RU2752290C1 - User authentication method and system - Google Patents

Abstract

FIELD: data transmission.SUBSTANCE: invention relates to a method, a terminal apparatus and a system for authentication of a user for a transaction. In the method, the input personal identification number (PIN) entered by the user, the input image drawn by the user on the touch screen of a terminal apparatus and the input biometric information of the user are recorded by the terminal apparatus when a transaction is initiated by the user on the terminal apparatus by means of a payment form constituting a payment medium associated with the account of the user, while the input image is drawn by the user; and a transaction is executed by the terminal apparatus based on user authentication, wherein the user is authenticated by the server receiving the input PIN, input image and input biometric information sent by the terminal apparatus when the input PIN, input image and input biometric information match the reference PIN, reference image and reference biometric information associated with the payment form, respectively, wherein the reference biometric information is associated with the reference image.EFFECT: technical result is improved security of a transaction.20 cl, 22 dwg

Description

TECHNICAL FIELD OF THE INVENTION

[0001] Various embodiments of the disclosure relate generally to methods and systems for authentication. More specifically, various embodiments of the disclosure relate to a method and system for authenticating users for transactions.

LEVEL OF TECHNOLOGY

[0002] Advances in technology have paved the way for the ability for users to conduct financial transactions electronically. Examples of terminal devices that facilitate such transactions include ATMs, point of sale (POS) devices, or the like. One of the most commonly used forms of payment for these transactions is ATM. ATM provides users (such as bank customers) with the ability to withdraw funds, deposit funds, transfer funds, and access account information.

[0003] Before processing a financial transaction performed by an ATM (or any other terminal device), it is important to authenticate the user performing the transaction. The traditional approach to authenticating a user requires the user to provide a personal identification number (PIN) associated with a transaction card (such as a debit card, credit card, or the like) of the user when initiating a transaction. Relying on PIN and lack of human control creates the risk that an attacker will compromise the security of the ATM. For example, an intruder can obtain information encrypted in a magnetic stripe or electronic chip of a transaction card and a PIN entered by a user through skimming devices, keyboard overlays, hidden cameras, or the like. The information obtained can then be used to gain unauthorized access to the user's funds, thereby leading to financial losses for the user, as well as the financial institution that maintains the user's account. Similar problems can arise for transactions performed through POS devices.

[0004] In light of the above, there is a need for a solution that provides a secure user authentication mechanism that prevents an unauthorized user from gaining unauthorized access to user funds.

SUMMARY OF THE INVENTION

[0005] In one embodiment of the disclosure, a method is provided for authenticating a user for a transaction. When a transaction is initiated by a user on a terminal device via a payment form, an input personal identification number (PIN) entered by the user, an input image drawn by the user on the touch screen of the terminal device, and the user's biometric input while the input image is drawn by the user are recorded by the device terminal. The transaction is executed by the terminal device based on user authentication. The user is authenticated when the input PIN, input image, and input biometric information match the reference PIN, reference image, and reference biometric information that are associated with the payment form, respectively. Additionally, the reference biometric information is associated with the reference image.

[0006] In another embodiment of the disclosure, a terminal device is provided. The terminal device includes a digital keyboard, a touch screen and a set of biometric sensors. The numeric keypad is configured to record the input PIN entered by the user to initiate a transaction at the terminal device. The touch screen is configured to display the first set of objects. The touch screen is further configured to record an input image that is drawn by the user by connecting a second set of objects from the first set of objects. In addition, the biometric sensor suite is configured to record the user's input biometric information while the input image is drawn by the user. The user is authenticated for a transaction when the input PIN, input image, and input biometric information match the reference PIN, reference image, and reference biometric information that are associated with the form of payment used to initiate the transaction, respectively. In addition, the reference biometric information is associated with the reference image.

[0007] In another embodiment of the disclosure, a system is provided for authenticating a user for a transaction. The system includes a terminal device that includes a numeric keypad, a touch screen, and a set of biometric sensors. The numeric keypad is configured to record the input PIN entered by the user to initiate a transaction at the terminal device. The touch screen is configured to display the first set of objects. The touch screen is further configured to record an input image that is drawn by the user by connecting a second set of objects from the first set of objects. The biometric sensor suite is configured to record the user's input biometric information while the input image is drawn by the user. The system further includes a server that communicates with the terminal device. The server is configured to authenticate a user when the input PIN, input image, and input biometric information that are recorded by the terminal device match the reference PIN, reference image, and reference biometric information that are associated with the form of payment used to initiate the transaction, respectively. In addition, the reference biometric information is associated with the reference image.

