USING EXISTING DATABASES

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of, and priority to, U.S. Patent Application Nos. 62/431 .609 filed on December 8, 2016 and 15/583.1 74 filed May 1, 2017. The entire disclosure of the above applications are incorporated herein by reference.

BACKGROUND

A user is often asked for authentication when initiating an electronic communication. For example, where the user wishes to secure items over the

Internet, the user is asked for authentication (i.e., proof that the user initiating the communication is who they say they are) before remuneration occurs. Such authentication is typically a password or security code that is associated with an identity of an account used to obtain the merchandise or service.

Many databases containing biometric templates already exist. For example, in India there is a unique identifier (ID) server that hosts a database with fingerprint templates of over one billion people. Other countries have similar databases. These databases are for example run by governments. Thus, many people have their biometric information already stored in a database in association with a unique identifying number. With the wide availabilit of biometric scanners in smartphones, these databases may be used to authenticate a user by capturing a biometric image and sending it to the existing database for authentication against a corresponding biometric template.

SUMMARY

One embodiment relates to a method for biometric authentication using external databases. A server receives a request for authentication of a user from a requestor. A notification is sent to a user device associated with the user from the server. A biometric image is received within the server in response to the notification. A biometric ID of the user is sent from the server to an external database for identifying a biometric template stored with the external database. An authentication result indicative of a match between the biometric image and the biometric template is determined and the authentication result is sent to the requestor.

Another embodiment relates to a biometric authentication server for biometric authentication using external databases. The biometric authentication server includes a user device interface for communicating with a user device, a database interface for communicating with a third party database, a processor, and a memory communicatively coupled to the processor and storing machine readable instructions that when executed by the processor perform the steps of: receiving , from a requestor, a request for authentication of a user; sending a notification to a user device associated with the user; receiving a biometric image associated with the user in response to the notification; sending a biometric ID of the user to an external database for identifying a biometric template stored with the external database;

determining an authentication result indicative of a match between the biometric image and the biometric template; and sending the authentication result to the requestor.

Another embodiment relates to a non-transitory computer readable medium with computer executable instructions stored thereon is executed by a processor of a server to perform the method of biometric authentication using external databases. The medium includes instructions for receiving, from a requestor, a request for authentication of a user; instructions for sending a notification to a user device associated with the user; instructions for receiving a biometric image associated with the user in response to the notification; instructions for sending a biometric ID of the user to an external database for identifying a biometric template stored with the external database; instructions for determining an authentication result indicative of a match between the biometric image and the biometric template; and instructions for sending the authentication result to the requestor.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 shows one example system for leveraging existing databases for biometric authentication, in an embodiment.

FIG. 2 A is a flowchart illustrating one example method for biometric authentication using existing databases, in an embodiment.

FIG. 2B is a flowchart illustrating another example method for biometric authentication using existing databases, in an embodiment. FIG. 3 shows the biometric authentication server of FIG. 1 in further detail, in an embodiment.

FIG. 4 shows another example system for leveraging existing databases for biometric authentication, in an embodiment.

DETAILED DESCRIPTION OF THE EMBODIMENTS

FIG. 1 shows one example system 100 for leveraging existing databases for biometric authentication. In the example of FIG. 1 , a user device 102 interacts with a resource 130. User device 102 is a computer and includes a processor 104 communicatively coupled to a memory 106, and a camera 108. In certain embodiments, user device 102 also includes a fingerprint scanner 110. User device 102 is selected from the group including: a smartphone, a personal computer, tablet computer, a notebook computer, and so on. ·

To access or utilize resource 130, a user 120 may require authentication. Biometric templates of user 120 may be stored within an external database 180, owned and/or maintained by a third party, having been previously created for other purposes and/or resources for example. These previously created biometric templates may advantageously be used to authenticate user 120. For example, resource 130 may represent a merchant from where user 120 wishes to secure items over the Internet. Before remuneration occurs, user 120 is

advantageously authenticated using external database 180. Thus, even though user 120 has not specifically enrolled for authentication with resource 130, previously generated and stored biometric templates of user 120 are successfully used to authenticate user 120 to resource 130.

