Personal digital key initialization and registration for secure transactions
A system and method provide efficient, secure, and highly reliable authentication for transaction processing and/or access control applications. A personal digital key (PDK) is programmed using a trusted programming device to initialize and/or register the PDK for use. In one embodiment, the initialization and registration processes are administered by a specialized trusted Notary to ensure the processes follow defined security procedures. In a biometric initialization, the programming device acquires a biometric input from a user and writes the biometric data to a tamperproof memory in the PDK. In registration, the Programmer communicates to one or more remote registries to create or update entries associated with the user PDK. Once initialized and registered, the PDK can be used for various levels of secure authentication processes.
1. A method of initializing a personal digital key (PDK) for secure authentication, the method comprising:
reading, with a programming device, user information from a first PDK to determine whether a user is authorized for initialization;
determining, with the programming device, a status of the first PDK based at least in part on a registry including data describing the status of the first PDK;
responsive to determining that the status of the first PDK is in good standing, determining, with the programming device, that the user is authorized for initialization;
reading, with the programming device, notary information from a notary PDK to determine whether a notary is authorized to witness the initialization;
acquiring a biometric input from the user, wherein the acquisition is witnessed by the notary; and
responsive to the user and the notary being authorized, storing a biometric profile on the first PDK.
2. The method of claim 1 , comprising:
determining a status of the first PDK based at least in part on a registry including data describing the status of the first PDK, and
wherein one or more of determining that the first PDK is authorized, acquiring the biometric information from the user and storing the biometric profile on the first PDK is responsive to the status of the first PDK being in good standing.
3. The method of claim 2 , wherein the first PDK is in good standing if the first PDK has not been reported as lost, stolen, expired or revoked.
4. The method of claim 2 , wherein the first PDK is in good standing if the first PDK has not been initialized.
5. The method of claim 1 , wherein acquiring the biometric input comprises:
scanning the biometric input; and
performing a transformation on the biometric input to generate the biometric profile.
6. The method of claim 5 , comprising:
checking a quality of the scanned biometric input; and
responsive to the quality not being satisfactory, re-scanning the biometric input.
7. The method of claim 1 , comprising storing initialization history data including at least one of an identifier of the first PDK, an identifier of the notary PDK, a programming device ID and a site ID.
8. The method of claim 1 , comprising writing initialization history data to the first PDK, wherein initialization history data comprises at least one of a an identifier of the first PDK, an identifier of the notary PDK, a programming device ID and a site ID.
9. The method of claim 1 , comprising:
receiving a hardware authentication request from the first PDK;
transmitting programming device information to the first PDK; and
responsive to the first PDK determining that the programming device is a valid device, receiving authorization from the first PDK to continue initialization.
10. The method of claim 1 , comprising determining that the notary PDK is authorized to administer initialization including:
checking a status of the notary PDK in a registry; and
wherein one or more of determining that the notary PDK is authorized, acquiring the biometric information from the user and storing the biometric profile on the first PDK is responsive to the status of the first PDK being in good standing.
11. The method of claim 1 , further comprising determining if the programming device is in good standing.
12. The method of claim 11 , wherein the programming device is in good standing if the programming device has not been reported as lost, stolen, expired or revoked and the programming device does not comprise altered software.
13. The method of claim 1 , wherein the notary associated with the notary PDK administers the initialization process from a remote location.
14. The method of claim 1 , further comprising transmitting registry information to a remote registry to add or update a registry entry, wherein the registry information comprises at least one of a user PDK ID, purchasing information and personal information.
15. An apparatus for programming a personal digital key (PDK) for use in secure authentication, comprising:
a PDK interface adapted to receive user information from the PDK for determining whether a user is authorized for initialization and to receive notary information from a notary PDK for determining whether a notary is authorized to witness initialization; a biometric reader adapted to acquire a biometric input from the user; and
a processor coupled to the PDK interface and the biometric reader to determine that the user is authorized for an initialization based at least in part on the user information, to determine that the user is authorized for an initialization based at least in part on the user information and responsive to determining that a status of the PDK is in good standing, to determine that the notary is authorized to witness an initialization based on the notary information and to instruct the PDK interface to write a biometric profile based on the biometric input to the PDK responsive to authorization of the user and of the notary PDK.
16. The apparatus of claim 15 comprising:
a network interface coupled to the processor, the network interface adapted to transmit notary PDK information to a remote registry and receive data describing the status of the notary PDK from the remote registry; and
wherein one or more of determining that the notary PDK is authorized, acquiring the biometric information from the user and storing the biometric profile on the user's PDK is responsive to the status of the user's PDK being in good standing.
17. The apparatus of claim 15 comprising:
a network interface coupled to the processor, the network interface adapted to transmit PDK information to the remote registry and receive the data describing the status of the PDK from the remote registry; and
wherein one or more of determining that the user is authorized, acquiring the biometric information from the user and storing the biometric profile on the PDK is responsive to the status of the PDK being in good standing.
18. The apparatus of claim 15 , wherein the biometric profile including based on the biometric input is written to the user PDK responsive to determining that the programming device is in good standing.
19. The system of claim 15 , wherein the biometric reader is adapted to obtain a representation of physical or behavioral characteristics derived from an individual.
20. The system of claim 15 , wherein the biometric reader comprises at least one of a fingerprint scanner, a retinal scanner, an iris scanner, a face scanner, a palm scanner, a DNA analyzer, a signature analyzer and a voice analyzer.