BRIEF DESCRIPTION OF DRAWINGS

[0008] The accompanying drawings depict various embodiments of the systems, methods, and other aspects of the disclosure. One skilled in the art will appreciate that the boundaries of the illustrated elements (eg, rectangles, groups of rectangles, or other shapes) in the drawings represent one example of boundaries. In some examples, one element may be depicted as a plurality of elements, or a plurality of elements may be depicted as one element. In some examples, an item shown as an internal component of one item may be implemented as an external component in another, and vice versa.

[0009] Various embodiments of the disclosure are illustrated by way of example and are not limited to the accompanying drawings, in which like references indicate like elements:

[0010] FIG. 1 is a block diagram that illustrates an exemplary environment for authenticating users, in accordance with an exemplary embodiment of the disclosure;

[0011] FIG. 2A is a block diagram that illustrates a perspective view of an ATM machine from the environment of FIG. 1, in accordance with an exemplary embodiment of the disclosure;

[0012] FIG. 2B is a block diagram that illustrates various ATM components in accordance with an exemplary embodiment of the disclosure;

[0013] FIGS. 3A-3D collectively represent a process flow diagram that illustrates an example scenario for registering user reference information with an issuer in the environment of FIG. 1, in accordance with an exemplary embodiment of the disclosure;

[0014] FIG. 4 is an example scenario that illustrates various reference images and corresponding reference fingerprints that a user registers with an issuer, in accordance with an exemplary embodiment of the disclosure;

[0015] FIG. 5 is a table that illustrates a tabular database maintained on an issuer server at an issuer, in accordance with an exemplary embodiment of the disclosure;

[0016] FIGS. 6A-6C collectively represent a flow diagram that illustrates an example scenario for authenticating a user for a transaction in the environment of FIG. 1, in accordance with an exemplary embodiment of the disclosure;

[0017] FIG. 7 is a block diagram that illustrates a perspective view of a point of sale (POS) device from the environment of FIG. 1, in accordance with an exemplary embodiment of the disclosure;

[0018] FIG. 8 is a block diagram that illustrates various components of an issuer server in accordance with an exemplary embodiment of the disclosure;

[0019] FIGS. 9A and 9B collectively represent a flow diagram that illustrates a method for providing registration of reference information with an issuer, in accordance with an exemplary embodiment of the disclosure;

[0020] FIG. 9C is a flow diagram that illustrates a method for executing a user initiated transaction in accordance with an exemplary embodiment of the disclosure;

[0021] FIG. 10A is a flow diagram that illustrates a method for registering reference information with an issuer, in accordance with an exemplary embodiment of the disclosure;

[0022] FIGS. 10B and 10C collectively represent a flow diagram that illustrates a method for authorizing a user initiated transaction in accordance with an exemplary embodiment of the disclosure;

[0023] FIG. 11 is a high-level flow diagram that illustrates a method for authenticating a user for a transaction, in accordance with an exemplary embodiment of the disclosure; and

[0024] FIG. 12 is a block diagram that illustrates a system architecture of a computer system in the environment of FIG. 1, in accordance with an exemplary embodiment of the disclosure.

[0025] Additional fields of application of the disclosure will become apparent from the detailed description provided below. It should be understood that the detailed description of the exemplary embodiments is for illustration purposes only and, thus, is not intended to necessarily limit the scope of the disclosure.

DETAILED DESCRIPTION

[0026] The disclosure is easiest to understand with reference to the detailed drawings and the description set forth herein. Various embodiments are discussed below with reference to the drawings. However, those skilled in the art will readily understand that the detailed descriptions given herein in relation to the drawings are merely for purposes of explanation, as methods and systems may fall outside the scope of the described embodiments. In one example, the presented ideas and requirements of a particular application may give rise to many alternative and suitable approaches to implement the functionality of any part described herein. Thus, any approach can go beyond the specific choices of implementation in the following embodiments, which are described and shown.

[0027] References to "an embodiment", "another embodiment", "another embodiment", "one example", "another example", "another example", "for example" and so on indicate that an option ( s) the implementation or example (s) described in this way may include a specific feature, structure, characteristic, property, element or limitation, but not every embodiment or example necessarily includes that specific feature, structure, characteristic, property , item or limitation. In addition, repeated use of the phrase "in one embodiment" does not necessarily refer to the same embodiment.

OVERVIEW

[0028] In current transaction systems, when a user initiates a transaction at a terminal device, the user provides a personal identification number (PIN) to the terminal device for authentication. Relying solely on the PIN, however, creates the risk that the attacker will receive, tricked into the terminal device, the PIN and details of the transaction card used to initiate the transaction. The information obtained can subsequently be used to gain unauthorized access to the user's funds. Thus, relying solely on the PIN to authenticate the user may not prevent the user from being tricked.

