Network (WAN) by authenticating the user using a biometric signatures. In some embodiments, a user can connect a user device to the network, such as through a Wi-Fi Hotspot, and can be presented with a user interface via a program or application (e.g., a Captive Portal program, and/or any other suitable program or application). The user interface can receive a username associated with the user and a biometric signature (e.g., a fingerprint, a voice signature, and/or any other suitable biometric signature) and can validate the username and the biometric signature. If the username and the biometric signature are determined to be valid, the mechanisms can allow the user device to connect to the network.

In some embodiments, the mechanisms can allow a user to create a new username and store a corresponding biometric signature for later use. For example, in some embodiments, the user can create the new username and store the biometric signature to be later used to log in to a LAN or WAN. In some embodiments, the mechanisms can receive a new username and can authenticate the user device that transmitted the new username by transmitting, from a sign-on server, a passcode to a user device and requesting that a user of the user device transmit the passcode back to the sign-on server for validation. In some embodiments, if the passcode is validated, the mechanisms can receive a biometric signature from the user of the user device for storage on the sign-in server and for future use.

Turning to <FIG>, an example <NUM> of hardware for authenticating users using biometric signatures in accordance with some embodiments of the disclosed subject matter is shown. As illustrated, hardware <NUM> can include a sign-on server <NUM>, a communication network <NUM>, and user devices <NUM> and/or <NUM>.

Sign-on server <NUM> can be any suitable server for storing user information and authenticating a user to a network based on the user information. For example, in some embodiments, sign-on server <NUM> can store a username corresponding to a user account to be used for authentication to the network, biometric signatures corresponding to the username, and/or any other suitable information. As another example, in some embodiments, sign-on server <NUM> can receive a biometric signature from a user of a user device and can compare the received biometric signature to a biometric signature sample to authenticate the user of the user device to a network, as described below in more detail in connection with <FIG>.

Communication network <NUM> can be any suitable combination of one or more wired and/or wireless networks in some embodiments. For example, communication network <NUM> can include any one or more of the Internet, a mobile data network, a satellite network, a LAN, a WAN, a telephone network, a cable television network, a Wi-Fi network, a WiMax network, and/or any other suitable communication network.

User devices <NUM> and/or <NUM> can be any suitable user devices for transmitting a biometric signature, being authenticated to a network, and/or performing any other suitable functions. In some embodiments, user devices <NUM> and/or <NUM> can include mobile devices (e.g., a mobile phone, a laptop computer, a wearable computer, and/or any other suitable mobile device) and/or non-mobile devices (e.g., a desktop computer, a smart television, and/or any other suitable non-mobile devices).

Although only one server <NUM> is shown in <FIG> to avoid over-complicating the figure, any suitable number of servers can be used in some embodiments.

Sign-on server <NUM> and user devices <NUM> and <NUM> can be implemented using any suitable hardware in some embodiments. For example, in some embodiments, devices <NUM>, <NUM>, and <NUM> can be implemented using any suitable general purpose computer or special purpose computer. For example, sign-on server <NUM> may be implemented using a special purpose computer. Any such general purpose computer or special purpose computer can include any suitable hardware. For example, as illustrated in example hardware <NUM> of <FIG>, such hardware can include hardware processor <NUM>, memory and/or storage <NUM>, an input device controller <NUM>, an input device <NUM>, display/audio drivers <NUM>, display and audio output circuitry <NUM>, communication interface(s) <NUM>, an antenna <NUM>, and a bus <NUM>.

Hardware processor <NUM> can include any suitable hardware processor, such as a microprocessor, a micro-controller, digital signal processor(s), dedicated logic, and/or any other suitable circuitry for controlling the functioning of a general purpose computer or a special purpose computer in some embodiments.

Memory and/or storage <NUM> can be any suitable memory and/or storage for storing programs, data, media content, and/or any other suitable information in some embodiments. For example, memory and/or storage <NUM> can include random access memory, read-only memory, flash memory, hard disk storage, optical media, and/or any other suitable memory.