A user 120 uses user device 102 to send a request 122 to a web interface 132 of a resource 130 via a network 190. For example, user 120 may use user device 1 2 to request and/or change certain information at resource 130. In another example, user 120 uses user device 102 to select an item or service for procurement from web interface 132 of resource 130. Web interface 132 is for example a website and user 120 uses a resource app 112 running on user device 102 to select items to procure. Network 190 may represent one or more of the I nternet, a local area network, a cellular network, a wide area network, a financial transaction network, and so on. Resource 130, based upon request 122 from user device 102, invokes a user authenticator 134 to authenticate the authority of user 120 before fulfilling request 122. In certain embodiments, based upon attributes of request 122, resource 130 may require a certain type of authentication, and/or may require multiple types of authentication. User authenticator 1 4 sends an authentication request message 136 to a biometric authentication server 160. In embodiments, biometric authentication server 160 is a computer that includes a processor and memory (not shown) that operates to authenticate user 120 using a biometric template 184 corresponding to user 120. The biometric template 184 was previously generated for user 120 by a third party, and is stored within existing external database 1 80 of the third party. For example, the third party may represent one or more of a government entity, a security entity, and so on. External database 180 stores biometric template 184 in association with a biometric ID 182. Biometric ID 182 is an identi ying label (e.g., one or more of a social security number, a driving license number, a tax ID. a passport number. and so on) that uniquely identifies user 120. External database 180 may represent one of many such external databases run by the same or different parties to store biometric templates. External database 180 is selected for matching, for example, based upon the type of biometric captured. For example, where a fingerprint image is captured, external database 180 represents an existing database of fingerprint type biometric templates that may be used to authenticate user 120.

User 120 may have more than one uniquely identifying label, and an authenticator 162 of biometric authentication server 160 utilizes an ID lookup 164 to determine biometric ID 182 from other provided labels. For example, user 120 may enroll with biometric authentication server 160 and provide an association between a login ID 1 14, utilized by user device 102 to access web interface 132. and biometric ID 1 82, such that ID lookup 164 may determine biometric ID 182 from login ID 1 14 received from user authenticator 134 of resource 130.

In embodiments, after receiving authentication request message 136, authenticator 162 sends a notification 168 (e.g., a push notification) to user device 102 requesting biometric authentication. An authentication app 1 16, running within user device 102 is activated by notification 168, and interacts with user 120 to capture at least one biometric image 118 of user 120. For example, where user device 102 includes both camera 108 and fingerprint scanner 1 10, authentication app 1 16 may offer user 120 a choice of which of a facial image, an iris image, and a fingerprint image to capture as biometric image 118. Where user device 102 includes camera 108, but no fingerprint scanner, authentication app 1 16 instructs user 120 to capture one or more of a facial image and an iris image as biometric image 118. In certain embodiments, authentication app 1 16 may allow user 120 to capture a retinal image as biometric image 118, where camera 108 supports such image capture. Authentication app 1 16 then sends biometric image 118 to biometric authentication server 160 as message 124. In one embodiment, authentication app 1 16 is part of resource app 1 12.

Authenticator 162 receives message 124 with biometric image 1 18 and interacts with external database 180 to determine whether biometric image 118 matches biometric template 184 corresponding to biometric ID 182 determined by ID lookup 164. In one embodiment, message 124 also includes a unique device ID 103 that uniquely identifies user device 102, wherein authenticator 162 ensures that message is received from a device previously registered with biometric authentication server 160 by user 120. In another embodiment, unique device ID 103 is associated with authentication app 116. Authenticator 162 may process and convert biometric image 1 18 into a more suitable format (e.g., a template) for matching based upon the type of biometric it contains and the format of biometric template 184 of external database 1 80. In one embodiment, database interface 166 retrieves biometric template 184, identified by biometric ID 182, and then matches biometric image 1 18 to biometric template 184 to determine whether they match. In another embodiment, database interface 166 sends biometric ID 1 2, determined by I D lookup 164. and biometric image 1 18, received from user device 102. to external database 180 in message I 70 and receives, in message 186 by return, an indication of whether biometric image 1 18 matches biometric template 184. In certain embodiments, database interface 166 interacts with external database 1 80 to determine whether biometric ID 182 is stored therein, and if so, whether the biometric type of stored biometric templates 184 corresponds to biometric ID 182.

