SECURE BIOMETRIC CREDENTIAL AUTHORIZATION METHODS AND APPARATUS

1 . A biometric authentication system comprising:

a reader device comprising:

a memory configured to store identifying data

a biometric capture device wherein the biometric capture device is configured to capture biometric data from a user proximate to the reader device;

a processor coupled to the biometric capture device, and wherein the processor is configured to compute a first hash in response to the biometric data; and

a short-range transceiver coupled to the processor, wherein the short-range transceiver is configured to output the first hash, and the identifying data; and

a smart device comprising:

a processor;

a short-range transceiver coupled to the processor;

a wide-area transceiver coupled to the processor; and

a memory coupled to the processor, wherein the memory comprises a software application including code configured to be executed on the processor, wherein the application is configured to:

direct the processor form an ephemeral ID signal, wherein the ephemeral ID signal comprises a first data portion including data associated with an authentication server and a second data portion including data not associated with a user;

direct the short-range transceiver to receive from the short-range transceiver of the reader device, the first hash and the additional data;

direct the processor to retrieve from the memory a stored biometric model associated with the user;

direct the processor to compute a second hash of the stored biometric model;

direct the processor to determine a match if the first hash is within a range of distances of the second hash;

direct the processor to retrieve a token in response to the identifying data and to the match; and

direct the processor to output the token with the short-range transceiver to the reader device.

2 . The system of claim 1 wherein the ephemeral ID signal comprises a first portion including data associated with a server and a second portion including data not associated with the user of the smart device.

3 . The system of claim 1

wherein the processor of the reader device is configured to compute the first hash in response to the biometric data and to additional data;

wherein the application is configured to direct the processor to compute the second hash of the stored biometric model and additional data;

wherein the additional data is selected from a group consisting of:

a nonce, a random number, a random data string, a pseudorandom number, a pseudorandom data string, and data selected from a closed group of data.

4 . The system of claim 1 wherein the biometric data is derived from biometric captures selected from a group consisting of: a face of the user, a fingerprint, a palm print, audio data, iris data, and movement data.

5 . The system of claim 1

wherein the reader device further comprises a peripheral device coupled to the processor that is selected from a group consisting of:

an electrical device and an electromechanical device, wherein the peripheral device is configured to perform a user-perceptible action.

6 . The system of claim 5 wherein the user-perceptible change in the peripheral device is selected from a group consisting: unlocking a door, preparing a beverage, unlocking a car door, activating an appliance, activating a vending machine.

7 . The system of claim 5 wherein the user-perceptible change in the peripheral device is selected from a group consisting: controlling a television, controlling a computer, executing a program on a computing device, logging into a software application or web site.

8 . A method for a smart device comprising:

outputting with a short-range transceiver an ephemeral ID signal, wherein the ephemeral ID signal is not pre-associated with a reader device;

receiving with the short-range transceiver from a reader device a request for identifying data, in response to the ephemeral ID signal;

receiving with the short-range transceiver from the reader device, a representation of reader-acquired biometric data associated with a user of the smart device and additional data;

retrieving from a memory a stored biometric model associated with the user;

determining with a processor a representation of the stored biometric model, in response to the stored biometric model and to the additional data;

determining with the processor a biometric match when the representation of the reader-acquired biometric data is within a range of the representation of the stored biometric model;

providing with the short-range transceiver to the reader device, authentication data in response to the biometric match, wherein the authenticated data comprises token data; and

sending with the short-range transceiver to the reader device a request to perform an action on a peripheral device coupled to the reader device.

9 . The method of claim 8 wherein the ephemeral ID signal comprises a first portion including data associated with a server and a second portion including data not associated with the user of the smart device.

10 . The method of claim 8

wherein the receiving with the short-range transceiver from the reader device, the request for identifying data further comprises receiving with the short-range transceiver from the reader device, an identifier associated with the reader device; and

wherein the token is associated with the identifier associated with the reader device.

11 . The method of claim 8 wherein the additional data is selected from a group consisting of:

a nonce, a random number, a random data string, a pseudorandom number, a pseudorandom data string, and data selected from a closed group of data.

12 . The method of claim 8 wherein the new biometric data is selected from a group consisting of:

a face of the user, a fingerprint, a palm print, audio data, iris data, and movement data.

13 . The method of claim 8 wherein the representation the reader-acquired biometric data associated with the user is selected from a group consisting of:

a hash of the reader-acquired biometric data, the reader-acquired biometric data that is digitally signed by the reader device, a hash of the reader-acquired biometric data and the additional data, the reader-acquired biometric data and the additional data that are combined and digitally signed by the reader device.

14 . The method of claim 8

wherein the peripheral device is selected from a group consisting of:

an electrical device and an electromechanical device;

wherein the action comprises a user-perceptible action; and

wherein the method further comprises receiving with the short-range transceiver from the reader device a confirmation that the user-perceptible action has been performed by the peripheral device.

15 . A biometric authentication system comprising:

a memory configured to store a biometric model associated with the user;

a short-range transceiver coupled to the processor, wherein the short-range transceiver is configured to output to a reader device an ephemeral ID signal, wherein the short-range transceiver is configured to receive from the reader device a request for identifying data, a first hash of reader-acquired biometric data associated with a user, and additional data; and

a processor coupled to the short-range transceiver, wherein the processor is configured to determine the ephemeral ID signal, wherein the ephemeral ID signal is not pre-associated with a reader device, wherein the processor is configured to determine a second hash of the biometric model and the additional data, wherein the processor is configured to determine a match condition when the first hash is within a range of distances to the second hash; and

wherein the short-range transceiver is configured to provide to the reader device, authentication data in response to the match condition, wherein the authenticated data comprises token data; and

wherein the short-range transceiver is configured to provide to the reader device a request to perform an action on a peripheral device coupled to the reader device.

16 . The system of claim 15 wherein the ephemeral ID signal comprises a first portion including data associated with an authentication server and a second portion including data not associated with the user of the smart device.

17 . The system of claim 15

wherein the short-range transceiver is configured to receive an identifier associated with the reader device and security data; and

wherein the system further comprising a wide-area network transceiver coupled to the processor, wherein the wide-area network transceiver is configured to send the identifier to the authentication server, and wherein the wide-area network transceiver is configured to receive the token from the authentication server, in response to the identifier.

18 . The system of claim 15 wherein the security data is selected from a group consisting of:

a nonce, a random number, a random data string, a pseudorandom number, a pseudorandom data string, and data selected from a closed group of data.

19 . The system of claim 15 wherein the reader-acquired biometric data comprises data associated with a portion of the user selected from a group consisting of:

a face of the user, a fingerprint, a palm print, voice data, iris data, and movement data.

20 . The system of claim 15

wherein the peripheral device is selected from a group consisting of: an electrical device and an electromechanical device.

wherein the action comprises a user-perceptible action; and

wherein the short-range transceiver is configured to receive from the reader device a confirmation that the user-perceptible action has been performed by the peripheral device.