System and method for authorizing access to access-controlled environments
Systems and methods are provided for authorizing a user to access an access-controlled environment. The system includes a system server platform that communicates with fixed PC's, servers and mobile devices (e.g., smartphones) operated by users. The systems and methods described herein enable a series of operations whereby a user attempting to access an access-controlled environment is prompted to biometrically authenticate using the user's preregistered mobile device. Biometric authentication can include capturing images of the user's biometric features, encoding the features as a biometric identifier, comparing the biometric identifier to a previously generated biometric identifier and determining liveness. In addition, the authentication system can further authorize the user and electronically grant access to the access-controlled environment. In this manner the secure authentication system can, based on biometric authentication, authorize a user's access to devices, online services, physical locations or any networked environment that require user authorization.
1. A method for securely authenticating a user operating a user computing device, the user computing device executing a biometric authentication application for confirming the user's identity as a function of a biometric feature of the user, the method comprising the steps of:
receiving, by the trusted server from the user computing device, a representation of the user's identity and a representation of at least one component of the user computing device, and wherein the user computing device is the user's personal mobile computing device;
testing the representation of the user's identity against a trusted set of user identification information to verify the user's identity;
providing a unique identifier that is assigned to the user based on verifying the user's identity;
causing, by the trusted server during user enrollment, generation of a key-pair comprising a private key and a corresponding public key, wherein the private key and the unique identifier is stored by a user device;
storing, by the trusted server in a storage medium, the public key in association with the assigned unique identifier thereby creating a registered user identity instance as a function of verifying the user's identity, and generation of the key-pair;
receiving, by the trusted server from the user device, a communication including: information asserting an identity of one or more of the user and the user device, a representation of the private key, and a current biometric representation of the user's biometric features captured by the user device using an associated biometric capture device;
authenticating the user, wherein the step of authenticating comprises:
identifying, by the trusted server based on the received information asserting an identity of one or more of the user and the user device, the user identity instance,
verifying, by the trusted server based on the public key associated with the identified user identity instance, that the representation of the private key corresponds to the public key, and
confirming, by the trusted server, that the current biometric representation captured by the user device matches a registered biometric representation of the user previously stored by the server in association with the identified user identity instance; and
transmitting, by the trusted server to one or more remote computing devices, a result of the step of authenticating.
2. The method of claim 1 , wherein the key-pair is unique to the user device and the corresponding user identity instance stored on a back-end storage such that the private key is useable by the user device to securely assert the user's identity and the public key is useable by the trusted server to identify the user's identity.
3. The method of claim 1 , wherein the key-pair is generated using one or more of the user device and the trusted server.
4. The method of claim 1 , further comprising the steps of:
receiving, by the trusted server subsequent to creating the user identity instance for the user, a request to authenticate the user in connection with the user accessing an access controlled environment (ACE), wherein the request identifies the ACE and the user.
5. The method of claim 4 , wherein the request identifies a requested transaction to be performed by the user accessing the ACE and wherein the step of authenticating is performed according to a level of security defined by the ACE for the requested transaction.
6. The method of claim 5 , further comprising the step of performing additional biometrics-based user authentication as a function of the level of security.
7. The method of claim 4 , wherein the step of transmitting comprises transmitting an authorization notification to a legacy authentication system of the ACE.
8. The method of claim 7 , further comprising:
facilitating the user's access to the ACE, wherein the step of facilitating includes:
retrieving by the trusted server from a secure data store, account information associated with the user identity instance and the ACE; and
transmitting the account information to the legacy authentication system.
9. The method of claim 1 , wherein the step of testing comprises testing, by the trusted server, the representation of the user's identity against the trusted set of user identification information, wherein the trusted set of user identification information is maintained by a legacy authentication system of an access controlled environment (ACE).
10. The method of claim 1 , wherein the unique identifier is stored by the trusted server in the storage medium and is associated with access account information that is useable to provide the user with access to an access controlled environment (ACE).
11. The method of claim 10 , wherein communications from the user device that are encoded using the private key securely assert the user's identity to the trusted server and are useable to identify any associated access account information.
12. A system for securely authenticating a user operating a user computing device, the user computing device being the user's personal mobile computing device and executing a biometric authentication application for confirming the user's identity as a function of a biometric feature of the user, the system comprising:
a network communication interface;
a computer-readable storage medium;
one or more processors configured to interact with the network communication interface and the computer-readable storage medium and execute one or more software modules stored on the storage medium, the one or more processors including;
an enrollment module that, when executed, configures the one or more processors to perform the steps of:
receiving, from the user computing device, a representation of the user's identity,
testing the representation of the user's identity against a trusted set of user identification information to verify the user's identity,
providing a unique identifier that is assigned to the user based on verifying the representation of the user's identity, and
causing generation of a key pair comprising a private key and a corresponding public key, wherein the private key is stored by a user device;
a database module that, when executed, configures the one or more processors to store the public key in association with the assigned unique identifier thereby creating a registered user identity instance as a function of verifying the user's identity and generation of the key pair;
a communication module that, when executed, configures the one or more processors to receive, from the user device, a communication including: information asserting an identity of one or more of the user and the user device, a representation of the private key, and a current biometric representation of the user's biometric features captured by the user device using an associated biometric capture device; and
an authorization module that, when executed, configures the one or more processors to authenticate the user based on the received communication, wherein the authentication includes the steps of:
identifying, based on the received information asserting an identity of one or more of the user and the user device, the user identity instance,
verifying, based on the public key associated with the identified user identity instance, that the representation of the private key corresponds to the public key,
confirming that the current biometric representation captured by the user device matches a registered biometric representation of the user previously stored by the server in association with the identified user identity instance, and
transmitting, based on the authentication of the user, by a trusted server to one or more remote computing devices, a result of the authentication of the user.
13. The system of claim 12 , wherein the key-pair is unique to the user device and the corresponding user identity instance stored on the back-end storage such that the private key is useable by the user device to securely assert the user identity and the public key is useable by the trusted server to identify the user identity.
14. The system of claim 12 , wherein the key-pair is generated using one or more of the user device and the trusted server.
15. The system of claim 12 , wherein the communication module further configures the one or more processors of the trusted server to receive, by the trusted server subsequent to creating the user identity instance for the user, a request to authenticate the user in connection with the user accessing an access controlled environment (ACE), wherein the request identifies the ACE and the user.
16. The system of claim 15 , wherein the request identifies a requested transaction to be performed by the user accessing the ACE and wherein the authentication of the user is performed by the trusted server according to a level of security defined by the ACE for the requested transaction.
17. The system of claim 16 , wherein the one or more processors are further configured to perform the step of performing additional biometrics-based user authentication as a function of the level of security.
18. The system of claim 12 , wherein the network communication interface communicatively connects the one or more processors of the trusted server with a legacy authentication system of an access controlled environment (ACE) and wherein the authorization module configures the one or more processors to facilitate the user's access by transmitting an authorization notification to the legacy authentication system of the ACE.
19. The system of claim 18 , wherein the authorization module configures the one or more processors to facilitate the user's access by retrieving account information associated with the user identity instance and the ACE from a secure data store and transmitting the account information to the legacy authentication system.
20. The system of claim 18 , wherein the enrollment module configures the one or more processors to test the representation of the user's identity to verify the user is authorized to access the ACE by comparing the representation of the user's identity to a trusted set of user identification information maintained by the legacy authentication system of the ACE.