Biometric sensor on portable device

1. A method comprising:

establishing, a first communication between a user device and a resource provider computer operating a host site in an interaction between the host site and a user of the user device;

after establishing the first communication, establishing, a second communication between the user device and a portable device of the user;

capturing, by the portable device, a biometric sample of the user;

converting, by the portable device, the biometric sample into a first biometric template;

comparing, by the portable device, the first biometric template with a second biometric template stored on the portable device, and determining a match result;

receiving, by the portable device from the resource provider computer, via the user device, interaction data comprising a transaction amount;

generating, by the portable device, a cryptogram by encrypting at least the interaction data comprising the transaction amount, access data stored on the portable device, and the match result, or a derivative of the interaction data comprising the transaction amount, the access data, and the match result with an encryption key; and

transmitting, by the portable device, the cryptogram and the access data stored on the portable device, to the resource provider computer via the user device, wherein the resource provider computer generates and transmits an authorization request message comprising the access data, the transaction amount and the cryptogram to a remote server computer, which verifies the cryptogram by decrypting the cryptogram to recover inputs to the cryptogram including the interaction data comprising the transaction amount and the match result, or the derivative of the interaction data comprising the transaction amount, the access data, and the match result, analyzes the match result or the derivative of the interaction data comprising the transaction amount, the access data, and the match result, verifies the cryptogram by comparing the interaction data comprising the transaction amount from the cryptogram to the interaction data comprising the transaction amount in the authorization request message, and by comparing the access data in the cryptogram to the access data in the authorization request message, and allows the interaction to continue using the access data based upon the verification of the cryptogram and the analysis of the match result.

2. The method of claim 1 , wherein the encryption key is symmetric key.

3. The method of claim 1 , wherein the portable device is in the form of a card.

4. The method of claim 1 , wherein the derivative of the interaction data is a hash of the interaction data and wherein the method further comprises:

hashing the interaction data.

5. The method of claim 1 , wherein the biometric sample is a fingerprint, a retinal scan, a facial scan, or a voice sample.

6. The method of claim 1 , wherein the remote server computer is an authorizing entity computer configured to allow or deny access to secure data.

7. The method of claim 1 , wherein the remote server computer is a processing computer.

8. The method of claim 1 , further comprising, prior to receiving the interaction data:

transmitting, by the portable device to the remote server computer, a request for the interaction data.

9. A portable device capable of being coupled to a user device, the user device capable of establishing, a first communication between the user device and a resource provider computer operating a host site in an interaction between the host site and a user of the user device, comprising:

a processor;

a memory; and

a computer readable medium, the computer readable medium comprising code, executable by the processor, to implement a method comprising:

after establishing the first communication, establishing, a second communication between the user device and the portable device of the user;

capturing, a biometric sample of the user;

converting, the biometric sample into a first biometric template;

comparing, the first biometric template with a second biometric template stored on the portable device, and determining a match result;

receiving from the resource provider computer, via the user device, interaction data comprising a transaction amount;

generating, a cryptogram by encrypting at least the interaction data comprising the transaction amount, access data stored on the portable device, and the match result, or a derivative of the interaction data comprising the transaction amount, the access data stored on the portable device, and the match result, with an encryption key; and

transmitting, the cryptogram and the access data stored on the portable device, to the resource provider computer via the user device, wherein the resource provider computer generates and transmits an authorization request message comprising the access data, the transaction amount and the cryptogram to a remote server computer, which verifies the cryptogram by decrypting the cryptogram to recover inputs to the cryptogram including the interaction data and the match result, or the derivative of the interaction data and the match result, analyzes the match result or the derivative of the interaction data comprising the transaction amount, the access data, and the match result, verifies the cryptogram by comparing the interaction data comprising the transaction amount from the cryptogram to the interaction data comprising the transaction amount in the authorization request message, and by comparing the access data in the cryptogram to the access data in the authorization request message, and allows the interaction to proceed using the access data based upon the verification of the cryptogram and the analysis of the match result.

10. The portable device of claim 9 , wherein the encryption key is a symmetric key.

11. The portable device of claim 9 , wherein the portable device is in the form of a card.

12. The portable device of claim 9 , wherein the portable device is in the form of a phone.

13. The portable device of claim 9 , wherein the biometric sample is a fingerprint, a retinal scan, a facial scan, or a voice sample.

14. The portable device of claim 9 , wherein the portable device comprises a reader device configured to read data from the portable device.

15. The portable device of claim 9 , wherein the encryption key is stored in the memory and wherein the memory is a secure memory.

16. The portable device of claim 9 , wherein the interaction data comprises a time stamp.