Systems and methods for use in biometric-enabled network interactions

1 . A computer-implemented method for facilitating network interactions based on user biometrics, the method comprising:

receiving, by a computing device, from a directory server, a biometric service provider (BSP) assertion having a signature computed by using a private key of a BSP, the BSP assertion including a biometric ID of a user;

verifying, by the computing device, the signature of the BSP assertion, using a public key specific to the BSP, previously shared with the computing device;

returning, by the computing device, a verification result to the directory server;

based on the verification result, receiving, by the computing device, an access token; and then,

receiving, by the computing device, a fast identity online (FIDO) authentication creation request, from a device specific to the user, in lieu of receiving the FIDO authentication creation request from an issuer of an account of the user, the FIDO authentication creation request including the access token;

determining, by the computing device, that the access token is unexpired;

providing, by the computing device, a challenge to the device, in response to the authentication creation request;

receiving, by the computing device, from the device specific to the user, a signed challenge, a credential ID, and a FIDO public key specific to the device;

storing, by the computing device, the FIDO public key specific to the device in association with the credential ID; and

mapping, by the computing device, the credential ID to the biometric ID of the user, whereby the device is enabled for FIDO authentication in connection with the biometric ID.

2 . The computer-implemented method of claim 1 , wherein the computing device is a computing device of a biometric identification verification platform; and

wherein the directory server is part of an EMV enhanced authentication scheme.

3 . The computer-implement method of claim 1 , wherein the BSP assertion includes a BSP identifier (ID) for the BSP; and

Wherein the method further comprises retrieving the public key specific to the BSP, based on the BSP ID.

4 . The computer-implemented method of claim 1 , further comprising:

generating, by the directory server, the access token, based on the verification result; and

transmitting the access token to the computing device.

5 . The computer-implemented method of claim 1 , further comprising:

verifying, by a 3DS server, a timestamp on a successful identify and verification (ID&V) transaction being within a threshold time;

in response to verification of the ID&V transaction being successful within the threshold time, generating a transaction ID and transmitting the transaction ID and the BSP assertion, as part of an authentication request, to the directory server; and

transmitting, by the directory server, the BSP assertion to the computing device, in response to the authentication request.

6 . The computer-implement method of claim 1 , further comprising:

receiving, by the computing device, from the device specific to the user, a request to authorize a first party for biometric-initiated pay through the biometric ID, the first party associated with a unique identifier;

returning, by the computing device, a second challenge to the device specific to the user;

receiving, by the computing device, a second challenge from the device specific to the user, which is signed by a FIDO private key specific to said device;

verifying, by the computing device, the second challenge using the FIDO public key specific to the device; and

in response to verification of the signed challenge, adding, by the computing device, the unique identifier to a list of authorized first parties for biometric-initiated pay for the user.

7 . The computer-implement method of claim 6 , wherein receiving the signed challenge includes receiving the credential ID from the device specific to the user; and

further comprising retrieving the public key specific to the device based on the credential ID.

8 . The computer-implemented method of claim 6 , further comprising

receiving, by the computing device, from the device specific to the user, a second request to authorize a further first party for the biometric-initiated pay through the biometric ID, the further first party associated with a second unique identifier;

returning, by the computing device, a third challenge to the device specific to the user;

receiving, by the computing device, a third challenge from the device specific to the user, which is signed by the FIDO private key specific to said device;

verifying, by the computing device, the third challenge using the FIDO public key specific to the device; and

in response to verification of the signed challenge, adding, by the computing device, the second unique identifier of the further first party to the list of authorized first parties for biometric-initiated pay.

9 . The computer-implement method of claim 1 , further comprising:

receiving, by the computing device, from the directory server, a second BSP assertion having a second signature by the private key of the BSP;

verifying, by the computing device, the second signature of the second BSP assertion, using the public key specific to the BSP;

returning, by the computing device, a verification result to the directory server;

receiving, by a computing device, from the directory server, a check request for a unique identifier for the second BSP assertion;

verifying, by the computing device, the unique identifier for the second BSP assertion is included in a list of authorized first parties for the user; and

returning, by the computing device, an affirmative response to the check request, in response to the unique identifier being included in the list of authorized first parties.

10 . A system for facilitating network interactions based on user biometrics, the system comprising:

a biometric identification verification platform (BIVP) computing device, which is configured, by executable instructions, to:

receive, from a directory server, a biometric service provider (BSP) assertion having a signature computed by using a private key of a BSP, the BSP assertion including a biometric ID of a user;

verify the signature of the BSP assertion, using a public key specific to the BSP, previously shared with the computing device;

return a verification result to the directory server;

based on the verification result, receive an access token from the directory server; and then,

receive a fast identity online (FIDO) authentication creation request from a device specific to the user, the FIDO authentication creation request including the access token;

determine that the access token is unexpired;

provide a challenge to the device specific to the user, in response to the authentication creation request and the access token being unexpired;

receive, from the device specific to the user, a signed challenge, a credential ID, and a FIDO public key specific to said device;

store the FIDO public key specific to the device in association with the credential ID; and

map the credential ID to the biometric ID of the user; and

enable, based on the credential ID being mapped to the biometric ID, the device specific to the user for FIDO authentication in connection with the biometric ID.

