Patent ID: 8812864

Claim:
A method of handling a factor of a multi-factor authentication sequence, said method comprising: at an enrollment phase: receiving a first biometric candidate at a device associated with an identity verification element; responsive to said receiving said first biometric candidate, generating a first cryptographic key from said first biometric candidate; receiving a character sequence associated with said identity verification element; employing said first cryptographic key to encrypt said character sequence to result in an encrypted character sequence; storing said encrypted character sequence; at a verification phase that occurs at a different time than the enrollment phase: receiving a second biometric candidate at said device, said device lacking access to a biometric template for use in verifying said second biometric candidate; responsive to said receiving said second biometric candidate, generating a second cryptographic key from said second biometric candidate; decrypting said encrypted character sequence associated with said identity verification element, wherein said decrypting employs said second cryptographic key and results in a decrypted character sequence; responsive to determining the decryption of the encrypted character sequence was successful at said device: transmitting said decrypted character sequence to said identity verification element, and receiving, from said identity verification element, an indication of failed character sequence verification; determining, from said indication, that said identity verification element has failed to verify said decrypted character sequence; and responsive to said determining from said indication that said identity verification element has failed to verify said decrypted character sequence, providing an indication of failure to verify; wherein not one of the first or second biometric candidate is persistently stored.