Rolling Biometric Key Exchange

Abstract

Various embodiments generally relate to techniques for generating a unique biometric key, hashing and salting the key, and storing it. Embodiments include techniques for analyzing biometric information associated with a user and determining one or more biometric characteristics from the analyzed information. The biometric characteristics may be used to generate a string unique to the user, which may be used to generate a biometric key based on a cryptographic algorithm. The hash value, salt value, or hash function may be changed at predetermined intervals.

Description

[0001] Related Applications

[0002] This application claims priority to U.S. Patent Application Serial No. 16 / 183,410, entitled “ROLLING BIOMETRIC KEY EXCHANGE,” filed on November 7, 2018. The contents of the above application are incorporated herein by reference. Background Art

[0003] Biometrics refer to various measurements related to a person's anatomical features or behavioral patterns. Biometric data can be digital data and can rely on, for example, different types of biometric identifiers (physiological characteristics), such as fingerprints, palm veins, DNA, hand geometry, etc. Biometric data can be stored on a server or storage device, which can be accessed and processed by the biometric system.

[0004] Typically, biometric data is stored in an encrypted format to protect it from any manipulation or unauthorized theft or tampering. While biometric data can be encrypted, biometric data is typically (if not always) stored statically. Therefore, an unauthorized person may be able to copy the biometric data and reproduce it to access internal accounts or systems.

[0005] Therefore, there is a need to improve the way biometric data is stored so that it cannot, or at least is extremely difficult to reproduce by unauthorized persons for use in accessing internal accounts or systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1A First example biometric information in accordance with one or more embodiments is shown.

[0007] Figure 1B A first example character string is shown in accordance with one or more embodiments.

[0008] Figure 2A Second example biometric information in accordance with one or more embodiments is shown.

[0009] Figure 2B A second example character string is shown in accordance with one or more embodiments.

[0010] Figure 3A Third example biometric information in accordance with one or more embodiments is shown.

[0011] Figure 3B A third example character string is shown in accordance with one or more embodiments.

[0012] Figure 4A Fourth example biometric information in accordance with one or more embodiments is shown.

[0013] Figure 4B A fourth character string is shown in accordance with one or more embodiments.

[0014] Figure 5 An example block diagram is shown in accordance with one or more embodiments.

[0015] Figure 6 An example flow diagram is shown in accordance with one or more embodiments.

[0016] Figure 7 An example computing architecture of a computing device in accordance with one or more embodiments is shown.

[0017] Figure 8 An example communication architecture is shown in accordance with one or more embodiments. DETAILED DESCRIPTION

[0018] Various embodiments generally relate to storing biometric data in a highly secure manner. A user's biometric information and associated biometrics may be analyzed to generate a string unique to the user. A cryptographic algorithm may be applied to the generated string to further generate a unique biometric key. The biometric key may then be hashed via a hash function and / or "salted" with additional data associated with the user. The hashed and / or salted biometric key may then be stored in one or more storage devices, where the hash value (or the hash function itself) and the salt value may be changed or "rolled" at predetermined intervals (e.g., time, event, instance, etc.).

[0019] In an embodiment, the biometric information to be analyzed may be automatically accessed or may be provided by a user. It is understood that the term "user" herein is broadly defined and may include any person, individual, applicant, client, etc. Biometric information may be any information related to various anatomical or physiological features of a user. In this regard, the biometric information is uniquely associated with the user who provided it. For example, it may be a user facial image, a user fingerprint scan, a user eye scan, a user hand scan, hand geometry, a user palm and palm vein scan, and / or a recording of a user's voice. Analysis of the biometric information may involve analyzing different features found therein.

[0020] According to an embodiment, one or more biometric features may be obtained from the biometric information. For example, when the biometric information is a face image, the biometric features of the face may include at least the distance between the eyes (e.g., pupil distance), the height of the face, the width of the face, or any distance or multiple distances between the eyes, ears, nose, upper lip, lower lip, chin, etc. In another example, when the biometric information is an eye scan, the biometric features of the eye may include the size of the iris and / or pupil, the distance between the retinal veins, etc. In yet another example, when the biometric information is a fingerprint, the biometric features may include arches, rings, and / or whorls. In yet another example, when the biometric information is a voice recording, the biometric features of the voice may include one or more unique voices or voice patterns. In yet another example, when the biometric information is a palm scan, the features may include the ridges and lines of the palm, the size and / or length of the palm veins, and the distance between the veins.

[0021] Since the biometric features of the associated biometric information are unique to the user, a unique string (e.g., an alphanumeric string) can be generated based on these features. Thereafter, the string can be applied to or used as an input to a cryptographic algorithm to generate a biometric key. In an embodiment, the biometric key is hashed using a hash function and / or "slated" using various salt data or salt values. It will be understood that "slatting" or "salting" involves adding or hashing additional data that may be uniquely associated with the user as input to increase overall complexity and security, such as to defend against dictionary attacks or pre-computed rainbow table attacks. The hashed and / or salted biometric key can then be stored in one or more storage devices, where the hash value, hash function, and / or salt value and data are changed or rolled at predetermined times.