Authenticator 162 then sends a message 172 indicating an authentication result of user 120 to resource 130. In one embodiment, authenticator 162 also sends the authentication result to authentication app 1 16 for display to user 120. Thus, resource 130 may selectively respond to request 122 from user device 102 based upon the indicated authentication of user 120 in message 1 72. For example, where user 120 is making a purchase from resource 130, resource 130 may proceed with the transaction based upon successful authentication of user 120 or decline the transaction based upon unsuccessful authentication of user 120.

Advantageously, user 120 does not have to provide biometric images to enroll with biometric authentication server 160, since user 120 has already provided biometric images to form biometric template 184 of external database 180.

In one embodiment, biometric authentication server 160 is part of a financial network that handles financial transactions, wherein biometric authentication server 160 is invoked to authenticate financial transactions based upon captured biometric image 1 18 of user 120 and using external database 180 of a third party. In this embodiment, ID lookup 164 may determine biometric ID 182 from an account number of a transaction being authenticated, thereby ensuring that authentication is correct for the transaction.

FIG. 2A is a flowchart illustrating one example method 200 for biometric authentication using existing databases. Method 200 is for example implemented within biometric authentication server 160 of FIG. 1 . In step 202, method 200 receives a request for authentication of a user from a requestor. In one example of step 202, authenticator 162 receives authentication request message 136 from user authenticator 134 of resource 130 requesting authentication of user 120. In step 204. method 200 looks up a biometric ID of the user received in step 202. In one example of step 204. authenticator 162 invokes ID lookup 164 to determine biometric ID 182 if user 120, based upon login ID 1 14 and/or unique device ID 103, is included within authentication request message 136. In certain embodiments, step 204 occurs at any point between step 202 and step 214.

In step 206, method 200 sends a notification to the user device associated with the user. In one example of step 206. authenticator 162 sends notification 168 to user device 102 requesting biometric authentication. In step 208, method 200 receives at least one biometric image from the user device. In one example of step 208, authenticator 162 receives, in message 124, biometric image 1 18 from authentication app 1 16 of user device 102 in response to notification 168.

In one embodiment, step 210 is included, and method 200 verifies that the biometric image is from the correct device. In one example of step 210, authenticator 162 verifies that message 124 is from user device 102 based upon unique device ID 103 received within message 1 24 matching a previous registered device ID associated with biometric ID 182. In step 212, method 200 converts the biometric image into a suitable format for the external database (if needed). In one example of step 212,

authenticator 162 converts biometric image 1 18 into a format suitable for matching to biometric template 184 by external database 180.

In step 214, method 200 sends the biometric ID of step 204 and biometric image received in step 208 and converted in step 212 to external database for matching to corresponding biometric template. In one example of step 214, authenticator 162 invokes database interface 166 to send message 170 including biometric ID 182 and biometric image 118 (in converted form) to external database 180 for matching.

In step 216, method 200 receives an authentication result from the external database. In one example of step 216, authenticator 162 receives message 186 indicating whether biometric image 118 matches biometric template 184 associated with biometric ID 182 from external database 180.

In step 21 8. method 200 sends an authentication result to the requestor.

In one example of step 218, authenticator 162 sends message 172 to user authenticator 134 of resource 130 indicating authentication of user 120 as determined using external database 180.

FIG. 2B is a flowchart illustrating another example method 250 for biometric authentication using existing databases. Method 250 is for example implemented within biometric authentication server 160 of FIG. 1 .

In step 252, method 250 receives a request for authentication of a user from a requestor. In one example of step 252, authenticator 162 receives

authentication request message 136 from user authenticator 134 of resource 130 requesting authentication of user 120. In step 254, method 250 looks up a biometric ID of the user received in step 252. In one example of step 254. authenticator 162 invokes ID lookup 164 to determine biometric ID 182 if user 120, based upon login ID 114 and/or unique device ID 103, is included within authentication request message 136. In certain embodiments, step 254 occurs at any point between step 252 and step 262.

