Methods and systems for secure and reliable identity-based computing
The embodiments herein provide a secure computing resource set identification, evaluation, and management arrangement, employing in various embodiments some or all of the following highly reliable identity related means to establish, register, publish and securely employ user computing arrangement resources in satisfaction of user set target contextual purposes. Systems and methods may include, as applicable, software and hardware implementations for Identity Firewalls; Awareness Managers; Contextual Purpose Firewall Frameworks for situationally germane resource usage related security, provisioning, isolation, constraining, and operational management; liveness biometric, and assiduous environmental, evaluation and authentication techniques; Repute systems and methods assertion and fact ecosphere; standardized and interoperable contextual purpose related expression systems and methods; purpose related computing arrangement resource and related information management systems and methods, including situational contextual identity management systems and methods; and/or the like.
1. A secure identity device arrangement, such secure identity device arrangement enabling reliable secure human identification, the secure identity device arrangement comprising:
security hardened identity device arrangement packaging;
a sensor set arrangement including at least one sensor, for acquiring biometric identification information, configured to detect electromagnetic radiation and/or sound, the sensor set arrangement configured for at least in part establishing, and subsequently authenticating, a human subject's biometric identification information;
a biometric identification liveness testing arrangement including at least one processor and associated memory and configured to perform biometric identification physical presence liveness testing involving time stamped, correlated emitter and sensor information, such testing involving identification of (1) timing discontinuity, (2) timing overhead delay, and/or (3) other sensed signal inconsistencies with emitted signal information,
wherein the biometric identification liveness testing arrangement comprises: (a) an emitter arrangement including an emitter and configured to provide electromagnetic radiation and/or sound, (b) such emitter arrangement's emission control arrangement including at least one processor and associated memory, where such emission control arrangement controls such emitter arrangement's provision of electromagnetic radiation and/or sound to produce at least in part unpredictable emitter output for painting at least a portion of such human subject, (c) a sensor set arrangement, for acquiring information for timing analysis, configured at least in part for receiving information corresponding to such emitter radiation, and (d) a secure clock arrangement including a trusted clock and configured for time stamping emitter emission timing information and/or sensor receiving timing information;
at least one cryptographic arrangement including at least one processor and associated memory and including a protected repository, located within such security hardened identity device arrangement packaging, at least in part configured for enabling secure communication with a remote administrative and/or cloud service identity arrangement including a server, such secure communication enabling the performance of secure human identification information verification similarity matching using such human subject's registered and securely maintained identification information;
a processing device arrangement located within such security hardened identity device arrangement packaging, comprising a secure operatively isolated processor, at least in part configured for processing such human subject's biometric identification information,
wherein such processing device arrangement is contained in a parent computing device arrangement including at least one processor and associated memory, such processing device arrangement configured to:
operate one or more authenticated and authorized load modules configured for performing identity operations using one or more protected processing environments to enable trusted identity operations, at least one of any such protected processing environments isolated from external processes, and
isolate operating resource sets from corruption, misdirection, subversion, observation, and/or other forms of interference using external resource sets; and at least one memory component configured for securely storing at least a portion of such human subject's biometric identification information.
2. The secure identity device arrangement of claim 1 , wherein such time stamping of emitter emission timing information and/or sensor receiving timing information enables cross-correlating emitter output and sensor input signals according to such clock arrangement's secure time stamping.
3. The secure identity device arrangement of claim 1 , wherein such parent computing device arrangement is configured to hibernate during one or more of the trusted identity operations of such contained processing device arrangement, such hibernation providing protection against interference with such identity device arrangement's operations.
4. The secure identity device arrangement of claim 1 , wherein such human subject's biometric identification information is at least in part derived from 2D image-acquisition-over-time pattern information, and
wherein such 2D image-acquisition-over-time information is used to test for 3D physical presence liveness of such human subject by calculating such human subject's corresponding 3D image pattern set using such 2D image pattern set information.