[0029] Various embodiments of the disclosure provide a method and system for authenticating a user to resolve the aforementioned problems. When a user is presented with a payment form (eg, a transaction card), the user is required to register the user's reference information with the entity that issued the payment form to the user (eg, the issuer that maintains the user's account for the user). The user can register the reference information with the issuer through the terminal device. To initiate registration, the user enters the reference PIN multiple times through the numeric keypad of the terminal device and draws the reference image multiple times on the touch screen of the terminal device. The terminal device records the reference PIN entered each time by the user and the reference image drawn each time by the user. The terminal device additionally records the reference biometric information of the user while the reference image is drawn each time by the user, the reference times taken by the user to draw the reference image each time, and the reference pressure values corresponding to the pressures applied by the user to draw the reference image each time. ... An example of the reference biometric information may include a reference fingerprint used by a user to draw a reference image a plurality of times. The reference PIN, reference image, reference biometric information, reference time intervals, and reference pressure values are collectively referred to as reference information. The server associated with the issuer receives the reference information recorded by the terminal device. Based on the reference pressure values and reference time intervals, the server determines the pressure and time ranges for user authentication, respectively. The server then associates the reference PIN, reference image, reference biometric information, time range, and pressure range to the form of payment, thereby successfully registering the user's reference information with the issuer.

[0030] Upon successful registration, the user can use the form of payment to perform transactions. For example, a user can use a form of payment to initiate a transaction at a terminal device, such as an ATM (ATM) or point of sale (POS) device. In addition, the user enters the input PIN through the numeric keypad and draws the input image on the touch screen. The terminal device records the input PIN entered by the user and the input image drawn by the user. The terminal device additionally records the input biometric information of the user while the input image is being drawn by the user, the input time interval taken by the user to draw the input image, and the input pressure value corresponding to the pressure applied by the user to draw the input image. The input PIN, input image, input biometric information, input time interval, and input pressure value are collectively referred to as user authentication information. The server receives authentication information recorded by the terminal apparatus and authenticates the user based on the authentication information and reference information associated with the form of payment. For example, the server authenticates the user when the input PIN matches the reference PIN, the input image matches the reference image, the input biometric information matches the reference biometric information, the input time slot is within the time range, and the input pressure value is within the pressure range. The terminal device executes the transaction when the user is successfully authenticated.

[0031] Thus, the user is authenticated based on a combination of the input PIN, the input image, the input biometric information, the input time slots, and the input pressure value. The use of various factors such as PIN, image, biometric information, time interval and pressure value to authenticate a user provides a more secure way to authenticate users compared to standard PIN-based user authentication methods implemented in a terminal device.

DESCRIPTION OF TERMS (in addition to common and dictionary meaning)

[0032] A transaction is an exchange of funds between two or more parties. For example, a transaction may include dispensing cash at an ATM equal to the amount of the transaction debited from the user's account. In another example, a transaction may include transferring a transaction amount from a user to a merchant when a user makes a purchase from a merchant.

[0033] A terminal device is a computing device associated with a financial institution (such as an acquirer). The terminal device enables users to perform various electronic transactions such as cash withdrawals, cash deposits, payments for purchases, funds transfers, or the like. In addition, the terminal device provides registration of the reference information of users with the respective issuers. Examples of the terminal device may include a POS device, a point of purchase (POP) device, a point of interaction (POI) device, an ATM, a bundle acceptance (BNA) device, a currency recycler, or the like.

[0034] A form of payment is a means of payment, such as a transaction card, digital wallet, and / or the like, that is linked to a user's account. Examples of a transaction card can include, but are not limited to, a debit card, a credit card, a prepaid card, a gift card, a promotion card, and a contactless card. The form of payment can be used to carry out transactions such as cash withdrawals, cash deposits, payments for purchases, transfers of funds, or the like, from the user account to which it is linked. The form of payment can be a physical form of payment or a virtual form of payment that is electronically stored on the user's device.

[0035] The image is drawn by connecting various objects displayed on the touch screen of the terminal device. The user can draw the image by using at least one finger. The drawn image is used to authenticate the user for a user initiated transaction. When the image is drawn by the user, the fingerprint used by the user to draw the image, the time interval taken by the user to draw the image, and the pressure applied by the user to draw the image are recorded in the terminal device to authenticate the user for a transaction.

[0036] The time range corresponds to the range of time intervals that a true user can take to draw a registered image. The time range is determined during the registration of the user's reference information with the issuer. Additionally, the time range can be updated after each successful user authentication. The time range is usually specified in seconds.

[0037] The pressure value corresponds to the amount of pressure applied by the user to draw the image on the touch screen of the terminal device. In one example, a user can apply constant pressure to paint an image. In this scenario, the pressure value is equal to the constant pressure value. In another example, the pressure applied by the user can vary while the image is being drawn by the user. In such a scenario, the pressure value may correspond to any one of the mean, median, mode, highest, lowest, or full value of the varying pressure values. The pressure value is usually measured in pascals.