Input device controller <NUM> can be any suitable circuitry for controlling and receiving input from a device, such as input device <NUM>, in some embodiments. For example, input device controller <NUM> can be circuitry for receiving input from an input device <NUM>, such as a touch screen, from one or more buttons, from a voice recognition circuit, from a microphone, from a camera, from an optical sensor, from an accelerometer, from a temperature sensor, from a near field sensor, and/or any other type of input device.

Display/audio drivers <NUM> can be any suitable circuitry for controlling and driving output to one or more display/audio output circuitries <NUM> in some embodiments. For example, display/audio drivers <NUM> can be circuitry for driving an LCD display, a speaker, an LED, or any other type of output device.

Communication interface(s) <NUM> can be any suitable circuitry for interfacing with one or more communication networks, such as network <NUM> as shown in <FIG>. For example, interface(s) <NUM> can include network interface card circuitry, wireless communication circuitry, and/or any other suitable type of communication network circuitry.

Antenna <NUM> can be any suitable one or more antennas for wirelessly communicating with a communication network in some embodiments. In some embodiments, antenna <NUM> can be omitted when not needed.

Any other suitable components can be included in hardware <NUM> in accordance with some embodiments.

Turning to <FIG>, an example <NUM> of a process for granting access to a LAN and/or a WAN using biometric signature validation is shown in accordance with some embodiments of the disclosed subject matter.

Process <NUM> can begin at <NUM> and can receive a username corresponding to a user at <NUM>. The username can be received in any suitable manner, for example, via a user interface. An example of a user interface for entering a username is user interface <NUM> of <FIG>. As illustrated, user interface <NUM> can include a text entry input <NUM>, which can receive text corresponding to the user name, and a sign in input <NUM>, which can cause the entered username to be transmitted to sign-on server <NUM>.

Process <NUM> can validate the username at <NUM>, for example, by determining whether the username exists. As a more particular example, in some embodiments, process <NUM> can determine whether the username is included in a database of valid usernames (e.g., corresponding to users who have already selected usernames, and/or any other suitable valid usernames). Based on <NUM>, process <NUM> can then determine if the username is valid at <NUM>.

If, at <NUM>, process <NUM> determines that the username is valid ("yes" at <NUM>), process <NUM> can proceed to block <NUM> and can receive a biometric signature from a user of the user device. In some embodiments, the biometric signature can include any suitable biometric data, such as a fingerprint, retinal scan data, a voice signature, and/or any other suitable type of biometric data. In some embodiments, process <NUM> can cause a user interface to be presented on the user device that receives the biometric data. For example, in some embodiments, process <NUM> can cause a user interface that includes a touchscreen for receiving a fingerprint to be presented on the user device. In some embodiments, the user interface can include any suitable instructions for instructing the user to submit the biometric signature.

Process <NUM> can validate the biometric signature at <NUM> and can determine at <NUM> if the biometric signature is valid. Process <NUM> can validate the biometric signature in any suitable manner and using any suitable technique or combination of techniques. For example, in some embodiments, process <NUM> can compare a sample of the biometric signature received at block <NUM> to a biometric sample stored in a database in association with the validated username. As a more particular example, in some embodiments, process <NUM> can compare a portion of the received biometric signature to the biometric sample. As a specific example, in instances where the biometric signature includes a fingerprint, process <NUM> can compare any suitable portion of the received fingerprint to sample fingerprint data stored in the database that corresponds to the username. As another specific example, in instances where the biometric signature includes a voice signature, process <NUM> can compare frequency information of the received voice signature to frequency information of voice data corresponding to the username.

If, at <NUM>, process <NUM> determines that the biometric signature is valid ("yes" at <NUM>), process <NUM> can grant the user associated with the username access to the LAN or WAN at <NUM>. For example, in some embodiments, process <NUM> can allow a user device used by the user to log in to the LAN or WAN. Process <NUM> can then end at <NUM>.