[0022] In previous solutions, one problem with storing biometric data in a storage device is that it is static. The data therefore remains unchanged, which means that an unauthorized person can copy the data and reproduce the data for access to secure internal systems. Another problem with storing biometric data is that, although the user's biometric information is usually encrypted when stored, the biometric information is directly used to generate a root key for accessing the internal system (or to build other keys with the root key). The above embodiments and examples described herein overcome the above problems and are superior to previous solutions in many aspects. For example, biometric information can be used to generate a string that is unique to the user, which in turn is applied to a cryptographic algorithm and used to generate a biometric key. Therefore, the biometric information itself and / or the string does not need to be stored in any storage device, thereby improving overall security. In addition, the hash function, hash value, and salt value applied to the biometric key can be constantly changed at different times or intervals, making the biometric key contained in the internal system useless at a later time.

[0023] Reference is now made to the accompanying drawings, in which the same reference numerals are used to refer to the same elements throughout. In the following description, for the purpose of explanation, many specific details are set forth to provide a thorough understanding thereof. However, it is apparent that novel embodiments can be practiced without these specific details. In other cases, well-known structures and devices are shown in block diagram form to facilitate description thereof. It is intended to cover all modifications, equivalents, and substitutes within the scope of the claims.

[0024] Figure 1A Example biometric information of a user is shown, such as a facial image 110. By way of example, the image 110 is a close-up, head shot of the user, and it may be a digital image captured by at least one input device, such as a camera. In other examples involving other types of biometric information, the input device may be a fingerprint reader, a palm print scanner or reader, a palm vein scanner or reader, etc. It is understood that the image of the user is not limited to a close-up head shot, but may be any suitable image, such as a profile image, a group photo, etc., in which the user's face is visible and analyzable.

[0025] An analysis may be performed on the image 110 by one or more computing devices or processing circuits thereof (characteristics of which are further described below) to determine one or more biometric features of the user. As shown, the user's face may exhibit a variety of biometric features. For example, the face has a facial width 112, a facial height 114, a distance from one pupil of one eye to another pupil of the other eye, such as a pupil distance (PD) 116, a monocular PD 118, a vertical distance 120 between the pupil and the bottom of the nose, a vertical distance 122 between the pupil and the lips, and a horizontal distance 124 between the pupil and the ear.

[0026] It is understood that a face may exhibit more features, such as the distance from ear to ear, the distance from a portion of the face to the upper or lower lip, the length of the neck, etc. It is also understood that different types of images may exhibit different features, for example, a profile image may reveal the depth of the eye sockets, etc. To this end, the biometric features collectively may be unique to the user depicted in the image 110. And based on these features, a string unique to the user may be generated.

[0027] Figure 1B An example string 160 that can be generated by a computing device or its processing circuit based on a biometric feature is shown. As shown, the string 160 is a series of alphanumeric characters and can include at least seven different segments 162, 164, 168, 170, 172, 174, each of which can correspond to a biometric feature of a user. For example, a segment 162 including characters 789&8* can represent at least an accurate numeric measurement of a user's facial width 112. For example, 789&8* can represent 15.2 centimeters. Different characters and combinations thereof can be used to represent measurements in different units of measurement, such as inches, centimeters, etc. The characters in the segment 162 can define not only the measurement value, but also the gender associated with the measurement value, etc. The specific characters and the arrangement of those characters in the segment 162 can be predefined, predetermined, and / or can be based on a coding technique or system, as will be discussed further below.

[0028] like Figure 1B As further shown in the figure, segment 164 includes characters *__0 and can represent at least the measurement of the user's facial height 114. Segment 166 is shorter than segment 164 and has characters DBb, which can represent at least the measurement of the monocular PD 118. Segment 168 includes characters uvr89! @ and can represent at least the measurement of PD116. Segment 170 is the longest in length and has characters __655578$, which can represent the vertical distance 122 between the left pupil and the lips. As shown, portions of segment 170 can be separated or defined by spaces, such as two spaces between an underscore and the number 6 and a space between the number 8 and the $ sign. These spaces - the delimitation and use of these spaces - can represent some information aspects of the vertical distance 122, such as measurement units, gender, eye color, etc. Similarly, other characters, such as underscores, can be used to delimit or define portions of the string. Segment 172 includes characters ty and can represent at least the vertical distance 120 between the pupil and the bottom of the nose. Segment 174 includes characters R& and may represent at least the horizontal distance 124 between the pupil and the ear.

[0029] It will be appreciated that the combination of the various segments of the string may collectively and uniquely define a biometric characteristic of a user. In this regard, the length of the segments may vary, the types of characters used may vary, the manner in which spaces and / or characters are layered, fused or delimited may vary, the arrangement of the segments themselves, etc. may also vary.