[0038] The pressure range corresponds to the range of pressure values corresponding to the pressures that a true user can apply to draw a registered image. The pressure range is determined during registration of the user's reference information with the issuer. Additionally, the pressure range can be updated after each successful user authentication. The pressure range is usually specified in Pascals.

[0039] User reference information includes a reference PIN entered by the user multiple times, a reference image drawn by the user multiple times, and reference biometric information of the user recorded while the reference image is drawn by the user multiple times. The reference information further includes reference times taken by the user to draw the reference image a plurality of times and the reference pressure values corresponding to pressures applied by the user to draw the reference image a plurality of times. The user's reference information is registered with the issuer that maintains the user's account for the user. The reference information is registered to allow the user to be authenticated when the user performs transactions using a transaction card issued by the issuer.

[0040] User authentication information is recorded by the terminal device when the user initiates a transaction in the terminal device via a payment form. The authentication information includes the input PIN entered by the user, the input image drawn on the terminal device by the user, the input biometric information of the user recorded while the input image is drawn by the user. The authentication information further includes an input time interval taken by the user to draw the input image and an input pressure value corresponding to the pressure applied by the user to draw the input image. The user is authenticated for the transaction based on the user authentication information and the user reference information registered with the issuer that maintains the user account for the user.

[0041] A numeric keypad is installed in the terminal device and is used by users to enter the user's PIN. The numeric keypad can be a physical keyboard or a virtual keyboard that is integrated into the touch screen of the terminal device or any other screen of the terminal device.

[0042] FIG. 1 is a block diagram that illustrates an exemplary environment 100 for authenticating users, in accordance with an exemplary embodiment of the disclosure. Environment 100 includes user 102, payment form 104 of user 102, first and second terminal devices 106a and 106b, acquirer server 108, payment network server 110, and issuer server 112. The first and second terminal devices 106a and 106b, acquirer server 108, payment network server 110, and issuer server 112 communicate with each other via communication network 114 or through separate communication networks established therebetween.

[0043] User 102 is an individual to be authenticated. In one embodiment, user 102 may be the account holder of a user account maintained by a financial institution, such as an issuer. For purposes of ongoing consideration and without limiting the scope of the disclosure, it is assumed that the payment form 104 is a transaction card and the issuer has issued the payment form 104 to the user 102 to perform transactions from the user account. Hereinafter, the payment form 104 is referred to and referred to as "transaction card 104". The user 102 can use the transaction card 104 to perform transactions on various terminal devices (eg, first and second terminal devices 106a and 106b). Examples of transactions performed on terminal devices may include withdrawing cash, depositing cash, paying for purchases, transferring funds, and the like. Before using the transaction card 104 to perform transactions, the user 102 needs to register user 102 reference information with the issuer that issued the card. 104 transactions to the user 102. The reference information is used by the issuer to authenticate the user 102 when a transaction is performed by the user 102 on the terminal device using the transaction card 104.

[0044] The transaction card 104 is linked to the user's account and stores account information for the user's account. The account information may include an account number, the name of the account holder (i.e., user 102), or the like. In addition, the transaction card 104 may have a unique card number, expiration date, and card security code. Account information for the user's account, unique card number, expiration date, and card security code are collectively referred to as card 104 transaction details. In one embodiment, the transaction card 104 is a physical card. In another embodiment, the transaction card 104 is a virtual card stored in a memory (not shown) of the user device (not shown) of the user 102. Examples of the transaction card 104 may include a credit card, debit card, membership card, promotion card, payment card, a prepaid card, gift card, contactless card, or the like.

[0045] The first and second terminal devices 106a and 106b include suitable logic, circuits, interfaces, and / or code executed by the circuits to allow users (such as user 102) to perform transactions from their respective user accounts. Each of the first and second terminal devices 106a and 106b may be associated with a financial institution, such as an acquirer. Examples of the first and second terminal devices 106a and 106b may include an ATM, bundle acceptance (BNA), currency recycling, point of purchase (POP) device, point of interaction (POI) device, POS device, or the like. For brevity, it is assumed that the first terminal device 106a is an ATM and the second terminal device 106b is a POS device. In addition, the first terminal device 106a is hereinafter referred to and referred to as "ATM 106a", and the second terminal device 106b is hereinafter referred to and referred to as the "POS device 106b".

