Secure method and apparatus to verify personal identity over a network
The present application provides an apparatus and method for verifying a user, via captured biometric characteristics of the user, who is interacting online. The captured biometrics are guaranteed to be captured in real-time, and avoids the possibility of providing biometrics that were previously captured, by sending to the user a time-sensitive challenge and requiring the user to provide the requested biometric information within a predetermined time period. Therefore, the present invention is best positioned for environments where trusted identification of a user is needed online to facilitate secure transactions.
1. A system for on-demand authentication of a user as an owner of an avatar interacting in a virtual world environment, said system comprising:
means for issuing, from a first computing device, a temporary challenge to the user interacting in said virtual world environment at a second computing device, said temporary challenge issued with limited time life for authenticating the user, and said temporary challenge being encrypted with a public key of said user, said public key employed as part of a public key encryption algorithm;
means for receiving, at said second computing device, said temporary challenge with limited time life, said second computing device having a memory storage device including a protected memory storing a private key of the user;
means for decrypting said received temporary challenge with said private key;
means for capturing biometric information of the user in response to the received temporary challenge from the first computing device;
means for hashing the biometric information at said second computing device;
means for encrypting the hash of the captured biometric information concatenated with the received challenge as an encrypted response, said encrypting means employing said stored private user key of the user;
means for returning the encrypted response to the first computing device; and
means for authenticating the user at said first computing device by processing the encrypted challenge within a limited amount of time.
2. The system according to claim 1 , wherein the public key encryption algorithm includes RSA algorithm.
3. The system according to claim 1 , wherein the hashing is according to at least one of an MD5 hash algorithm and an SHA-1 hash algorithm.
4. The system according to claim 1 , wherein the received challenge was transmitted by a virtual world server.
5. The system according to claim 1 , wherein the biometric information includes digitally captured human characteristics of at least one of a fingerprint, a handprint, a hand-written signature, an iris and a retina.
6. The system according to claim 1 , wherein said limited time life is on the order of minutes, or an amount of time to allow transmission of the temporary challenge, capture of the user's biometric pattern and return of the hash/encrypted response by the user.
7. A method for on-demand authentication of a user as an owner of an avatar interacting in a virtual world environment, said method comprising:
issuing, from a first computing device, a temporary challenge to the user interacting in said virtual world environment at a second computing device, said temporary challenge issued with limited time life for authenticating the user, and said temporary challenge being encrypted with a public key of said user, said public key employed as part of a public key encryption algorithm;
receiving, at said second computing device, said temporary challenge with limited time life, said second computing device having a memory storage device including a protected memory storing a private key of the user;
decrypting said received temporary challenge with said private key;
capturing, at the user device, biometric information of the user in response to the received temporary challenge;
hashing the biometric information at said second computing device;
encrypting, using said stored private user key of the user, the hash of the captured biometric information concatenated with the received temporary challenge as an encrypted response;
returning the encrypted response to the first computing device; and
authenticating the user at said first computing device by processing the encrypted challenge within a limited amount of time.
8. The method according to claim 7 , wherein the public key encryption algorithm includes RSA algorithm.
9. The method according to claim 7 , wherein the hashing is according to at least one of an MD5 hash algorithm and an SHA-1 hash algorithm.
10. The method according to claim 7 , wherein the first computing device is a virtual world server.
11. The method according to claim 7 , wherein the biometric information includes digitally captured human characteristics of at least one of a fingerprint, a handprint, a hand-written signature and an iris.
12. The method according to claim 7 , wherein said limited time life is on the order of minutes, or an amount of time sufficient to allow transmission of the temporary challenge, capture of the user's biometric pattern and return of the hash/encrypted response by the user.