[0030] The selection of the type of characters or symbols in the string, their arrangement, how they are spaced, etc. can be based on one or more encoding techniques, systems and / or algorithms. For example, it can be a single-table substitution cipher (e.g., Caesar, Atbash, Keyword, Pigpen, Masonic, Polybius), a multi-table substitution cipher (e.g., Vigenere, Beaufort, Autokey, rolling key), a multi-graph cipher (e.g., Playfair, Bifid, Trifid, Four-square), a transposition cipher (e.g., Fence-Fence, Route, Column Transposition), and other suitable types of ciphers, codes, algorithms (e.g., Book Cipher, Beer Cipher, Morse Code, Tap Code, One-Time Key, Scytale, Semaphore, ASCII, Steganography). The encoding can be based on custom tables that can be rolled or changed regularly. In addition, it is understood that the encoding can integrate or adopt one (or a combination) of any of the above techniques.

[0031] Figure 2A Another example of a user's biometric information is shown, such as fingerprint 210, which may be a fingerprint of a user's thumb. Fingerprint 210 may be captured by a fingerprint scanner, ink and paper, or any suitable means by which a computing device images a fingerprint. In some cases, fingerprint 210 may be captured by ink and paper and converted to a digital fingerprint, such as by a camera, scanning device, etc. Fingerprint 210 may include various and numerous rings, whorls, and / or arches that are unique to a user.

[0032] Analysis may be performed on fingerprint 210 to determine one or more biometric characteristics of the user. Figure 2AAs shown in , a portion 212 (shown by a box) of the fingerprint 210 can be analyzed. The first level of analysis may include determining how many loops, whorls, or arches are present in the portion 212. The second level of analysis may be to examine the specific features of the loops, whorls, or arches, or portions thereof, in the individual sub-portions 214, 216, and 218 of the portion 212. For example, the number of arches in the sub-portion 214 and / or the distance between each arch may be determined. The same is true for the loops and whorls in the sub-portion 214, and the number of arches, loops, or whorls in the sub-portions 216 and 218 and / or the distance between them may be determined. In addition, the unique and specific patterns and shapes of the loops, whorls, or arches in each sub-portion may be analyzed and determined. When data associated with the biometric features of the fingerprint 210 is determined and obtained from at least the first analysis and the second analysis, a string unique to the user's fingerprint 210 may be generated.

[0033] Figure 2B Another example string 240 generated by a computing device based on a fingerprint is shown. As shown, string 240 may include at least three segments 242, 244, 246, each of which corresponds to an analysis performed on a corresponding sub-portion of fingerprint 210. For example, segment 242 may correspond to sub-portion 214, segment 244 may correspond to sub-portion 216, and segment 246 may correspond to sub-portion 218. Based on the analysis of sub-portion 214, the feature of segment 242 is AbC%I74yR743*, which may indicate, for example, the type of features found in sub-portion 214 (e.g., arches, loops, whorls), the number of these features, the distance between each feature, etc. The characters, the types and arrangements of characters may be predetermined, predefined, or may be based on a coding technique system, as described above. As shown, the characters of segment 244 are 555et56@@_*, and the characters of segment 246 are *_yYYRp&&. The characters may also be spaces, or characters delimited or defined in any suitable manner, which represent information associated with a biometric feature. At least in this regard, the generated string 240 may be unique to the user.

[0034] Figure 3A Yet another example of biometric information for a user is shown, such as an eye scan 310. The eye scan 310 may be acquired by an eye scanner, a retinal scanner, or any suitable device capable of scanning or imaging the user's eye. Similar to the above example, analysis may be performed on the eye scan 310 and one or more biometric features determined to be unique to the user. The eye scan 310 may include biometric features such as iris size 312, pupil size 314, and distance 316 between two retinal veins. Other veins with varying distances may also be selected. Based on these features, a string of characters may be generated that is also unique to the user.

[0035] Figure 3BYet another example string 360 generated by a computing device based on an eye scan is shown. String 360 has at least three segments 362, 364, and 366. Segment 362 may correspond to information about iris size 312 and include the characters hyppRrs784++b9. Segment 364 may correspond to information about pupil size 314 and include the characters 69652^^__6&#. And segment 366 may correspond to information about the distance 316 between two veins in the retina of the user's eye and include the characters! 651333&%_. The characters themselves, their arrangement, and the delimitation and / or use of various spaces and characters may be predetermined, predefined, or based on a coding technique or system, as described above. String 360 is unique to the user based on the biometric information provided in the user's eye.

[0036] Figure 4A Another example of biometric information of a user is shown, such as a voice recording 410. For example, voice can be recorded by a microphone. Analysis can be performed on the voice recording to determine one or more unique biometric features. As shown, the voice recording 410 can be modulated at various levels during the recording process. Therefore, features that can be obtained from the analyzed voice recording 410 include different modulation levels, such as the highest modulation value, the lowest modulation value, and include the distance between two adjacent modulations, the overall shape of the recording, repetitive patterns in the modulation, speech frequency, pronunciation of certain words, articulation, intonation, etc.