In step 256, method 250 sends a notification to the user device associated with the user. In one example of step 256, authenticator 162 sends notification 168 to user device 102 requesting biometric authentication. In step 258, method 250 receives at least one biometric image from the user device. In one example of step 258, authenticator 162 receives, i message 124. biometric image 118 from authentication app 1 16 of user device 102 in response to notification 168.

In one embodiment, step 260 is included, and method 250 verifies that the biometric image is from the correct device. In one example of step 260, authenticator 162 verifies that message 124 is from user device 102 based upon unique device ID 103 received within message 124 matching a previous registered device ID associated with biometric ID 182.

In step 262, method 250 sends the biometric ID of step 254 to external database to request a corresponding biometric template. In one example of step 262, authenticator 162 invokes database interface 166 to send message 170 including biometric ID 182 to external database 180.

In step 264, method 250 receives the corresponding biometric template from the external database. In one example of step 264, authenticator 162 receives biometric template 184, corresponding to biometric ID 182, from external database 180.

In step 266, method 250 converts the biometric image of step 258 into a suitable format for the biometric template (if needed). In one example of step 266. authenticator 162 converts biometric image 1 18 into a format suitable for matching to biometric template 184.

In step 268, method 250 authenticates the biometric image with the biometric template. In one example of step 268, authenticator 162 authenticates converted biometric image 118 with biometric template 184 received from external database 1 80 to determine an authentication result.

In step 270. method 250 sends an authentication result to the requestor. In one example of step 270, authenticator 162 sends message 172 to user authenticator 134 of resource 130 indicating authentication of user 120 as determined using external database 180.

FIG. 3 shows an embodiment of biometric authentication server 160 of FIG. 1 in further detail. Biometric authentication server 160 has a processor 302 that is communicatively coupled with a memory 304. Memory 304 stores authenticator 162 with machine readable instructions that are executed by processor 302 to provide functionality of biometric authentication server 160, as described above. Memory 304 may also store a lookup table 306 that correlates login ID 1 14 with biometric ID 182, such that ID lookup 164 may determine biometric ID 182 based upon login ID 1 14. Biometric authentication server 160 includes database interface 166 and a user device interface 308 that allows authenticator 162 to communicate with user device 102. For example, user device interface 308 facilitates sending of notification 168 and receiving of biometric image 118 within message 124.

In certain embodiments, lookup table 306 also allows authenticator 162 to determine, based upon biometric ID 182, which external databases 180 contain biometric templates of user 120. For example, lookup table 306 may store one or more database IDs 312 corresponding to biometric ID 182, where each database ID 312 defines which one of many external databases 180 contain biometric templates 184 corresponding to biometric ID 182. For example, based upon results from lookup table 306, authenticator 162 may determine whether or not authentication of user 120 is possible, and which external databases 180 may be used for authentication of user 120.

In certain embodiments, lookup table 306 also allows authenticator 162 to determine, based upon database ID 312, a biometric type 314 of biometric templates 184 stored within external database 180 corresponding to database ID 312. This allows authenticator 162 to determine which biometric types 314 may be used to authenticate user 120, and thereby, in notification 168, request that the captured biometric image 118 be of a particular biometric type 3 14. Where more than one biometric type 314 of biometric template 184 is available for biometric ID 182, user 120 may be able to choose the type of biometric capture to perform based upon those available on user device 102.

In certain embodiments, communication between database interface 166 and external database 180 utilizes a standardized protocol. In other embodiments, lookup table 306 provides additional information relating to external databases 180 and biometric template 184 to authenticator 162. In one example, lookup table 306 provides address and protocol information to allow database interface 166 to communicate with external database 180.

