Systems and methods for linking an authentication account to a device
Systems and methods for linking an authentication account to a device may include processor(s) to maintain a plurality of authentication profiles, each authentication profile corresponding to a respective user and including at least one profile image, an immutable identifier, and authentication data used to authenticate the respective user. The processor(s) may receive a request including the device key, an immutable identifier, and a biometric image captured by a camera of a client device. The processor(s) may identify a subset of authentication profiles having respective immutable identifiers that match the immutable identifier from the request. The processor(s) may compare feature(s) extracted from the biometric image of the request to features extracted from the a profile image of the subset of authentication profiles, and link the device key of the client device with an authentication profile in a data structure to register the client device with the authentication server.
1. A method comprising:
receiving, by an authentication server from a client device of a user, via a session between the authentication server and an authentication service executing on the client device, a request including a new device key of the client device generated by the authentication service, an immutable identifier for the user, and a biometric image captured during the session by a camera of the client device;
authenticating, by the authentication server, the biometric image as captured by the camera of the client device during the session;
identifying, by the authentication server, from a plurality of authentication profiles, a subset of authentication profiles, the subset of authentication profiles comprising two or more authentication profiles having respective immutable identifiers which match the immutable identifier from the request; and
linking, by the authentication server, responsive to determining that one or more features of the biometric image match features of at least one profile image of an authentication profile of the subset of authentication profiles, the new device key of the client device with the authentication profile, to register the client device with the authentication profile.
2. The method of claim 1 , further comprising:
comparing, by the authentication server, the one or more features from the biometric image to the features of the at least one profile image of the authentication profile of the subset of authentication profiles.
3. The method of claim 1 , wherein the request includes an image of an identification document (ID), the method further comprising:
identifying, by the authentication server, the immutable identifier and a second image of a face of the user from the ID; and
comparing, by the authentication server, the biometric image with the second image from the ID.
4. The method of claim 3 , further comprising:
authenticating, by the authentication server, the user based on a comparison of one or more first features extracted from the biometric image and one or more second features extracted from the second image.
5. The method of claim 1 , wherein the authentication server authenticates the biometric image as captured by the camera of the client device during the session, based on a cryptographic assertion received from the client device.
6. The method of claim 1 , further comprising:
determining, by the authentication server, to identify the subset of authentication profiles based on determining that the new device key does not match a known device key stored in the data structure.
7. The method of claim 1 , wherein the immutable identifier comprises a date of birth of the user, and wherein the subset of authentication profiles are identified based on having respective dates of birth which match the date of birth of the user corresponding to the request.
8. The method of claim 1 , further comprising:
transmitting, by the authentication server to the client device, a second request to merge the new device key of the client device with the authentication profile.
9. The method of claim 8 , wherein linking the new device key of the client device with the authentication profile is based on a response to the second request.
10. The method of claim 1 , further comprising:
receiving, by the authentication server from the authentication service of the client device responsive to linking the device key to the authentication profile, a second request to authenticate the user of the client device to a resource server, the second request including a second biometric image; and
authenticating, by the authentication server, the user of the client device to the resource server, based on the second biometric image.
11. The method of claim 1 , further comprising receiving, by the authentication server, from the authentication service, a selection to merge the new device key with the authentication profile, wherein the authentication server links the new device key of the client device with the authentication profile, responsive to determining that the one or more features from the biometric image match the features extracted from the at least one profile image of the authentication profile and according to the selection.
12. An authentication system comprising:
one or more authentication servers configured to:
receive, from a client device of a user, via a session between the one or more authentication servers and an authentication service executing on the client device, a request including a new device key of the client device generated by the authentication service, an immutable identifier of the user, and a biometric image captured during the session by a camera of the client device;
authenticate the biometric image as captured by the camera of the client device during the session;
identify, from a plurality of authentication profiles, a subset of authentication profiles, the subset of authentication profiles comprising two or more authentication profiles having respective immutable identifiers that match the immutable identifier from the request; and
link, responsive to determining that one or more features of the biometric image match features of at least one profile image of an authentication profile of the subset of authentication profiles, the new device key of the client device with the authentication profile, to register the client device with the authentication profile.
13. The authentication system of claim 12 , wherein the one or more authentication servers are configured to:
compare the one or more features from the biometric image to the features of the at least one profile image of the authentication profile of the subset of authentication profiles.
14. The authentication system of claim 12 , wherein the request includes an image of an identification document (ID), wherein the one or more authentication servers are configured to:
identify the immutable identifier and a second image of a face of the user from the ID;
compare the biometric image with the second image from the ID; and
authenticate the user based on a comparison of one or more first features extracted from the biometric image and one or more second features extracted from the second image.
15. The authentication system of claim 12 , wherein the authentication server authenticates the biometric image as captured by the camera of the client device during the session, based on a cryptographic assertion received from the client device.
16. The authentication system of claim 12 , wherein the one or more authentication servers are configured to:
determine to identify the subset of authentication profiles based on determining that the new device key does not match a known device key stored in the data structure.
17. The authentication system of claim 12 , wherein the immutable identifier comprises a date of birth of the user, and wherein the subset of authentication profiles are identified based on having respective dates of birth which match the date of birth of the user corresponding to the request.
18. The authentication system of claim 12 , wherein the one or more authentication servers are configured to:
transmit, to the client device, a second request to merge the new device key of the client device with the authentication profile,
wherein linking the new device key of the client device with the authentication profile is based on a response to the second request.
19. The authentication system of claim 12 , wherein the one or more authentication servers are configured to:
receive, from the authentication service of the client device responsive to linking the device key to the authentication profile, a second request to authenticate the user of the client device to a resource server, the second request including a second biometric image; and
authenticate the user of the client device to the resource server, based on the second biometric image.
20. The authentication system of claim 12 , wherein the one or more authentication servers are configured to receive, from the authentication service, a selection to merge the new device key with the authentication profile,
wherein the one or more authentication servers link the new device key of the client device with the authentication profile, responsive to determining that the one or more features from the biometric image match the features extracted from the at least one profile image of the authentication profile and according to the selection.