[0037] FIG4C illustrates another example string 460 generated by a computing device based on a voice recording. Using the unique biometric features determined from voice recording 410, string 460 may be generated that includes the characters +7645urTTs&3%__45pl7rT70909. As described above, the characters and arrangements of those characters may be based on an encoding technique or system or any other suitable predetermined or predefined technique. The characters and symbols may also be space or symbol delimited or defined. Like the other strings described above, string 460 is also unique to the user.

[0038] Figure 5An example block diagram 500 is shown in accordance with an embodiment. After a string 502 (e.g., string 160, 240, 360, 460) based on a user's biometric information is generated, the string may be applied to or used in a cryptographic algorithm 504 or encryption algorithm to generate a biometric key unique to the user. In at least this regard, neither the biometric information (including the analyzed and determined biometrics) nor the string need to be stored based on the generation of the biometric key via the cryptographic algorithm 504. It will be appreciated that the term biometric information may be interpreted broadly, as described above, and may be any information, digital image, or other information containing data about numerous and unique anatomical or physiological features of a user that may be encompassed by the term biometric, as described above.

[0039] The cryptographic algorithm 504 may be any suitable algorithm for encrypting, hiding, or otherwise scrambling information. For example, it may be one of (or a combination of): a triple Data Encryption Standard (DES) algorithm, (ii) an RSA public key encryption algorithm, (iii) a Blowfish algorithm, (iv) a Twofish algorithm, (v) an Advanced Encryption Standard (AES) algorithm, (vi) a Diffie-Hellman algorithm, (vii) a Cramer-Shoup algorithm, and (viii) an ElGamal encryption algorithm. Additionally or alternatively, the cryptographic algorithm 504 may be a unique equation, such as (e^2) / (522*e), where "e" represents a string of characters. The result of applying the cryptographic algorithm 504 is a biometric key, which may be any suitable type of encryption key, such as a 512-bit key, a 768-bit key, a 1024-bit key, or a 2048-bit key.

[0040] The biometric key may be hashed by a computing device based on various hash values ​​via a hash function 506. The hash function 506 and the associated hash values ​​may be specifically configured for cryptography. Figure 5 As shown, the hash function 506 outputs a hashed biometric key. The complexity of the biometric hash can be further increased by adding a salt 508 (e.g., a salt value) to the hash key, which can be data associated with and unique to the user. For example, the salt value can be data or information related to where the user went to college, the names of the user's mother and father, the street the user lived on when the user was ten years old, the names of the user's current or past pets, etc. Adding salt to the biometric hash increases the overall complexity and security of the biometric data before it is stored. Therefore, the output is a hashed and salted biometric key 510, which can be stored in one or more storage devices.

[0041] Once the hashed and salted biometric key is stored, any of the hash function, hash value, and salt value can be changed or "rolled" at predetermined intervals, such as every minute, one hour, six hours, 12 hours, 24 hours, one week, a triggered event, etc. This at least ensures that the stored data is not static, so that the pre-rolled key cannot be used to access internal systems after the rolling process.

[0042] Although Figure 5 The boxes in are shown in a particular order, but the process of generating a hashed and salted biometric key is not limited to this. For example, hashing and salting can be performed simultaneously. Alternatively, it will be appreciated that the salt value itself can be used as the hash value in the hash function. In an embodiment, a string can be generated simultaneously in real time and automatically applied to a cryptographic algorithm. Alternatively, the process of generating a string can be separate, whereby it is created at a different time than when it is applied to the cryptographic algorithm. For example, one computing device can generate a unique string, and another different computing device (connected to the computing device via a network) can receive the string to generate a biometric key using a cryptographic algorithm.

[0043] Figure 6 Flowchart 600 is shown in accordance with one or more embodiments. It will be appreciated that features associated with the illustrated blocks may be performed or executed by one or more computing devices and / or processing circuitry contained therein.

[0044] Biometric information may be acquired or received from a user and analyzed at block 602. Biometric information may be any information related to a user's unique anatomical or physiological features, such as facial images, fingerprints, eye scans, voice recordings, etc., as described above.

[0045] At block 604, based on the analysis, one or more biometric features may be determined. For example, a width measurement of the user's face, a height measurement of the face, the distance between the pupils of the eyes, the distance between the pupils and the user's lips, etc. At block 606, these unique biometric features may be used to generate a string indicating these features. The string may include a number of alphanumeric characters and / or symbols that may be selected, applied, and / or arranged in a predetermined manner. As described above, it may be based on a coding technique or system.

[0046] At block 608, the string may be applied to or used in a cryptographic algorithm to generate a biometric key. At block 610, the biometric key may be hashed using a hash function and various hash values, which may be cryptographic in nature, and further salted with a user-unique salt value. The hashed and salted key may then be stored in one or more storage devices.

[0047] The hash value, hash function and / or salt value may be changed at predetermined times, intervals, or upon the occurrence of predetermined events or instances, at block 612. As described above, this ensures that the hashed and salted keys—if compromised, stolen, or copied by authorized personnel—cannot be used or reproduced to access internal systems after a certain time or specific event.

