CPC H04L 9/30 (2013.01) [G06K 7/10722 (2013.01); G06K 7/1417 (2013.01); H04L 9/088 (2013.01); H04L 63/0861 (2013.01)] | 20 Claims |
1. A method comprising:
maintaining, by an authentication server, a plurality of authentication profiles, each authentication profile corresponding to a respective user and including at least one profile image, an immutable identifier comprising a date of birth of the respective user, and authentication data used to authenticate the respective user;
receiving, by the authentication server from a client device of a user, via a session between the authentication server and an authentication service executing on the client device, a request including the device key of the client device, an immutable identifier for the user, and a biometric image captured during the session by a camera of the client device, the authentication service controlling the camera to capture the biometric image;
authenticating, by the authentication server, the biometric image as captured by the camera of the client device during the session, based on a cryptographic assertion received from the client device;
determining, by the authentication server, that the device key is a new device key generated by the authentication service;
identifying, by the authentication server, from the plurality of authentication profiles, a subset of authentication profiles, the subset of authentication profiles comprising two or more authentication profiles, the subset having respective immutable identifiers that match the immutable identifier from the request;
comparing, by the authentication server, one or more features extracted from the biometric image of the request to features extracted from the at least one profile image of the subset of authentication profiles; and
linking, by the authentication server in a data structure, responsive to determining that the one or more features from the biometric image match the features extracted from the at least one profile image of the authentication profile, the new device key of the client device with an authentication profile of the subset of authentication profiles to register the client device with the authentication server.
|