5. The identity device arrangement of claim 1 , wherein such security hardened identity device arrangement packaging contains a plurality of protected processing environments that respectively isolate different trusted identity related operations.
6. The secure identity device arrangement of claim 1 , wherein biometric identification and liveness information of the human subject, and at least a portion of such biometrically identified human subject's registered, securely associated attribute information, is stored within such security hardened identity device arrangement packaging, wherein at least a portion of such attribute information is employed in authorizing computing activities of such identified human subject.
7. The secure identity device arrangement of claim 1 , wherein such processing device arrangement comprises a protected processing environment that enables extraction and correlation processing that includes human subject (a) feature extraction and/or (b) temporal pattern extraction.
8. The secure identity device arrangement of claim 1 , wherein each of a plurality of component identity device arrangements contains such human subject's biometric identification information, wherein each of such plurality of component identity device arrangements includes at least one processor and associated memory and employs security hardened identity device arrangement packaging.
9. The secure identity device arrangement of claim 1 , wherein a secure identity device arrangement processing arrangement instructs such emitter arrangement to provide in its output an encrypted emission challenge comprising tamper resistant challenge information used in authenticating the presence of a human biometrically identified subject.
10. The secure identity device arrangement of claim 9 , wherein such challenge is at least in part generated by a pseudo random generator located within such processing device arrangement.
11. The secure identity device arrangement of claim 1 , wherein such security hardened identity device arrangement's protected processing environment arrangement at least in part is enabled to securely perform plural registrations of a user's biometric identification with plural registration services.
12. The secure identity device arrangement of claim 1 , wherein such parent computing device arrangement is a mobile computing device.
13. The secure identity device arrangement of claim 1 , wherein at least one component arrangement including at least one processor and associated memory of such security hardened identity device arrangement packaging includes at least one of (a) a sensor arrangement, or (b) an emitter arrangement.
14. The secure identity device arrangement of claim 1 , wherein such emission control arrangement operates at least in part in such remote administrative and/or cloud service identity arrangement.
15. The secure identity device arrangement of claim 1 , wherein such portion of a human subject comprises at least one of a finger, an iris, a retina, vasculature, or a face.
16. The secure identity device arrangement of claim 1 , wherein the biometric identification sensor set arrangement and the timing analysis information acquiring sensor set arrangement are the same sensor set arrangement.
17. A method for establishing reliable secure human identification, such method comprising:
providing, through use of a computing arrangement including at least one processor and associated memory, at least one of one or more standardized resources and specifications, wherein such providing enables operating a secure identity device arrangement for enabling reliable secure human identification, wherein such secure identity device arrangement comprises:
security hardened identity device arrangement packaging;
a sensor set arrangement including at least one sensor, for acquiring biometric identification information, configured to detect electromagnetic radiation and/or sound, the sensor set arrangement configured for at least in part establishing, and subsequently authenticating, a human subject's biometric identification information;
a biometric identification liveness testing arrangement including at least one processor and associated memory and configured to perform biometric identification physical presence liveness testing involving time stamped, correlated emitter and sensor information, such testing involving identification of (1) timing discontinuity, (2) timing overhead delay, and/or (3) other sensed signal inconsistencies with emitted signal information,
wherein the biometric identification liveness testing arrangement comprises: (a) an emitter arrangement including an emitter and configured to provide electromagnetic radiation, and/or sound, (b) such emitter arrangement's emission control arrangement, including at least one processor and associated memory, where such emission control arrangement controls such emitter arrangement's provision of electromagnetic radiation and/or sound to produce at least in part unpredictable emitter output for painting at least a portion of such human subject, (c) a sensor set arrangement, for acquiring information for timing analysis, configured at least in part for receiving information corresponding to such emitter radiation, and (d) a secure clock arrangement including a trusted clock and configured for time stamping emitter emission timing information and/or sensor receiving timing information;
at least one cryptographic arrangement including at least one processor and associated memory and including a protected repository, located within such security hardened identity device arrangement packaging, at least in part configured for enabling secure communication with a remote administrative and/or cloud service identity arrangement including a server, such secure communication enabling the performance of secure human identification information verification similarity matching using such human subject's registered and securely maintained identification information;
a processing device arrangement located within such security hardened identity device arrangement packaging, comprising a secure operatively isolated processor, at least in part configured for processing such human subject's biometric identification information,
wherein such processing device arrangement is contained in a parent computing device arrangement including at least one processor and associated memory, such processing device arrangement configured to:
operate one or more authenticated and authorized load modules configured for performing identity operations using one or more protected processing environments to enable trusted identity operations, at least one of any such protected processing environments isolated from external processes, and
isolate operating resource sets from corruption, misdirection, subversion, observation, and/or other forms of interference using external resource sets; and
at least one memory component configured for securely storing at least a portion of such human subject's biometric identification information.