[0048] Understandably, Figure 6 The blocks shown are not limited to any particular order. One or more of these blocks may be executed or performed simultaneously or nearly simultaneously. For example, hashing and salting of a key may be performed simultaneously.

[0049] Figure 7 An embodiment of an exemplary computing architecture 700 is shown, for example, an exemplary computing architecture 700 of a computing device, such as a desktop computer, a laptop computer, a tablet computer, a mobile computer, a smart phone, etc., suitable for implementing various embodiments as described above. In one embodiment, the computing architecture 700 may include or be implemented as part of a system, which will be further described below. As described above, at least one computing device and / or its processing circuitry may be configured to at least analyze biometric information associated with a user, determine one or more biometric features of the user, generate a unique string based on the features, generate a biometric key via a cryptographic algorithm, and the output of the cryptographic algorithm may be hashed, salted, and stored in one or more storage devices, wherein the hash value, salt value, and / or hash function may be changed at multiple times.

[0050] The terms "system" and "component" used in this application are intended to refer to computer-related entities, which can be hardware, a combination of hardware and software, software, or software in execution, examples of which are provided by the exemplary computing architecture 700. For example, a component can be, but is not limited to, a process running on a processor, a processor, a hard drive, multiple storage drives (optical and / or magnetic storage media), an object, an executable file, an execution thread, a program, and / or a computer. For example, both an application running on a server and a server can be a component. One or more components can reside in a process and / or execution thread, and a component can be located on a computer and / or distributed between two or more computers. In addition, components can be communicatively coupled to each other through various types of communication media to coordinate operations. Coordination can involve a one-way exchange or a two-way exchange of information. For example, a component can transmit information in the form of a signal transmitted through a communication medium. The information can be implemented as a signal assigned to various signal lines. In such an assignment, each message is a signal. However, other embodiments may alternatively use data messages. Such data messages can be sent through various connections. Exemplary connections include parallel interfaces, serial interfaces, and bus interfaces.

[0051] The computing architecture 700 includes various common computing elements, such as one or more processors, multi-core processors, coprocessors, storage units, chipsets, controllers, peripherals, interfaces, oscillators, timing devices, video cards, audio cards, multimedia input / output (I / O) components, power supplies, etc. However, the embodiments are not limited to being implemented by the computing architecture 700.

[0052] like Figure 7 As shown, computing architecture 700 includes processor 704, system memory 706, and system bus 708. Processor 704 may be any of various commercially available processors, processing circuits, central processing units (CPUs), dedicated processors, field programmable gate arrays (FPGAs), and the like.

[0053] The system bus 708 provides an interface to the processor 704 for system components including, but not limited to, the system memory 706. The system bus 708 may be any of a variety of types of bus structures, which may be further interconnected to a memory bus (with or without a memory controller), a peripheral bus, and a local bus using any of a variety of commercially available bus architectures. Interface adapters may be connected to the system bus 708 via a slot architecture. Example slot architectures may include, but are not limited to, Accelerated Graphics Port (AGP), Cardbus, (Extended) Industry Standard Architecture ((E)ISA), Micro Channel Architecture (MCA), NuBus, Peripheral Component Interconnect (Extended) (PCI(X)), PCI Express, Personal Computer Memory Card International Association (PCMCIA), and the like.

[0054] The computing architecture 700 may include or implement various articles of manufacture. Articles of manufacture may include a computer-readable storage medium for storing logic. Examples of computer-readable storage media may include any tangible media capable of storing electronic data, including volatile or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writable or rewritable memory, etc. Examples of logic may include executable computer program instructions implemented using any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, object-oriented code, visual code, etc. Embodiments may also be implemented at least in part as instructions contained in or on a non-transitory computer-readable medium, which may be read and executed by one or more processors to enable the operations described herein to be performed.

[0055] The system memory 706 may include various types of computer-readable storage media in the form of one or more high-speed memory cells, such as read-only memory (ROM), random access memory (RAM), dynamic RAM (DRAM), double data rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, polymer memory such as ferroelectric polymer memory, Austrian memory, phase change or ferroelectric memory, silicon-oxide-nitride-oxide-silicon (SONOS) memory, magnetic or optical cards, device arrays such as redundant array of independent disks (RAID) drives, solid-state storage devices (e.g., USB memory, solid-state drive (SSD)), and any other type of storage medium suitable for storing information. Figure 7 In the illustrated embodiment shown, system memory 706 may include non-volatile memory 710 and / or volatile memory 712. A basic input / output system (BIOS) may be stored in non-volatile memory 710.

[0056] The computer 702 may include various types of computer-readable storage media in the form of one or more low-speed memory units, including an internal (or external) hard disk drive (HDD) 714, a magnetic floppy disk drive (FDD) 716 for reading from or writing to a removable magnetic disk 718, and an optical drive 720 for reading from or writing to a removable optical disk 722 (e.g., a CD-ROM or DVD). The HDD 714, FDD 716, and optical drive 720 may be connected to the system bus 708 via a HDD interface 724, a FDD interface 726, and an optical drive interface 728, respectively. The HDD interface 724 for external drive implementations may include at least one or both of a universal serial bus (USB) and IEEE 1394 interface technologies.

