Correct me if I’m wrong but after reviewing latest claim changes in global dossier of the US20160226868 patent application it seems that applicant submitted patent application claiming NIST Electronic Authentication Guideline publish in 2013 (pdf) guidelines as their invention, moreover the claim changes indicate adaptation to conform to the latest version of the guidelines (now Digital Identity Guidelines) (GitHub) (note claim elements: an electronic mail (e-mail) message, a mobile application push notification, and a web push notification).
Also is it possible to submit this review to the USPTO?
Below are corresponding claim elements from latest submitted claim 4 against citations from the 2013 NIST guideline.
4. (Currently Amended) An integrated interactive messaging system comprising:
[p. iii]
The recommendation covers remote authentication of users (such as employees, contractors, or private individuals) interacting with government IT systems over open networks. E-authentication presents a technical challenge when this process involves the remote authentication of people over an open network, for the purpose of electronic government and commerce.
[p. v]
This recommendation provides technical guidelines to agencies to allow an individual to remotely authenticate his or her identity to a Federal IT system.
an interactive messaging server comprising one or more computers and configured to communicate an interactive push message to a client device used by a user; and
[p. 44]
For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol.
[p. 67]
The challenge and session key are securely transmitted to the Verifier. The Verifier in turn sends only the challenge to the Claimant, and the Claimant applies the challenge to the long-term shared secret to generate the session key. Both Claimant and Verifier now share a session key, which can be used for authentication.
Also see 4. E-Authentication Model
a biometric engine, executed on a computer, to verify the user via one or more biometrics captured at the client device; and
[p. 35]
For physical transactions, the Applicant shall identify himself/herself in person by either using a secret as described above, or by biometric verification (comparing a captured biometric sample to a reference biometric sample that was enrolled during a prior encounter).
[p. 40]
Obtain and verify a copy of a biometric recorded when the original credential was issued. An example of such a biometric is the signed biometric data object on a PIV card, however if the biometric reference is not available from the Level 4 token, it may be obtained elsewhere, as long as its authenticity is assured; Compare a fresh biometric sample obtained in person from the Applicant to the reference biometric retained from the original Level 4 credentials and determine that they match, and; wherein the interactive push message is a push message and comprises a request for biometric capture and is selected from the group consisting of:
[p. 43]
The second factor of authentication may be achieved through some kind of integral entry pad, an integral biometric (e.g., fingerprint) reader or a direct computer interface (e.g., USB port).
[p. 44]
For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol.
a short message service (SMS) message,
a multimedia messaging service (MMS) message,
[p. 44]
For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol.
an electronic mail (e-mail) message,
Push message via “email” was not part of original patent application. Email was identified as an example of personal information, not a messaging platform.
a mobile application push notification, and
Could not find “mobile application push notification” as part of original patent application.
a web push notification;
Could not find “web push notification” as part of original patent application.
the biometric engine is configured to communicate with a service provider and the interactive message messaging server using an out-of-band network distinct from a primary network connecting the client device and the service provider;
[p. 4]
Recognition of more types of tokens, including pre-registered knowledge token, lookup secret token, out-of-band token, as well as some terminology changes for more conventional token types;
[p. 15]
Trust Anchor A public or symmetric key that is trusted because it is directly built into hardware or software, or securely provisioned via out-of-band means, rather than because it is vouched for by another trusted entity (e.g. in a public key certificate).
[p. 44]
For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol.
the biometric engine is configured to receive, over the out-of-band network, a request from the service provider for verification of a user;
[p. 15]
Trust Anchor A public or symmetric key that is trusted because it is directly built into hardware or software, or securely provisioned via out-of-band means, rather than because it is vouched for by another trusted entity (e.g. in a public key certificate).
[p. 44]
• Out of Band Token – A physical token that is uniquely addressable and can receive a Verifier-selected secret for one-time use. The device is possessed and controlled by the Claimant and supports private communication20 over a channel that is separate from the primary channel for e-authentication. The token authenticator is the received secret and is presented to the Verifier using the primary channel for e-authentication. For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol. Out of Band Tokens are something you have.
the biometric engine is configured to communicate with the interactive messaging server to request one or more biometric probes from the user;
This is implied.
the one or more biometric probes are generated at the client device using biometric information collected from the user by the client device;
Camera equipped mobile devices were already popular at the time of patent applications. Thus obvious to one skilled in art.
[p. 45]
The second factor of authentication may be achieved through some kind of integral entry pad, an integral biometric (e.g., fingerprint) reader or a direct computer interface (e.g., USB port).
[p. 44]
For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol.
the biometric engine is configured to receive the biometric probes over the out-of-band network;
Not explained how response biometric probe is sent back via e.g. Text Messaging service.
the biometric engine is configured to compare the biometric probes with biometric templates stored in a database; and
[p. 40]
Obtain and verify a copy of a biometric recorded when the original credential was issued. An example of such a biometric is the signed biometric data object on a PIV card, however if the biometric reference is not available from the Level 4 token, it may be obtained elsewhere, as long as its authenticity is assured; Compare a fresh biometric sample obtained in person from the Applicant to the reference biometric retained from the original Level 4 credentials and determine that they match, and;
the biometric engine is configured to provide a response to the service provider representing the possibility that the biometric probe and the biometric template are from the same user.
E-authentication begins with registration. The usual sequence for registration proceeds as follows. An Applicant applies to a Registration Authority (RA) to become a Subscriber of a Credential Service Provider (CSP). If approved, the Subscriber is issued a credential by the CSP which binds a token to an identifier (and possibly one or more attributes that the RA has verified). ... When a Claimant successfully demonstrates possession and control of a token to a Verifier through an authentication protocol, the Verifier can verify that the Claimant is the Subscriber named in the corresponding credential. The Verifier passes on an assertion about the identity of the Subscriber to the Relying Party (RP). That assertion includes identity information about a Subscriber, such as the Subscriber name, an identifier assigned at registration, or other Subscriber attributes that were verified in the registration process (subject to the policies of the CSP and the needs of the application). Where the Verifier is also the RP, the assertion may be implicit. The RP can use the authenticated information provided by the Verifier to make access control or authorization decisions.
Also see 4. E-Authentication Model
5. (Original) The system of claim 4, wherein the response to the service provider comprises a biometric fusion score.
Either match/no match or fusion score has no real difference, in any case the result from biometric matcher at some point has to be converted into match/no match form.
