Patent ID: 12217229

DETAILED DESCRIPTION

Various embodiments herein each include at least one of systems, methods, and software for biometric authentication of pre-staged self-service terminal transactions. In some embodiments, a customer may utilize a mobile device app to generate a transaction to be completed or performed on an SST, such as by identifying an item to purchase or an ATM withdraw. Data of the transaction to be performed may then be transmitted by the mobile device app to a server where the transaction will be pre-staged. When ready, the customer will approach an SST and the mobile device will connect to the SST via a wireless communication protocol, such as BLUETOOTH®, a Near-Field Communication (NFC) protocol, Wi-Fi, and the like. In some embodiments, this wireless connection is a peer-to-peer connection. The connection may be established automatically under the direction of a particular mobile device app, such as the mobile device app utilized to pre-stage the transaction. The customer will then initiate the transaction on the SST by providing a biometric sample, such as a fingerprint scan or retina scan on the SST. The SST may then transmit a data form of the biometric sample, also referred to as a biometric scan and biometric data, to the mobile device via the previously established connection. The customer will have already been authenticated with regard to a customer account, such as a bank account, customer shopping account, digital wallet account, and the like, or will be upon receipt of customer account credentials. The mobile device app will then receive the data of the biometric sample received by the mobile device and attempt to authenticate the biometric sample based upon biometric data previously stored on the mobile device by the customer or upon receipt of a biometric scan by a biometric reading device of the mobile device. When a match is not made, an error code may be transmitted back to the SST. However, when a match is made, the mobile device app may transmit back to the SST via the previously established wireless connection, data identifying the match and an account identifier that enables the SST to retrieve the pre-staged transaction from the server where it is stored. The data transmitted from the mobile device to the SST may further include security data in some embodiments, or the data may be encrypted. Through such methods, customer biometric data may be retained by the customer for validation purposes. Further, the biometric data present on the SST may be maintained in a secure memory or memory that is flushed upon completion of the authentication to ensure customer biometric data is not stored or compromised.

These and other embodiments are described herein with reference to the figures.

In the following detailed description, reference is made to the accompanying drawings that form a part hereof, and in which is shown by way of illustration specific embodiments in which the inventive subject matter may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice them, and it is to be understood that other embodiments may be utilized and that structural, logical, and electrical changes may be made without departing from the scope of the inventive subject matter. Such embodiments of the inventive subject matter may be referred to, individually and/or collectively, herein by the term “invention” merely for convenience and without intending to voluntarily limit the scope of this application to any single invention or inventive concept if more than one is in fact disclosed.

The following description is, therefore, not to be taken in a limited sense, and the scope of the inventive subject matter is defined by the appended claims.

The functions or algorithms described herein are implemented in hardware, software or a combination of software and hardware in one embodiment. The software comprises computer executable instructions stored on computer readable media such as memory or other type of storage devices. Further, described functions may correspond to modules, which may be software, hardware, firmware, or any combination thereof. Multiple functions are performed in one or more modules as desired, and the embodiments described are merely examples. The software is executed on a digital signal processor, ASIC, microprocessor, or other type of processor operating on a system, such as a personal computer, server, a router, or other device capable of processing data including network interconnection devices.

Some embodiments implement the functions in two or more specific interconnected hardware modules or devices with related control and data signals communicated between and through the modules, or as portions of an application-specific integrated circuit. Thus, the exemplary process flow is applicable to software, firmware, and hardware implementations.

FIG.1is a logical block diagram of a system100, according to an example embodiment. The system100includes a mobile device102, an SST104, a network106, and a banking systems108. The mobile device102may be a smartphone, smartwatch, tablet, personal computer, and other mobile device types. The SST106may be an ATM, and self-service checkout terminal, a hybrid customer assisted/self-service terminal, and the like. The network may be or include one or more of a secured ATM network, the Internet, a virtual private network, a local area network, a wide area network, and other secured and unsecured networks. The banking systems108are generally backend systems that support execution of transactions performed or completed on an SST104. While the system100includes the banking systems108, the banking systems108may instead be backend systems of a retail outlet or other entity on which transactions may be pre-staged and executed, at least in part. Note that although the mobile device102is not illustrated as connected to the network106, such a connection does exist in typical embodiments as a transaction may be initiated on the mobile device102and pre-staged to the banking systems108for retrieval by the SST104upon biometric authentication of an individual on the mobile device102and as provided by the mobile device102to the SST104.

