Granted Patent B2

US 12,282,539 · App. 17/703,115 · Granted Apr 22, 2025

Inventors: Sunpreet Singh Arora (San Mateo, CA); Maliheh Shirvanian (Cupertino, CA)

Assignee: Visa International Service Association

G06F21/45H04L63/0861H04L63/0884

Abstract

Claims (48)

1. A method comprising:

receiving, by an authentication server computer, from a public device, a validation request message, the validation request message including an identifier of a communication device associated with a user;

transmitting, by the authentication server computer, to the communication device, a delegation confirmation message;

receiving, by the authentication server computer, from the communication device, a delegation confirmation response;

transmitting, by the authentication server computer, to a token server computer, a request for an interaction token;

receiving, by the authentication server computer, from the token server computer, the interaction token; and

transmitting, by the authentication server computer, to the communication device, the interaction token, wherein the communication device locks the interaction token in a data vault using a biometric template associated with the user.

2. The method of claim 1 , wherein the data vault was formed using a fuzzy vault scheme.

3. The method of claim 1 , wherein the communication device transmits the data vault to the public device which stores the data vault.

4. The method of claim 1 , wherein the data vault comprises a number of random points.

5. The method of claim 1 , wherein the communication device is a mobile phone.

6. The method of claim 1 , wherein the communication device transmits the data vault to the public device which stores the data vault, and wherein the communication device is a mobile phone and the public device is a computational device generally accessible to the public.

7. The method of claim 1 , wherein the validation request message further comprises a user identifier.

8. The method of claim 1 , wherein the delegation confirmation message comprises a prompt which requests confirmation from the user of the communication device regarding a desire to delegate biometric authentication to the public device.

9. The method of claim 1 , wherein the interaction token can be used for has a limited number of interactions for which the interaction token can be used by the user.

10. The method of claim 1 , wherein the data vault is in the form of a two-dimensional array of points comprising a plurality of biometric points and a plurality of random points.

11. The method of claim 1 , wherein the authentication server computer maintains a registry of users and communication devices.

12. The method of claim 1 , wherein the interaction token is a substitute for a credential.

13. The method of claim 1 , wherein the biometric template is derived from a face scan, an iris scan, a retina scan, a thumbprint scan, or a voice recording.

14. An authentication server computer comprising:

a processor; and

a non-transitory computer readable medium comprising code, when executed by the processor, causes the authentication server computer to perform operations comprising:

receiving, from a public device, a validation request message, the validation request message including an identifier of a communication device associated with a user;

transmitting to the communication device, a delegation confirmation message;

receiving from the communication device, a delegation confirmation response;

transmitting to a token server computer, a request for an interaction token;

receiving from the token server computer, the interaction token; and

transmitting to the communication device, the interaction token, wherein the communication device locks the interaction token in a data vault using a biometric template associated with the user.

15. The authentication server computer of claim 14 , wherein the interaction token is a substitute for a credential.

16. The authentication server computer of claim 14 , further comprising a database comprising a registry of users and communication devices.

17. The authentication server computer of claim 14 , wherein the identifier of the communication device is a phone number.

18. The authentication server computer of claim 14 , wherein the validation request message further comprises a user identifier.

19. A system comprising:

an authentication server computer comprising

a first processor, and

a first non-transitory computer readable medium comprising code, when executed by the first processor, causes the authentication server computer to perform operations comprising:

receiving, from a public device, a validation request message, the validation request message including an identifier of a communication device associated with a user,

transmitting to the communication device, a delegation confirmation message,

receiving from the communication device, a delegation confirmation response,

transmitting to a token server computer, a request for an interaction token,

receiving from the token server computer, the interaction token, and

transmitting to the communication device, the interaction token, wherein the communication device locks the interaction token in a data vault using a biometric template associated with the user; and

the token server computer comprising,

a second processor, and

a second non-transitory computer readable medium comprising code, when executed by the second processor, causes the authentication server computer to perform operations comprising,

receiving the request for the interaction token from the authentication server computer, and

transmitting the interaction token to the authentication server computer.

20. The system of claim 19 , further comprising the communication device.

Continuity (2)

References Cited (34)