[0046] ATM 106a provides registration of reference information with the issuer that maintains the user's account and issued the transaction card 104 to the user 102. The reference information is registered to allow the user 102 to be authenticated when the user 102 transacts using the transaction card 104. When user 102 initiates registration with ATM 106a, ATM 106a prompts user 102 to enter a reference PIN and draw the reference image multiple times. Based on the reference PIN inputted each time and the reference image drawn each time, the ATM 106a records the reference information of the user 102. The reference information includes the reference PIN inputted each time by the user 102, the reference image drawn each time by the user 102, and the reference biometric information of the user 102 that is recorded while the reference image is drawn each time (eg, a reference fingerprint used by the user 102 to draw the reference image each time). The reference information may further include reference times taken by the user 102 to draw the reference image each time, and the reference pressure values corresponding to the pressures applied by the user 102 to draw the reference image each time. ATM 106a provides reference information to the issuer.

[0047] The ATM 106a may further enable the user 102 to perform transactions and process transactions performed by the user 102. When a transaction is initiated by the user 102 in the ATM 106a via the transaction card 104, the ATM 106a records the details of the transaction card 104 and the authentication information of the user 102. The authentication information is recorded ATM 106a based on the input PIN entered and the input image drawn by the user 102 when initiating the transaction. The authentication information includes an input PIN, an input image, and input biometric information of the user 102 that is recorded while the input image was being drawn (eg, an input fingerprint used by the user 102 to draw the input image). The authentication information further includes an input time interval taken by the user 102 to draw the input image and an input pressure value corresponding to the pressure applied by the user 102 to draw the input image. Additionally, ATM 106a records the transaction details for the transaction. The details of the transaction include the type of transaction (such as cash withdrawal), the amount of the transaction, and / or the like. ATM 106a provides authentication information to an issuer to authenticate a user 102 for a transaction. ATM 106a may execute a transaction based on the authentication of user 102. For example, if the transaction is a cash withdrawal transaction, ATM 106a may dispense cash equal to the amount of the transaction when user 102 is authenticated.

[0048] POS device 106b is functionally similar to ATM 106a. For example, the POS device 106b may enable a user 102 to register reference information with an issuer and transact via a transaction card 104 or any other form of payment such as a digital wallet.

[0049] The acquirer server 108 is a computing server operated by the acquirer and includes suitable logic, circuits, interfaces, and / or circuit executable code to process transactions. The acquirer server 108 communicates with the ATM 106a and the POS device 106b to receive reference information and authentication information. The acquirer server 108 further communicates with the payment network server 110 to process various transactions performed at the ATM 106a and POS device 106b.

[0050] The payment network server 110 is a computing server operated by the payment network and includes suitable logic, circuits, interfaces, and / or chain-executable code to process transactions. The payment network server 110 represents an intermediate entity between the acquirer server 108 and the issuer server 112 for processing transactions.

[0051] The Issuer Server 112 is a computing server operated by the Issuer and includes suitable logic, circuits, interfaces, and / or code executed on the circuits to authorize transactions performed by the transaction card 104 or any other form of payment issued by the Issuer. The issuer is a financial institution that manages the accounts of a plurality of users, such as user 102. Account details for user accounts established with the issuer are stored as account profiles in a memory (shown later in FIG. 8) of the issuing server 112, in an external database. associated with the issuer server 112, or in a cloud server associated with the issuer server 112. Account details may include details of account holders, account numbers for user accounts, account balances for user accounts, details of issued card transactions, or the like. Account holders details include name, age, gender, registered contact number, registered email ID, or the like.

[0052] When the registration of the reference information is initiated by the user 102, the issuing server 112 receives the transaction card 104 details and the reference information from the ATM 106a or the POS device 106b via the acquirer server 108 and the payment network server 110. The issuing server 112 binds the reference information to the transaction card 104 and stores the information related to the binding in the memory of the issuing server 112. In one example, the issuing server 112 may create a tabular database (shown later in FIG. 5) having different rows and columns for storing information related to various bindings, such as the binding between reference information and the transaction card 104. Each row in the table database corresponds to a unique binding. For example, each row can store a username, account number of a user's account, a unique card number associated with a transaction card, reference information associated with a transaction card, or the like.

[0053] When a transaction is initiated by user 102, the issuing server 112 receives the transaction card 104 details, authentication information, and transaction details from the payment network server 110. The issuing server 112 authenticates the user 102 and authorizes transactions based on the details of the transaction card 104, authentication information, transaction details, and the binding between the reference information and the transaction card 104.

[0054] A communications network 114 is a medium through which content and messages are transferred between an ATM 106a, a POS device 106b, an acquirer server 108, a payment network server 110, an issuer server 112, or other entities that conform to one or more standards for transaction messaging. such as the ISO8583 standard. Examples of communication network 114 may include, but are not limited to, Wi-Fi network, light fidelity network (Li-Fi), local area network (LAN), wide area network (WAN), regional network (MAN), satellite network, Internet, fiber optic network, coaxial cable network, infrared (IR) network, radio frequency (RF) network, and combinations thereof. Various entities in environment 100 can connect to communication network 114 in accordance with various wired and wireless communication protocols such as Transmission Control Protocol and Internet Protocol (TCP / IP), User Datagram Protocol (UDP), Long Term Evolution Project (LTE) communication protocols ) or any combination of them.

