SECURE BIOMETRIC AUTHENTICATION
Systems and methods for configuring an authenticator to provide a secure user authentication to an application processing a task requesting the authentication are provided. The authenticator performs the biometric authentication upon receiving a match request from an application processing the task. Subsequently, the authenticator generates a match score based on a comparison between biometric input data captured by a sensor associated with the authenticator and stored enrollment data in order to determine a match result based on the match score. The authenticator then determines a level of confidence in the match result and provides the match result and the level of confidence to the application processing the task. Additionally, systems and methods provide a secure way to communicate the match result and the level of confidence over an untrusted communication channel.
1 . A method for an authenticator to provide a secure biometric authentication for a task, the method comprising:
receiving a match request from an application processing the task;
generating a match score based on a comparison between biometric input data captured by a sensor associated with the authenticator and stored enrollment data;
determining a match result based on the match score;
determining a level of confidence in the match result; and
providing the match result and the level of confidence to the application processing the task.
2 . The method of claim 1 , wherein the level of confidence is the match score.
3 . The method of claim 1 , wherein both determining the match result and the level of confidence comprises comparing the match score to a threshold.
4 . The method of claim 3 , wherein the comparison between the match score and the threshold to determine the level of confidence is represented as a percentage.
5 . The method of claim 1 , further comprising receiving a random challenge from the application at the same time as the match request.
6 . The method of claim 5 , further comprising generating an identifier relating to a user of the authenticator, wherein the providing the match result and the level of confidence to the application processing the task comprises:
combining the match result, the level of confidence, the random challenge and the identifier into system data;
signing the system data with a signature key to obtain signed system data; and
providing the signed system data to the application.
7 . The method of claim 5 , wherein the identifier provides an identification of the user of the authenticator.
8 . The method of claim 7 , wherein the signature key is an asymmetric key.
9 . The method of claim 7 , wherein the random challenge is a random sequence.
10 . The method of claim 7 , wherein the application is implemented in an embedded secure element.
11 . The method of claim 1 , wherein the authenticator is provided by a secure processor of a device associated with the authenticator, and the device includes an application processor separate from the secure processor.
12 . The method of claim 11 , wherein the secure processor controls the sensor.
13 . The method of claim 1 , wherein the authenticator is provided by a Trusted Execution Environment (TEE) of an application processor of a device hosting the authenticator.
14 . A device for providing a secure biometric authentication for a task, the device comprising:
a biometric sensor; and
a processing system including an authenticator configured to:
receive a match request from an application processing the task;
generate a match score based on a comparison between biometric input data captured by a sensor associated with the authenticator and stored enrollment data;
determine a match result based on the match score;
determine a level of confidence in the match result; and
provide the match result and the level of confidence to the application processing the task.
15 . The method of claim 14 , wherein the level of confidence is determined by comparing the match score with a threshold.
16 . The method of claim 14 , wherein the processing system includes an application processor and a secure processor separate from the application processor and the secure processor provides the authenticator and controls the biometric sensor.
17 . The method of claim 14 , wherein the processing system includes an application processor and the application processor includes a Trusted Execution Environment (TEE) that provides the authenticator.
18 . A system providing a secure biometric authentication for a task, the system comprising:
an application processing the task; and
an authenticator, wherein the authenticator is configured to:
receive a match request from the application;
generate a match score based on a comparison between biometric input data captured by a sensor associated with the authenticator and stored enrollment data;
determine a level of confidence in the match score; and
provide the level of confidence to the application.
19 . The system of claim 19 , wherein the level of confidence is determined by comparing the match score with the threshold.
20 . The system of claim 19 , wherein the application is implemented in an embedded secure element of a host device for the application, and the task is a payment transaction.