[0057] The drives and associated computer-readable media provide volatile and / or nonvolatile storage of data, data structures, computer-executable instructions, etc. For example, a number of program modules may be stored in the drives and memory units 710, 712, including an operating system 730, one or more application programs 732, other program modules 734, and program data 736. In one embodiment, the one or more application programs 732, other program modules 734, and program data 736 may include, for example, various applications and / or components of the system 800.

[0058] A user may enter commands and information into the computer 702 through one or more wired / wireless input devices, such as a keyboard 738 and a pointing device, such as a mouse 740. Other input devices may include a microphone, an infrared (IR) remote control, a radio frequency (RF) remote control, a game controller, a stylus, a card reader, a dongle, a fingerprint reader, a glove, a drawing tablet, a joystick, a keyboard, a retina reader, a touch screen (e.g., capacitive, resistive, etc.), a trackball, a trackpad, a sensor, a stylus, etc. These and other input devices are typically connected to the processor 704 through an input device interface 742 coupled to the system bus 708, but may be connected through other interfaces, such as a parallel port, an IEEE 1394 serial port, a game port, a USB port, an IR port, etc.

[0059] A monitor 744 or other type of display device is also connected to the system bus 708 via an interface, such as a video adapter 746. The monitor 744 may be internal or external to the computer 702. In addition to the monitor 744, computers typically include other peripheral output devices, such as speakers, printers, and the like.

[0060] The computer 702 can operate in a networked environment using logical connections via wired and / or wireless communications with one or more remote computers, such as computer 748. The remote computer 748 can be a workstation, server computer, router, personal computer, portable computer, microprocessor-based entertainment device, peer device, or other public network node, and typically includes many or all of the elements described with respect to the computer 702, but only a memory / storage device 750 is shown for simplicity. The depicted logical connections include wired / wireless connections to a local area network (LAN) 752 and / or a larger network, such as a wide area network (WAN) 754. Such LAN and WAN networking environments are common in offices and companies, and facilitate enterprise-wide computer networks, such as intranets, all of which can be connected to a global communication network, such as the Internet.

[0061] When used in a LAN networking environment, the computer 702 is connected to the LAN 752 through a wired and / or wireless communication network interface or adapter 756. The adapter 756 can facilitate wired and / or wireless communication to the LAN 752, which can also include a wireless access point disposed thereon for communicating with the wireless functionality of the adapter 756.

[0062] When used in a WAN networking environment, the computer 702 may include a modem 758, or be connected to a communications server on the WAN 754, or have other means for establishing communications over the WAN 754, for example, via the Internet. The modem 758 may be an internal or external wired and / or wireless device connected to the system bus 708 via the input device interface 742. In a networking environment, program modules or portions thereof described with respect to the computer 702 may be stored in the remote memory / storage device 750. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.

[0063] The computer 702 is operable to communicate with wired and wireless devices or entities using the IEEE 802 family of standards, such as wireless devices operatively configured for wireless communications (e.g., IEEE 802.11 over-the-air modulation techniques). This includes at least Wi-Fi (or Wireless Fidelity), WiMax, and Bluetooth. TM Wireless technology, etc. Therefore, the communication can be a predefined structure like traditional networks, or just an ad hoc communication between at least two devices. Wi-Fi networks use radio technology called IEEE 802.118 (a, b, g, n, etc.) to provide secure, reliable, and fast wireless connections. Wi-Fi networks can be used to connect computers to each other, to the Internet, and to wired networks (using IEEE 802.3 related media and functions).

[0064] The various elements of the devices described above with reference to Figures 1-5 may include various hardware elements, software elements, or a combination of the two. Examples of hardware elements may include devices, logic devices, components, processors, microprocessors, circuits, processors, circuit elements (e.g., transistors, resistors, capacitors, inductors, etc.), integrated circuits, application specific integrated circuits (ASICs), programmable logic devices (PLDs), digital signal processors (DSPs), field programmable gate arrays (FPGAs), storage units, logic gates, registers, semiconductor devices, chips, microchips, chipsets, etc. Examples of software elements may include software components, programs, applications, computer programs, applications, system programs, software development programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, processes, software interfaces, application program interfaces (APIs), instruction sets, computing codes, computer codes, code segments, computer code segments, words, values, symbols, or any combination thereof. However, the determination of whether to use hardware elements and / or software elements to implement an embodiment may vary depending on any number of factors, such as desired computing rates, power levels, thermal tolerances, processing cycle budgets, input data rates, output data rates, memory resources, data bus speeds, and other design or performance constraints, as desired for a given implementation.