If, at <NUM>, process <NUM> determines that the biometric signature is not valid ("no" at <NUM>), process <NUM> can end at <NUM>. In some embodiments, process <NUM> can cause any suitable message to be presented on the user device that indicates that the biometric signature was not valid.

If, at <NUM>, process <NUM> determines that the username is not valid ("no" at <NUM>), process <NUM> can receive a new username at <NUM>. In some embodiments, process <NUM> can present a user interface that allows a user to reset a username, such as user interface <NUM> as shown in <FIG>. As illustrated, in some embodiments, user interface <NUM> can include a text entry input <NUM> that can be used to enter characters corresponding to a new username. Additionally, in some embodiments, user interface <NUM> can have a submit username button <NUM>, that, when selected, can cause the characters entered in text entry input <NUM> to be transmitted to sign-on server <NUM>. Note that, in some embodiments, user interface <NUM> can be presented in response to any suitable information. For example, in some embodiments, user interface <NUM> can be presented in response to determining that a username entered via user interface <NUM> of <FIG> is invalid. As another example, in some embodiments, user interface <NUM> can be presented in response to receiving an indication from a user that the user does not currently have a username.

Process <NUM> can validate the new username at <NUM> and can determine, at <NUM>, whether the new username is valid. In some embodiments, process <NUM> can validate the new username using any suitable information and/or technique(s). For example, in some embodiments, process <NUM> can determine whether the new username already exists and corresponds to a different user. As a more particular example, in some embodiments, process <NUM> can determine whether the new username is included in a database of usernames stored on sign-in server <NUM>. As another example, in some embodiments, process <NUM> can determine whether the new username satisfies particular criteria, such as a number of characters (e.g., more than a predetermined number of characters, fewer than a predetermined number of characters, and/or any other suitable length criteria), whether it includes particular characters that are not allowed in usernames, and/or any suitable criteria.

If, at <NUM>, process <NUM> determines that the username is not valid ("no" at <NUM>), process <NUM> can loop back to block <NUM> and can request a new username. In some embodiments, process <NUM> can indicate to the user one or more reasons the username was found to be invalid. For example, in some embodiments, process <NUM> can indicate that the entered username already exists and corresponds to a different user, that the entered username is too short or too long, that the entered username includes characters that are not allowed, and/or any other suitable information.

If, at <NUM>, process <NUM> determines that the username is valid ("yes" at <NUM>), process <NUM> can proceed to block <NUM> and can cause a passcode to be transmitted to the user device. In some embodiments, the passcode can be transmitted in any suitable manner, for example, by text message, e-mail, and/or in any other suitable manner. In some embodiments, the passcode can be in any suitable format (e.g., a series of numbers, a series of letters, a series of alphanumeric characters, and/or in any other suitable format). Furthermore, in some embodiments, the passcode can be of any suitable length (e.g., one character, two characters, four characters, and/or any other suitable length). Note that, in some embodiments, process <NUM> can transmit the passcode to the user device in response to receiving an indication from a user of the user device that the user wants to receive the passcode. For example, in some embodiments, the indication can be received via a send passcode button <NUM> as shown in a user interface <NUM> of <FIG>.

At <NUM>, process <NUM> can receive, from the user device, characters from the user device corresponding to the transmitted passcode. For example, in some embodiments, the characters can be received via a user interface <NUM> as shown in <FIG>. As illustrated, user interface <NUM> can include a text entry input <NUM> for a user to enter characters corresponding to the received passcode, and a submit button <NUM> for transmitting the entered characters to sign-on server <NUM>. Note that, in some embodiments, user interface <NUM> can be presented in response to any suitable information. For example, in some embodiments, user interface <NUM> can be presented in response to receiving an indication that send passcode button <NUM> was selected on the user device, that the passcode was transmitted by process <NUM> at block <NUM>, and/or based on any other suitable information.