11 . The system of claim 10 , wherein the assertion includes a BSP identifier (ID) for the BSP; and

wherein the BIVP computing device is configured, by the executable instructions, to retrieve the public key specific to the BSP, based on the BSP ID.

12 . The system of claim 10 , further comprising the directory server, which is configured by second executable instructions, to:

generate an access token, based on the verification result; and

transmit the access token to the BIVP computing device.

13 . The system of claim 10 , further comprising a 3DS server, which is configured by third executable instructions, to:

verify a timestamp on an identify and verification (ID&V) transaction, which is successful within a threshold time; and

in response to verification of the ID&V transaction being successful within the threshold time, generate a transaction ID and transmit the transaction ID and the BSP assertion, as part of an authentication request, to the directory server; and

wherein the directory server is configured to transmit the BSP assertion to the BIVP computing device, in response to the authentication request.

14 . The system of claim 10 , wherein the BIVP computing device is further configured, by the executable instructions, to:

receive, from the device specific to the user, a request to authorize a first party for biometric-initiated pay through the biometric ID, the first party associated with a unique identifier;

return a second challenge to the device specific to the user;

receive a second challenge from the device specific to the user, which is signed by a FIDO private key specific to said device;

verify the second challenge using the FIDO public key specific to the device; and

in response to verification of the signed challenge, add the unique identifier to a list of authorized first parties for biometric-initiated pay for the user.

15 . The system of claim 14 , wherein the BIVP computing device is further configured, by the executable instructions, to:

receive the credential ID along with the second challenge from the device specific to the user; and

retrieve the public key specific to said device based on the credential ID.

16 . The system of claim 14 , wherein the BIVP computing device is further configured, by the executable instructions, to:

receive, from the device specific to the user, a second request to authorize a further first party for the biometric-initiated pay through the biometric ID, the further first party associated with a second unique identifier;

return a third challenge to the device specific to the user;

receive a third challenge from the device specific to the user, which is signed by the FIDO private key specific to said device

verify the third challenge using the FIDO public key specific to said device; and

in response to verification of the signed challenge, add the second unique identifier of the further first party to the list of authorized first parties for biometric-initiated pay.

17 . The system of claim 10 , wherein the BIVP computing device is further configured, by the executable instructions, to:

receive, from the directory server, a second BSP assertion having a second signature by a private key of a BSP;

verify the second signature of the second BSP assertion, using the public key specific to the BSP;

return a verification result to the directory server;

receive, from the directory server, a check request for a unique identifier for the second BSP assertion;

verify the unique identifier for the second BSP assertion is included in a list of authorized first parties for the user; and

return an affirmative response to the check request, in response to the unique identifier being included in the list of authorized first parties.

18 . A non-transitory computer-readable storage medium including executable instructions for use in facilitating network interactions based on user biometrics, which, when executed by at least one processor, cause the at least one processor to:

receive, from a directory server, a biometric service provider (BSP) assertion having a signature computed by using a private key of a BSP, the BSP assertion including a biometric ID of a user;

verify the signature of the BSP assertion, using a public key specific to the BSP, previously shared with the at least one processor;

return a verification result to the directory server;

based on the verification result, receive an access token from the directory server; and then,

receive a fast identity online (FIDO) authentication creation request from a device specific to the user, in lieu of receiving the FIDO authentication creation request from an issuer of an account of the user, the FIDO authentication creation request including the access token;

determine that the access token is unexpired;

provide a challenge to the device specific to the user, in response to the authentication creation request and the access token being unexpired;

receive, from the device specific to the user, a signed challenge, a credential ID, and a FIDO public key specific to said device;

store the FIDO public key specific to the device in association with the credential ID; and

map the credential ID to the biometric ID of the user, whereby the device specific to the user is enabled for FIDO authentication in connection with the biometric ID.

19 . The non-transitory computer-readable storage medium of claim 18 , wherein the BSP assertion includes a BSP identifier (ID) for the BSP; and

wherein the executable instructions, when executed by the at least one processor, further cause the at least one processor to retrieve the public key specific to the BSP, based on the BSP ID.

20 . The non-transitory computer-readable storage medium of claim 18 , wherein the executable instructions, when executed by the at least one processor, further cause the at least one processor to:

receive, from the device specific to the user, a request to authorize a first party for biometric-initiated pay through the biometric ID, the first party associated with a unique identifier;

return a second challenge to the device specific to the user;

receive a second challenge from the device specific to the user, which is signed by a FIDO private key specific to said device;

verify the second challenge using the FIDO public key specific to the device; and

in response to verification of the signed challenge, add the unique identifier to a list of authorized first parties for biometric-initiated pay for the user.