Patent ID: 6845453

Claim:
A method of authenticating the identity of a user to determine access to a system, comprising: providing a possession-based data instance, a modified version of the possession-based data instance, a knowledge-based data instance, a biometric-based data instance, and a modified version of the biometric-based data instance; generating a first cryptographic key based on the knowledge-based data instance; applying the first cryptographic key to the modified version of the possession-based data instance to generate a first recovered data instance; interrogating the first recovered data instance against the possession-based data instance to generate a possession value as a result of a first correspondence evaluation; applying the first cryptographic key to the modified version of the biometric-based data instance to generate a second recovered data instance; interrogating the second recovered data instance against the biometric-based data instance to generate a biometric value as a result of a second correspondence evaluation; combining the first cryptographic key, the possession value, and the biometric value to form a second cryptographic key; restricting the user's access to the system if the user's identity is not authenticated, based at least in part on the second cryptographic key; and granting the user's access to the system if the user's identity is authenticated, based at least in part on the second cryptographic key.