In some embodiments, the mobile device102includes a stored data representation of a biometric scan, such as that of a customer fingerprint, retina scan, image facial recognition features, and other possible biometric data. The mobile102device further includes an app that executes thereon that provides transaction pre-staging functionality. The transaction pre-staging functionality allows a customer to define a transaction to be performed or completed at the SST104, such as a bank account withdrawal when the SST is an ATM or a purchase of an item or service at a checkout terminal. Once the transaction is defined within the mobile device102app, the mobile device102app transmits data defining the transaction to a backend system, such as the banking systems108, to pre-stage the transaction.

The customer then arrives at the SST104and provides a biometric input of the type stored on the mobile device102. The SST104therefore includes a biometric reading device, such as a fingerprint scanner, retinal scanner, or camera capable of capturing images and facial recognition software that identifies facial recognition features. The biometric data is then transmitted to the mobile device102via an ad hoc and on demand wireless peer-to-peer connection, such as may be established via Wi-Fi, BLUETOOTH®, NFC, and the like. The mobile device102app receives the biometric data and performs and authentication in view of the stored biometric data. The authentication may also or alternatively be performed with regard to a newly captured biometric scan on the mobile device102in some embodiments. When authenticated, the mobile device102app generates a message including an authentication, which may include a security code or certificate, one or both of an account identifier and a pre-staged transaction identifier to enable retrieval of the pre-staged transaction, and other data, depending on the embodiment. The message is then transmitted from the mobile device102to the SST104via the previously established wireless connection.

The SST104, upon receipt of the authentication from the mobile device102, retrieves data defining the pre-staged transaction from the banking systems108via the network106. The banking systems108then provide the pre-staged transaction data, via the network106, to the SST104. The SST104may then complete the transaction.

FIG.2is a block flow diagram of a method200, according to an example embodiment. The method200is an example of a method that may be performed on a mobile device according to instructions stored thereon as part of a mobile device app. The method200includes receiving202input, within the mobile device app, defining a transaction to be completed on an SST against an account, such as a bank, credit, or other customer account-type. The method200further includes transmitting204data via a first wireless communication device of the mobile to pre-stage the transaction on a server for download by the SST upon authentication of an account holder of the account. The first wireless communication device may be a Wi-Fi enabled device, a radio transceiver device enabling the mobile device to communicate on a wireless service network, and the like.

The method200continues by connecting206, wirelessly via a second wireless communication device of the mobile device app, to the SST. The second wireless communication device may be a BLUETOOTH® data communication device, an NFC communication device, the same Wi-Fi enabled device of the first wireless communication device, and the like.

Next, the method200includes receiving208, via the second wireless communication device from the SST, biometric data to authenticate the account holder and comparing210, on the mobile device, the received biometric data with biometric data of the account holder. In some such embodiments, when the comparing210identifies a match between the received biometric data and the biometric data of the account holder, the method200includes transmitting210an authentication message via the second wireless communication device to the SST.

In some embodiments of the method200, the comparing210of the received208biometric data with biometric data of the account holder includes retrieving biometric data stored on the mobile device. Such embodiments may then compare the received208biometric data and the retrieved biometric data to identify whether there is a match and when there is a match, determine a confidence level of the match. In some such embodiments, transmitting212the authentication message to the SST includes transmitting the confidence level. In some embodiments, the biometric data stored on the mobile device may be stored securely by the mobile device app and is not accessible and never shared by the mobile device with other mobile device apps or otherwise within our outside the bounds of the mobile device.

In some embodiments, the authentication message includes an account identifier of the account. The account identifier in such embodiments identifies the pre-staged transaction associated with the account to be retrieved. The authentication message may further include security data indicating validity of the authentication message to the SST. This security data may be in the form of encryption of at least a portion of the authentication message according to an encryption key stored on the mobile device, obtained by the mobile device app when pre-staging the transaction, or otherwise possessed or obtained by the mobile device app.

FIG.3is a block flow diagram of a method300, according to an example embodiment. The method300is another example of a method that may be performed on a mobile device according to instructions stored thereon as part of a mobile device app. The method300includes connecting302, wirelessly via a wireless communication device of a mobile device app, to an SST. The method300further includes receiving304, via the wireless communication device from the SST, biometric authentication data to authenticate an account holder and comparing306on the mobile device, the received biometric data with biometric data stored on or read by a biometric reader of the mobile device. The method300, upon identifying a match between the received304biometric data and the biometric data read by or stored on the mobile device, may then transmit308an authentication message via the wireless communication device to the SST indicating the match.

In some embodiments, the comparing of the received304biometric data with biometric data read by or stored on the mobile device includes retrieving biometric data stored on the mobile device. The comparing306may then be performed between received304biometric data and the retrieved biometric data to identify whether there is a match. When there is a match, the method300may then determine a confidence level of the match. The transmitting308of the authentication message to the SST in such embodiments includes transmitting308the confidence level.