[0055] Although the disclosure describes that the transaction card 104 is used by the user 102 to initiate registration of reference information with the issuer and to initiate a transaction, the scope of the disclosure is not limited thereto. In various other embodiments, the user 102 may have a digital wallet and may register reference information with the digital wallet service provider of that digital wallet without deviating from the scope of disclosure. Upon registration, the user 102 can use the digital wallet to initiate a transaction. In such a scenario, operations performed by the issuer server 112 may be performed by a server associated with a digital wallet service provider.

[0056] FIG. 2A is a block diagram that illustrates a perspective view of an ATM 106a, in accordance with an exemplary embodiment of the disclosure. ATM 106a includes card reader 202 having a card slot 204. The card reader 202 is configured to record details of transaction cards (eg, transaction cards 104) that are used in the ATM 106a. The ATM 106a further includes a numeric keypad 206 and a touch screen 208. The numeric keypad 206 and a touch screen 208 are used by users (such as user 102) to enter a PIN and to draw images, respectively. Numeric keypad 206 is configured to record PINs entered by users, and touch screen 208 is configured to record user-drawn patterns. ATM 106a further includes biometric sensors 210 that are configured to record biometric information of users while users draw images on the touch screen 208. Examples of biometric sensors 210 may include fingerprint sensors, iris sensors, or the like. For purposes of ongoing consideration and without limiting the scope of the disclosure, biometric sensors 210 are assumed to be fingerprint sensors that record user fingerprints while images are drawn by users. In the following, biometric sensors 210 are referred to and referred to as "fingerprint sensors 210".

[0057] ATM 106a further includes pressure sensors 212 that are configured to record pressure values while users draw images on the touchscreen 208. In one embodiment, the fingerprint sensors 210 and pressure sensors 212 may be located below the touchscreen. screen 208. The ATM 106a further includes a timer 214 that is configured to record the times taken by users to draw images on the touch screen 208. In addition, the ATM 106a is equipped with a display screen 216 and a cash dispenser 218. The display screen 216 displays various messages related to the success and failure of registrations and transactions to users. Cash dispenser 218 dispenses cash when transactions initiated at ATM 106a are cash withdrawals. However, when the transactions initiated in the ATM 106a are cash deposits, the cash dispenser 218 may function as a cash deposit machine.

[0058] Although the touch screen 208 and the display screen 216 are implemented as separate components in FIG. 2A, the scope of the disclosure is not limited thereto. In various other embodiments, the touch screen 208 may be integrated into the display screen 216 without deviating from the scope of the disclosure. In such a scenario, the fingerprint sensors 210 and the pressure sensors 212 may be located below the display screen 216.

[0059] FIG. 2B is a block diagram that illustrates various components of an ATM 106a, in accordance with an exemplary embodiment of the disclosure. As depicted in FIG. 2A, ATM 106a includes a card reader 202, a numeric keypad 206, a touch screen 208, fingerprint sensors 210 (i.e., biometric sensors 210), pressure sensors 212, and a timer 214. ATM 106a further includes includes the first processing circuits 220, the first memory 222 and the first transceiver 224. The card reader 202, the numeric keypad 206, the touch screen 208, the fingerprint sensors 210, the pressure sensors 212, the timer 214, the first processing circuits 220, the first memory 222 and the first the transceiver 224 communicates with each other via the first communication bus 226.

[0060] The card reader 202 includes suitable logic, circuits, interfaces, and / or code executed by the circuits to write the details of transaction cards (such as transaction card 104) that are used in ATM 106a. The card reader 202 may be a magnetic stripe card reader or an electronic chip equipped with a card slot 204 into which transaction cards can be inserted or swiped. In one embodiment, the card reader 202 records the details of the transaction cards that are inserted into or posted to the card slot 204. The card reader 202 may further be provided with near field communication (NFC) capabilities such that transaction card details can be recorded when the transaction cards touch the card slot 204 or are within NFC range of the ATM 106a.

[0061] Numeric keypad 206 includes suitable logic, circuits, interfaces, and / or code executed by circuits to write PIN and transaction details for transactions initiated by users (such as user 102) into ATM 106a. Numeric keypad 206 includes various buttons (or keys) that are used by users to enter PIN and / or transaction details. The buttons can display numbers (such as "0" to "9"), functions (such as "enter", "erase" or "cancel"), or the like. In one embodiment, the numeric keypad 206 is a physical keyboard. In another embodiment, the numeric keypad is a virtual keyboard integrated into a touch screen 208, a display screen 216, or a separate screen (not shown) of an ATM 106a.