[0065] Figure 8 800 is a block diagram depicting an exemplary communication architecture 800 suitable for implementing various embodiments. For example, one or more computing devices can communicate with each other via a communication framework such as a network. At least one computing device connected to the network can be a client computing device, such as a desktop computer, a laptop computer, a tablet computer, a smart phone, etc. At least one computing device connected to the network can be a server computer, which can be implemented as a back-end server. In some embodiments, the client computing device can be configured to generate a unique string for the user based on the user's biometric information. For example, at least one back-end server computer can receive the string and generate a unique biometric key, where the hashed and salted key can be stored in a server data store. For example, this involves an example in which the string can be generated by a third party (e.g., a party that does not control the back-end server computer).

[0066] The communication architecture 800 includes various common communication elements, such as transmitters, receivers, transceivers, radios, network interfaces, baseband processors, antennas, amplifiers, filters, power supplies, etc. However, embodiments are not limited to implementation via the communication architecture 800 .

[0067] like Figure 8As shown, the communication architecture 800 includes one or more clients 802 and servers 804. The one or more clients 802 and servers 804 are operably connected to one or more corresponding client data stores 806 and server data stores 807, which can be used to store local information, such as cookies and / or associated contextual information, of the corresponding clients 802 and servers 804. For example, the server data store 807 can store all hashed and salted biometric keys.

[0068] Client 802 and server 804 can communicate information between each other using communication framework 810. Communication framework 810 can implement any well-known communication technologies and protocols. Communication framework 810 can be implemented as a packet-switched network (e.g., a public network such as the Internet, a private network such as an intranet, etc.), a circuit-switched network (e.g., a public switched telephone network), or a combination of packet-switched networks and circuit-switched networks (with appropriate gateways and converters).

[0069] The communication framework 810 can implement various network interfaces arranged to accept, communicate and connect to the communication network. The network interface can be regarded as a special form of input / output (I / O) interface. The network interface can adopt connection protocols including but not limited to direct connection, Ethernet (e.g., thick, thin, twisted pair 10 / 100 / 1000Base T, etc.), token ring, wireless network interface, cellular network interface, IEEE 802.7ax network interface, IEEE802.16 network interface, IEEE 802.20 network interface, etc. In addition, multiple network interfaces can be used to engage with various communication network types. For example, multiple network interfaces can be used to allow communication through broadcast, multicast and unicast networks. If the processing requirements require higher speed and capacity, the distributed network controller architecture can be similarly used for pooling, load balancing, and otherwise increasing the communication bandwidth required by the client 802 and the server 804. The communication network can be any type and combination of wired and / or wireless networks, including but not limited to direct interconnection, secure customized connection, private network (e.g., corporate intranet), public network (e.g., Internet), personal area network (PAN), local area network (LAN), metropolitan area network (MAN), operation mission as a node in the Internet (OMNI), wide area network (WAN), wireless network, cellular network and other communication networks.

[0070] The components and features of the above-described devices may be implemented using any combination of discrete circuits, application specific integrated circuits (ASICs), logic gates, and / or single chip architectures. In addition, where appropriate, features of the devices may be implemented using microcontrollers, programmable logic arrays, and / or microprocessors, or any combination of the foregoing. Note that hardware, firmware, and / or software elements may be collectively referred to herein as "logic" or "circuitry."

[0071] At least one computer-readable storage medium may include instructions that, when executed, cause a system to perform any of the computer-implemented methods described herein.

[0072] Some embodiments may be described using the expression "one embodiment" or "an embodiment" and their derivatives. These terms mean that a particular feature, structure, or characteristic described in conjunction with the embodiment is included in at least one embodiment. The phrase "in one embodiment" appearing in various places in the specification does not necessarily refer to the same embodiment. In addition, unless otherwise stated, the above-mentioned features are considered to be able to be used together in any combination. Therefore, any features discussed separately can be used in combination with each other unless it is noted that these features are incompatible with each other.

[0073] The detailed description herein may be presented in terms of program processes executed on a computer or computer network, with general reference to the symbols and nomenclature used herein. These procedural descriptions and representations are used by those skilled in the art to most effectively convey the substance of their work to those skilled in the art.

[0074] A procedure is here, and generally, conceived to be a self-consistent sequence of operations leading to a desired result. These operations are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical, magnetic, or optical signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It is convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. It should be noted, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities.

[0075] In addition, the manipulations performed are often referred to in terms such as adding or comparing, which are often associated with mental operations performed by a human operator. In most cases, such capabilities of a human operator are not required or expected in any of the operations described herein that form a part of one or more embodiments. Instead, these operations are machine operations.

[0076] Some embodiments may be described using the expressions "coupled" and "connected" and their derivatives. These terms are not necessarily synonymous with each other. For example, some embodiments may be described using the terms "connected" and / or "coupled" to indicate that two or more elements are in direct physical or electrical contact with each other. However, the term "coupled" may also mean that two or more elements are not in direct contact with each other, but still cooperate or interact with each other.