FIG.4is a block flow diagram of a method400, according to an example embodiment. The method400is an example of a method that may be performed by a computer controlling operation of an SST, such as an ATM or a checkout terminal. The method400includes receiving402biometric data from the biometric reading device of the SST and transmitting404a representation of the biometric data, via a short-range data communication interface device to a mobile device to obtain an authentication of the biometric data. The short-range data communication interface device may be a BLUETOOTH® device, an NFC enabled device, or other similar device. Note however that in some embodiments the short-range data communication interface device may instead be a Wi-Fi enabled device.

The method400further includes receiving406, via the short-range data communication interface device, authentication of the biometric data from the mobile device and retrieving408via wireless network data communication interface device, such as a Wi-Fi enabled device, data defining a pre-staged transaction to be completed on the SST. Once the pre-staged transaction data is retrieved, the SST may complete the transaction.

In some embodiments, the received406authentication message includes an account identifier and the retrieving408of the data defining the pre-staged transaction is performed based at least in part on the account identifier.

In another embodiment, the received406authentication message includes data identifying a confidence level of a match between the representation of the biometric data transmitted404to the mobile device and biometric data on the mobile device. In such an embodiment, the retrieving408of the data defining the pre-staged transaction is performed only when the confidence level at least meets a threshold confidence level. In this and some other embodiments, the received406authentication message may include security data. In such embodiments, the method400may further include validating the security data, such as by decrypting data or validating a certificate, and retrieving408the data defining the pre-staged transaction only when the security data is valid.

FIG.5is a block diagram of a computing device, according to an example embodiment. In one embodiment, multiple such computer systems are utilized in a distributed network to implement multiple components in a transaction-based environment. An object-oriented, service-oriented, or other architecture may be used to implement such functions and communicate between the multiple systems and components. One example computing device in the form of a computer510, may include a processing unit502, memory504, removable storage512, and non-removable storage514. Although the example computing device is illustrated and described as computer510, the computing device may be in different forms in different embodiments. For example, the computing device may instead be a smartphone, a tablet, smartwatch, or other computing device including the same or similar elements as illustrated and described with regard toFIG.5. Devices such as smartphones, tablets, and smartwatches are generally collectively referred to as mobile devices. In other embodiments, the computing device may be a computer that controls operation of an SST or a computer deployed as a server, such as a host of one or more banking software systems. Further, although the various data storage elements are illustrated as part of the computer510, the storage may also or alternatively include cloud-based storage accessible via a network, such as the Internet.

Returning to the computer510, memory504may include volatile memory506and non-volatile memory508. Computer510may include—or have access to a computing environment that includes a variety of computer-readable media, such as volatile memory506and non-volatile memory508, removable storage512and non-removable storage514. Computer storage includes random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM) and electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD ROM), Digital Versatile Disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium capable of storing computer-readable instructions.

Computer510may include or have access to a computing environment that includes input516, output518, and a communication connection520. The input516may include one or more of a touchscreen, touchpad, mouse, keyboard, camera, one or more device-specific buttons, one or more sensors integrated within or coupled via wired or wireless data connections to the computer510, and other input devices. The computer510may operate in a networked environment using a communication connection520to connect to one or more remote computers, such as database servers, web servers, and other computing device. An example remote computer may include a personal computer (PC), server, router, network PC, a peer device or other common network node, or the like. The communication connection520may be a network interface device such as one or both of an Ethernet card and a wireless card or circuit that may be connected to a network. The network may include one or more of a Local Area Network (LAN), a Wide Area Network (WAN), the Internet, and other networks. In some embodiments, the communication connection520may also or alternatively include a transceiver device, such as a BLUETOOTH® device that enables the computer510to wirelessly receive data from and transmit data to other BLUETOOTH® devices.

In some embodiments, the computer510also includes a biometric reading device522. The biometric reading device522may be a fingerprint reading device. In other embodiments, the biometric reading device522may be an iris scanner. In further embodiments, the biometric reading device522may instead be a firmware or software element that executes upon images captured by an imaging device to perform facial recognition. The biometric reading device522may take different forms and be of these and other types in various embodiments.

Computer-readable instructions stored on a computer-readable medium are executable by the processing unit502of the computer510. A hard drive (magnetic disk or solid state), CD-ROM, and RAM are some examples of articles including a non-transitory computer-readable medium. For example, various computer programs525or apps, such as one or more applications and modules implementing one or more of the methods illustrated and described herein or an app or application that executes on a mobile device or is accessible via a web browser, may be stored on a non-transitory computer-readable medium.

It will be readily understood to those skilled in the art that various other changes in the details, material, and arrangements of the parts and method stages which have been described and illustrated in order to explain the nature of the inventive subject matter may be made without departing from the principles and scope of the inventive subject matter as expressed in the subjoined claims.