Process <NUM> can determine whether the passcode received at block <NUM> is valid at block <NUM>. For example, in some embodiments, process <NUM> can determine whether the passcode received at block <NUM> matches the passcode transmitted by sign-on server <NUM> at block <NUM>.

If, at <NUM>, process <NUM> determines that the passcode is not valid ("no" at <NUM>), process <NUM> can loop back to block <NUM> and can receive a new username. Alternatively, in some embodiments, process <NUM> can loop back to block <NUM> and can cause a new passcode to be transmitted to the user device.

If, at <NUM>, process <NUM> determines that the passcode is valid ("yes" at <NUM>), process <NUM> can receive a biometric signature to be associated with the new username at <NUM>. In some embodiments, process <NUM> can cause a user interface <NUM> as shown in <FIG> to be presented on the user device, which can include a collect signature input <NUM>. In some embodiments, selection of collect signature input <NUM> can cause process <NUM> to receive the biometric signature, for example, by presenting a user interface that receives a fingerprint, by activating a microphone of the user device to collect a voice signature, and/or receives the biometric signature in any other suitable manner. In some embodiments, the received biometric signature can then be stored in association with the new username created at block <NUM>. Note that, in some embodiments, after the biometric signature has been associated with the new username, a user of user interface <NUM> can select a log out input <NUM>, which can cause the user to be logged out of the user account.

It should be understood that at least some of the above described blocks of the process of <FIG> can be executed or performed in any order or sequence not limited to the order and sequence shown in and described in the figure. Also, some of the above blocks of the process of <FIG> can be executed or performed substantially simultaneously where appropriate or in parallel to reduce latency and processing times. Additionally or alternatively, some of the above described blocks of the process of <FIG> can be omitted.

In some implementations, any suitable computer readable media can be used for storing instructions for performing the functions and/or processes described herein. For example, in some implementations, computer readable media can be transitory or non-transitory. For example, non-transitory computer readable media can include media such as non-transitory forms of magnetic media (such as hard disks, floppy disks, etc.), non-transitory forms of optical media (such as compact discs, digital video discs, Blu-ray discs, etc.), non-transitory forms of semiconductor media (such as flash memory, electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), etc.), any suitable media that is not fleeting or devoid of any semblance of permanence during transmission, and/or any suitable tangible media. As another example, transitory computer readable media can include signals on networks, in wires, conductors, optical fibers, circuits, any suitable media that is fleeting and devoid of any semblance of permanence during transmission, and/or any suitable intangible media.

Accordingly, methods, systems, and media for authenticating users using biometric signatures are provided.

Claim 1:
A method for authenticating users connecting to at least one of a local area network and a wide area network (<NUM>) using biometric signatures, comprising:
receiving (<NUM>) a first username from a first user device (<NUM>, <NUM>);
transmitting (<NUM>), by a hardware processor (<NUM>, <NUM>) to the first user device, a first passcode;
receiving (<NUM>), by the hardware processor from the first user device, a version of the first passcode;
determining (<NUM>) whether the version of the first passcode matches the first passcode transmitted to the first user device;
in response to determining that the version of the first passcode matches the first passcode transmitted to the first user device, receiving (<NUM>) a first biometric sample corresponding to a first user of the first user device; and
storing the first biometric sample in association with the first username; and
receiving, from the first user device, an indication that the first user device is to be connected to the at least one of a local area network and a wide area network;
in response to receiving the indication, causing a user interface (<NUM>) to be presented on the first user device that receives the first username corresponding to the first user of the first user device;
receiving, from the first user device, a
second biometric sample corresponding to the first user of the first user device;
determining (<NUM>) whether the second biometric sample matches the first biometric sample; and
in response to determining that the second biometric sample matches the first biometric sample, granting (<NUM>) access to the at least one of a local area network and a wide area network.