18. The method of claim 17 , wherein such providing enables such time stamping of emitter emission timing information and/or sensor receiving timing information enables cross-correlating emitter output and sensor input signals according to such clock arrangement's secure time stamping.
19. The method of claim 17 , wherein such providing enables such parent computing device arrangement to be configured to hibernate during one or more of the trusted identity operations of such contained processing device arrangement, such hibernation providing protection against interference with such identity device arrangement's operations.
20. The method of claim 17 , wherein such providing enables deriving such human subject's biometric identification information at least in part from 2D image-acquisition-over-time pattern set information, and
wherein such 2D image-acquisition-over-time information is used to test for 3D physical presence liveness of such human subject by calculating such human subject's corresponding 3D image pattern set using such 2D image pattern set information.
21. The method of claim 17 , wherein such providing enables including a plurality of protected processing environments that respectively isolate different trusted identity related operations.
22. The method of claim 17 , wherein such providing enables storing biometric identification and liveness information of the human subject, and at least a portion of such biometrically identified human subject's registered, securely associated attribute information within such security hardened identity device arrangement packaging, wherein at least a portion of such attribute information is employed in authorizing computing activities of such identified human subject.
23. The method of claim 17 , wherein such providing enables such processing device arrangement comprising a protected processing environment to enable extraction and correlation processing that includes human subject (a) feature extraction and/or (b) temporal pattern extraction.
24. The method of claim 17 , wherein such providing enables a plurality of component identity device arrangements, the component identity device arrangements including at least one processor and associated memory, to respectively contain such human subject's biometric identification information, wherein each of such plurality of component identity device arrangements employs security hardened identity device arrangement packaging.
25. The method of claim 17 , wherein such providing enables a secure identity device arrangement's processing arrangement to instruct such emitter arrangement to provide in its output an encrypted emission challenge comprising tamper resistant challenge information used in authenticating the presence of a human biometrically identified subject.
26. The method of claim 25 , wherein such providing enables generating such challenge at least in part by a pseudo random generator located within such processing device arrangement.
27. The method of claim 17 , wherein such providing enables such security hardened identity device arrangement's protected processing environment arrangement at least in part to securely perform plural registrations of a user's biometric identification with plural registration services.
28. The method of claim 17 , wherein such providing enables such parent computing device arrangement to be a mobile computing device.
29. The method of claim 17 , wherein such providing enables at least one component arrangement including at least one processor and associated memory of such security hardened identity device arrangement packaging to include at least one of (a) a sensor arrangement, or (b) an emitter arrangement.
30. The method of claim 17 , wherein such providing enables such emission control arrangement to operate at least in part in such remote administrative and/or cloud service identity arrangement.
31. The method of claim 17 , wherein such providing enables such portion of a human subject to comprise at least one of a finger, an iris, a retina, vasculature, or a face.
32. The method of claim 17 , wherein such providing enables the biometric identification sensor set arrangement and the timing analysis information acquiring sensor set arrangement to be the same sensor set arrangement.