[0077] Various embodiments also relate to apparatus or systems for performing these operations. The apparatus may be specially constructed for the desired purpose and may be selectively activated or reconfigured by a computer program stored in a computer. The processes presented herein are not inherently related to a particular computer or other device. The structure required for various such machines will be apparent from the description given.

[0078] It is emphasized that the abstract of the present disclosure is provided to enable the reader to quickly determine the nature of the technical disclosure. The abstract is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the above detailed description, it can be seen that in order to simplify the present disclosure, various features are combined in a single embodiment. The disclosed method should not be interpreted as reflecting the intention that the claimed embodiment requires more features than the features explicitly recited in each claim. On the contrary, as reflected in the following claims, the subject matter of the invention lies in less than all the features of a single disclosed embodiment. Therefore, the following claims are hereby incorporated into the detailed description, and each claim stands on its own as a separate embodiment. In the appended claims, the terms "including" and "in which" are used as the plain English equivalents of the corresponding terms "comprising" and "wherein", respectively. In addition, the terms "first", "second", "third", etc. are used only as labels and are not intended to impose numerical requirements on their objects.

[0079] What has been described above includes examples of the disclosed architecture. Of course, it is not possible to describe every possible combination of components and / or methods, but one of ordinary skill in the art will recognize that many further combinations and permutations are possible. Therefore, the novel architecture is intended to embrace all such changes, modifications, and variations that fall within the spirit and scope of the appended claims.

Claims

1. A method for processing biological information, comprising: receiving biometric information corresponding to a user via at least one input device; performing analysis on the biological information by a processing circuit; determining, by the processing circuitry, a plurality of biometric features uniquely associated with the user based on the performed analysis; generating, by the processing circuit, a character string based at least in part on the plurality of biometric features, the character string comprising a plurality of alphanumeric characters; Using the character string, generating a biometric key based on a cryptographic algorithm; applying at least one hash function and a hash value to the biometric key to generate a hashed biometric key; applying a salt value to the hashed biometric key to generate a salted and hashed biometric key; and One or more of the at least one hash function, hash value, and salt value applied to the biometric key is changed at predetermined intervals to update the biometric key.

2. The method according to claim 1, wherein: The string includes a plurality of different segments, each segment corresponding to one of the plurality of biometric features.

3. The method according to claim 1, wherein: The string is character delimited and space delimited.

4. The method according to claim 3, wherein: The space delimitation and the character delimitation are uniquely associated with the user.

5. The method according to claim 1, wherein: The biometric information includes: (i) fingerprint, (ii) face, (iii) palm print, (iv) palm vein, (v) hand geometry, (vi) voice, (vii) iris, (viii) retina and / or (ix) eye scan.

6. The method according to claim 1, wherein: The multiple biometric features include: (i) pupil distance (PD), (ii) monocular PD, (iii) one or more distances between eyes, pupils, ears, nose, upper lip, lower lip and / or chin, (iv) face width, (v) face height, (vi) voice frequency, (vii) arches, rings and / or whorls of fingerprints, (viii) distance between at least two veins of the palm, (ix) size of the iris, (x) size of the pupil, and (xi) distance between at least two veins of the retina.

7. A machine-readable medium comprising codes, which when executed cause a machine to perform the method according to any one of claims 1 to 6.

8. A computing device, comprising: Processing circuit; and a memory storing instructions that, when executed by the processing circuit, cause the processing circuit to: receiving biometric information corresponding to a user via at least one input device; performing analysis on the biological information; determining a plurality of biometric characteristics uniquely associated with the user based on the performed analysis; generating a character string based at least in part on the plurality of biometric characteristics, the character string comprising a plurality of alphanumeric characters; Using the character string, generating a biometric key based on a cryptographic algorithm; applying at least one hash function and a hash value to the biometric key to generate a hashed biometric key; applying a salt value to the hashed biometric key to generate a salted and hashed biometric key; and One or more of the at least one hash function, hash value, and salt value applied to the biometric key is changed at predetermined intervals to update the biometric key.

9. The computing device according to claim 8, wherein: The string includes a plurality of different segments, each segment corresponding to one of the plurality of biometric features.

10. The computing device according to claim 8, wherein: The string is character delimited and space delimited.

11. The computing device according to claim 10, wherein: The space delimitation and the character delimitation are uniquely associated with the user.

12. The computing device according to claim 8, wherein: The biometric information includes: (i) fingerprint, (ii) face, (iii) palm print, (iv) palm vein, (v) hand geometry, (vi) voice, (vii) iris, (viii) retina and / or (ix) eye scan.

13. The computing device of claim 8, wherein: The multiple biometric features include: (i) pupil distance (PD), (ii) monocular PD, (iii) one or more distances between eyes, pupils, ears, nose, upper lip, lower lip and / or chin, (iv) face width, (v) face height, (vi) voice frequency, (vii) arches, rings and / or whorls of fingerprints, (viii) distance between at least two veins of the palm, (ix) size of the iris, (x) size of the pupil, and (xi) distance between at least two veins of the retina.

Images