FIG. 4 shows another example system 400 for leveraging existing databases for biometric authentication. Specifically, in system 400, authentication is performed by a user device 402 and a separate biometric authentication server 160 is not required. For example, a user device 402 may be similar to user device 102, a resource 430 may be similar to resource 130, and an external database 480 may be similar to external database 180. In the example of FIG. 4, user device 402 interacts with a resource 430. User device 402 includes a processor 404 communicatively coupled to a memory 406, and a camera 408. In certain embodiments, user device 402 also includes a fingerprint scanner 410. User device 402 is selected from the group including: a smartphone, a personal computer, a tablet computer, a notebook computer, and so on.

To access or utilize resource 430, user 420 may require authentication. Previously created biometric templates of user 420 are stored within external database 480, owned and/or maintained by a third party. These previously created biometric templates may advantageously be used to authenticate user 420. For example, resource 430 may represent an entity that stores data that user 420 wishes to access. Before user 420 is allowed access to the data, user 420 is advantageously

authenticated using external database 480. Thus, even though user 420 has not specifically enrolled for authentication with resource 430. previously generated and stored biometric templates of user 420 are successfully used to authenticate user 420 to resource 430. To enable authentication, user device 402 loads an authentication app 416 that is for example created and trusted by resource 430. Such communication can occur via a network 490. Network 490 may represent one or more of the Internet, a local area network, a cellular network, a wide area network, a financial transaction network, and so on.

Resource 430, based upon request 422 from user device 402, may request user device 402 to authenticate the authority of user 420 before fulfilling request 422. User device 402 (and. e.g., resource app 412 in particular) then invokes authentication app 416 to authenticate user 420 using a biometric template 484 corresponding to user 420. Authentication app 416 may be configured with a biometric ID 482 of user 420. Biometric ID 482 may be similar to biometric ID 182 and uniquely identifies user 420. Authentication app 416 may select external database 480 based upon the type of biometric captured by user device 402. For example, where a fingerprint image is captured, external database 480 represents an existing database of fingerprint type biometric templates that may be used to authenticate user 420.

Authentication app 416 may be configured to utilize more than one external database 180 that contains biometric information of user 420 corresponding to biometric ID 482. In embodiments, after receiving authentication request message 436. resource app 412 invokes authentication app 416 to authenticate user 420. In certain embodiments, resource app 412 and authentication app 416 are combined into a single app. Authentication app 416 interacts with user 420 to capture at least one biometric image 418 of user 420. For example, where user device 402 includes both camera 408 and fingerprint scanner 410, authentication app 416 may offer user 420 a choice of which of a facial image, an iris image, and a fingerprint image to capture as biometric image 418 based upon available typed of biometric templates within external database 480. In certain embodiments, authentication app 416 may allow user 420 to capture a retinal image as biometric image 1 18, where camera 408 supports such image capture. Alternatively, the user 420 may be instructed as to which type of biometric will be captured for authentication. Authenticat ion app 416 may convert biometric image 418 into an appropriate format for use by external database 180.

In one embodiment, authentication app 416 retrieves biometric template 484, identified by biometric ID 482, from external database 480 and then matches biometric image 418 to biometric template 484 to determine whether they match. In another embodiment, authentication app 416 sends biometric ID 482 and biometric image 418 to external database 480 in message 470 and receives, in message 486 by return, an indication of whether biometric image 418 matches biometric template 484.

Authentication app 416 then sends a message 472 indicating an authentication result of user 420 to resource 430. In certain embodiments, authenticator 462 also sends the authentication result to authentication app 416 for display to user 420. Thus, resource 430 may selectively respond to request 422 from user device 402 based upon the indicated authentication of user 420 in message 472. For example, where user 420 is making a purchase from resource 430, resource 430 may proceed with the transaction based upon successful authentication of user 420 or decline the transaction based upon unsuccessful authentication of user 420.

Advantageously, user 420 does not have to provide biometric images to enroll for biometric authentication with resource 430, since user 420 has already provided biometric images to form biometric template 484 of external database 480.

It should thus be noted that the matter contained in the above description or shown in the accompanying drawings should be interpreted as illustrative and not in a limiting sense. The following claims are intended to cover all generic and specific features described herein, as well as all statements of t he scope of the present method and system, which, as a matter of language, might be said to fall therebetween.