[0062] The touchscreen 208 includes suitable logic, circuits, interfaces, and / or code executed by the circuits to record user-drawn images. The touchscreen 208 is configured to display various objects (eg, points, circles, squares, triangles, rectangles, or any other geometric or non-geometric shapes) to users, and users are prompted to draw images by connecting two or more of the displayed objects. When users touch or press an object on the touchscreen 208 with their finger and drag their finger over other objects to draw an image, the touchscreen 208 is configured to record the touch positions and the drawn image (i.e., a sequential combination of touch positions). In one embodiment, the image drawn on the touch screen 208 is visible, i. E. lines connecting two or more objects in the image are visible. In another embodiment, the image drawn on the touch screen 208 is invisible, i. E. lines connecting two or more objects in the image are invisible. Examples of the touch screen 208 may include, but are not limited to, a resistive touch screen, a capacitive touch screen, a surface acoustic wave (SAW) touch screen, and an optical touch screen.

[0063] Fingerprint sensors 210 include suitable logic, circuits, interfaces, and / or code executed by circuits to record user fingerprints while images are drawn by users on touchscreen 208. Fingerprint sensors 210 may be an array of sensors that are located below the touch screen 208, or more specifically, below the area covering various objects displayed on the touch screen 208. In one example, a fingerprint sensor is located below each object. In one embodiment, the fingerprint sensors 210 are in physical contact with the touchscreen 208. In another embodiment, the fingerprint sensors 210 are physically disconnected from the touchscreen 208. When a user (such as user 102) draws an image using a finger, the fingerprint sensors 210 Configurable to record a fingerprint. In one example, the fingerprint sensors 210 may record a digital image of the fingerprint. Examples of fingerprint sensors 210 may include, but are not limited to, optical fingerprint sensors, capacitive fingerprint sensors, ultrasonic fingerprint sensors, and thermal fingerprint sensors.

[0064] Pressure sensors 212 include suitable logic, circuits, interfaces, and / or code executed by the circuits to record the amount of pressure applied by users on the touch screen 208 to draw images. The pressure sensors 212 can be an array of sensors that are located below the touch screen 208, or more specifically, below the area covering various objects displayed on the touch screen 208. In one example, a pressure sensor is located under each object displayed on the touch screen 208. In one embodiment the pressure sensors 212 are in physical contact with the touch screen 208. In another embodiment, the pressure sensors 212 are physically disconnected from the touch screen 208.

[0065] When a user (such as user 102) draws an image using a finger, pressure sensors 212 are configured to record a pressure value corresponding to the amount of pressure applied by the user to draw the image. In one example, the pressure applied by the user may be constant. In such a scenario, the pressure value may correspond to the constant pressure value applied by the user. In another example, the pressure applied by the user can vary while the image is being drawn by the user. In such a scenario, the pressure value may correspond to one of the mean, median, mode, highest, lowest, or total variable pressures applied by the user. Examples of pressure sensors 212 may include, but are not limited to, resistive pressure sensors, capacitive pressure sensors, optical pressure sensors, ultrasonic pressure sensors, magnetic pressure sensors, piezoresistive pressure sensors, and piezoelectric pressure sensors.

[0066] The timer 214 includes suitable logic, circuits, interfaces, and / or code executed by the circuits to record the times it takes users to draw images. The timer 214 is activated when the first touch is recorded on the touch screen 208 (i.e. when the finger is placed on the touch screen 208), and is deactivated when the last touch is recorded on the touch screen 208 (i.e. when the finger is lifted off the touch screen 208) ...

[0067] The first processing circuits 220 include suitable logic, circuits, interfaces, and / or code executed by the circuits to facilitate registration of user reference information with issuers that support user user accounts. The first processing chains 220 additionally provide user authentication and execute user initiated transactions in ATM 106a. First processing circuits 220 provide enrollment and authentication via card reader 202, numeric keypad 206, touch screen 208, fingerprint sensors 210, pressure sensors 212, and timer 214. Operations performed by first processing circuits 220 are explained in detail in conjunction with FIG. 3A. -3D, 6A-6C and 9A-9C. Examples of the first processing circuits 220 may include an application-specific integrated circuit (ASIC) processor, a reduced instruction set computer (RISC) processor, a complex instruction set computer (CISC) processor, a field programmable gate array (FPGA), or the like.

[0068] The first memory 222 includes suitable logic, circuits, interfaces and / or code executed by the circuits to provide registration of reference information with the issuer and processing of transactions initiated in ATM 106a. The first memory 222 can temporarily store PINs, patterns, fingerprints, pressure values and time slots recorded by the ATM 106a in an encrypted format. Examples of first memory 222 may include random access memory (RAM), read-only memory (ROM), removable memory, hard disk drive (HDD), flash memory, solid state memory, or the like. One skilled in the art will appreciate that the scope of the disclosure is not limited to implementing the first memory 222 in ATM 106a as described herein. In another embodiment, first memory 222 may be in the form of a database server or cloud storage, operating in conjunction with ATM 106a, without going beyond the scope of the disclosure.

