Patent ID: 7131009

Claim:
A method of authenticating the identity of a user to determine access to a system, comprising: providing a token having a possession-based data instance corresponding to the token, an encrypted biometric reference-based data instance corresponding to the user, and an encrypted identifying data instance corresponding to at least one of the token and the user; providing a knowledge-based data instance corresponding to the user; applying a predetermined algorithm to the knowledge-based data instance to generate a knowledge factor value; providing the knowledge factor value to the token; using the knowledge factor value to decrypt the encrypted identifying data instance; comparing the decrypted identifying data instance to the possession-based data instance; providing a possession factor value based on the decrypted identifying data instance only if the decrypted identifying data instance corresponds to the possession-based data instance; using the knowledge factor value to decrypt the encrypted biometric reference-based data instance; providing a biometric sample-based data instance corresponding to the user; comparing the decrypted biometric reference-based data instance to the biometric sample-based data instance; providing a biometrics factor value to the token based on the biometric reference-based data instance only if the decrypted biometric reference-based data instance corresponds to the biometric sample-based data instance; binding the possession factor value, the knowledge factor value, and the biometrics factor value; generating a key based on the bound possession factor value, knowledge factor value, and biometrics factor value; and granting system access to the user based on validity of the key; wherein the key is valid only if each of the possession factor value, the knowledge factor value, and the biometrics factor value is valid.