Filing Information

Inventor(s)	David S. Abdallah · Barry W. Johnson ·
Assignee(s)	Privaris, Inc. ·  View assignee updates
Primary Examiner	Techane Gergiso ·
Application Number	US12190058
Filing date	08/12/2008
Issue date	02/28/2012
Prior Publication Data	US20090031140 - 01/29/2009
Predicted expiration date	08/06/2023
U.S. Classifications	713/186  · 340/582  · 382/115  ·
International Classifications	G05B2300  · G06F2100  · G06K900  ·
Kind Code	B2
Related U.S. Application Data	RELATED U.S. APPLICATION DATA This application claims priority to and is a divisional of U.S. patent application Ser. No. 10/635,762, filed Aug. 6, 2003, now U.S. Pat. No. 7,590,861 entitled “Methods for Secure Enrollment and Backup of Personal Identity Credentials into Electronic Devices,” which claims priority to U.S. Patent Application No. 60/401,399 filed on Aug. 6, 2002 entitled, “A Secure Enrollment Process for a Biometric Personal Identification Device,” each of which is herein incorporated by reference in their entireties. This application is related to U.S. patent application Ser. No. 12/190,061, entitled “Methods for Secure Backup of Personal Identity Credentials for Electronic Devices” and Ser. No. 12/190,064, entitled “Methods for Secure Restoration of Personal Identity Credentials for Electronic Devices,” each filed on the same date, and each of which is incorporated herein by reference their entirety.

Patent Family

Abstract

A method and system for securely enrolling personal identity credentials into personal identification devices. The system of the invention comprises the manufacturer of the device and an enrollment authority. The manufacturer is responsible for recording serial numbers or another unique identifier for each device that it produces, along with a self-generated public key for each device. The enrollment authority is recognized by the manufacturer or another suitable institution as capable of validating an individual before enrolling him into the device. The enrollment authority maintains and operates the appropriate equipment for enrollment, and provides its approval of the enrollment. The methods described herein discuss post-manufacturing, enrollment, backup, and recovery processes for the device.

Independent Claims | See all claims (24)

1. 1. A method, comprising: verifying, at a personal identification device, a validity of an enrollment authority based on an encrypted verification string associated with the enrollment authority, the verifying including comparing a decrypted verification string and an unencrypted verification string such that the validity of the enrollment authority is verified when the decrypted verification string matches the unencrypted verification string, the decrypted verification string being produced by the personal identification device based on the encrypted verification string and a public key associated with the enrollment authority; sending from the personal identification device an encrypted session key to the enrollment authority when the validity of the enrollment authority is verified; downloading, at the personal identification device, biometric data encrypted using the encrypted session key after the sending and when the validity of the enrollment authority is verified; and storing, only at the personal identification device, the biometric data after the receiving such that the biometric data is prevented from being transmitted from the personal identification device after the storing.
2. 8. A method, comprising: verifying, at an enrollment authority, a validity of a personal identification device based on an encrypted verification string associated with the personal identification device, the verifying including comparing a decrypted string and a device verification string such that the validity of the personal identification device is verified when the decrypted string matches the device verification string; receiving, at the enrollment authority, an encrypted session key from the personal identification device; and sending, from the enrollment authority, a signal configured to permit the personal identification device to download biometric data encrypted using the encrypted session key after the validity of the personal identification device is verified such that the biometric data is stored only at the personal identification device and prevented from being transmitted from the personal identification device.
3. 17. An apparatus, comprising: a memory configured to store biometric data of a user; a processor coupled to the memory, the processor configured to verify a validity of an enrollment authority based on an encrypted string associated with the enrollment authority and a digital certificate uniquely associated with the enrollment authority; the processor configured to compare a decrypted string and an enrollment authority verification string such that the validity of the enrollment authority is verified when the decrypted string matches the enrollment authority verification string; a biometric sensor coupled to the processor, the biometric sensor configured to receive biometric data from the user; a transmitter coupled to the processor, the processor configured to send an encrypted session key to the enrollment authority via the transmitter when the validity of the enrollment authority is verified; and a receiver coupled to the processor, the receiver configured to receive the digital certificate uniquely associated with the enrollment authority, the digital certificate including a public key of the enrollment authority, the processor configured to download and store the biometric data when the validity of the enrollment authority is verified, the receiver configured to store the biometric data such that such that the biometric data is prevented from being transmitted by the transmitter after the storing.