[0069] The first transceiver 224 includes suitable logic, circuits, interfaces, and / or code executed by the circuits to transmit and receive data over the communications network 114 using one or more communications protocols. The first transceiver 224 transmits various requests and messages related to the registration of reference information and authorization of the transaction to the acquirer server 108. The first transceiver 224 receives various requests and messages related to registration of reference information and authorization of the transaction from the acquirer server 108. Examples of the first transceiver 224 may include, but are not limited to, an antenna, an RF transceiver, a wireless transceiver, a Bluetooth transceiver, an Ethernet port, a universal serial bus (USB) port, or any other device configured to transmit and receive data.

[0070] FIGS. 3A-3D collectively represent a process flow diagram 300 that illustrates an example scenario for registering reference information with an issuer, in accordance with an exemplary embodiment of the disclosure. The user 102 is required to register reference information for the card 104 transactions with the issuer before using the card 104 transactions to perform transactions. The user 102 can register the reference information with the issuer via an ATM (such as ATM 106a) or a POS device (such as a POS device 106b). For brevity, it is assumed that the user 102 initiates registration of the reference information in the ATM 106a.

[0071] Transaction card 104 is used by user 102 in ATM 106a to initiate registration (as indicated by arrow 302). In one example, the user 102 inserts the transaction card 104 into the card slot 204. In another example, user 102 posts card 104 transactions to card slot 204. In another example, the user 102 touches the transaction card 104 to the card slot 204. In another example, user 102 presents a transaction card 104 near card slot 204.

[0072] The card reader 202 records the details of the transaction card 104 (as shown by arrow 304). The ATM 106a prompts the user 102 through a display screen 216 to enter a PIN for the first time (as indicated by arrow 306). The user 102 enters a PIN for the first time (hereinafter referred to as the "first reference PIN") through the numeric keypad 206 (as shown by arrow 308). Numeric keypad 206 records the first reference PIN (as shown by arrow 310). ATM 106a prompts the user 102 to enter the same PIN a second time (as indicated by arrow 312). The user 102 enters the PIN a second time (hereinafter referred to as a "second reference PIN") through the numeric keypad 206 (as indicated by arrow 314). Numeric keypad 206 records the second reference PIN (as indicated by arrow 316). The first processing nets 220 determine if the first and second reference PINs are the same (as indicated by arrow 318). The first processing circuits 220 determine whether the first and second reference PINs are the same using art-known PIN comparison methods. In one example scenario, the first and second reference PINs may be different. In such a scenario, the first processing circuits 220 display a "registration failed" message to the user 102 on the display screen 216 and may prompt the user 102 to re-initiate the registration. For brevity, it is assumed that the first and second reference PINs are the same.

[0073] When the first and second reference PINs are the same, different objects are displayed on the touch screen 208, and the ATM 106a prompts the user 102 to draw an image for the first time (as indicated by arrow 320). The user 102 draws an image for the first time (hereinafter referred to as a "first reference image") by connecting two or more objects from different objects displayed on the touch screen 208 (as indicated by arrow 322). The touch screen 208 records the first reference image (as indicated by arrow 324). Fingerprint sensors 210 record the fingerprint used by the user 102 to draw the first reference image (hereinafter referred to as the "first reference fingerprint"). The pressure sensors 212 record a pressure value corresponding to the pressure applied by the user 102 to draw the first reference image (hereinafter referred to as the "first reference pressure value"). In addition, the timer 214 records the time interval taken by the user 102 to draw the first reference image (hereinafter referred to as the "first reference time interval"). Thus, the ATM 106a records the first reference fingerprint, the first reference pressure value, and the first reference time interval (as indicated by arrow 326).

[0074] ATM 106a prompts the user 102 to draw the same image a second time using the same finger (as indicated by arrow 328). The user 102 draws the image a second time (hereinafter referred to as the "second reference image") on the touch screen 208 (as indicated by the arrow 330). The touch screen 208 records a second reference image (as indicated by arrow 332). Fingerprint sensors 210 record the fingerprint used by the user 102 to draw a second reference image (hereinafter referred to as the "second reference fingerprint"). The pressure sensors 212 record a pressure value corresponding to the pressure applied by the user 102 to draw the second reference image (hereinafter referred to as the "second reference pressure value"). In addition, the timer 214 records a time interval taken by the user 102 to draw a second reference image (hereinafter referred to as the "second reference time interval"). Thus, the ATM 106a records a second reference fingerprint, a second reference pressure value, and a second reference time interval (as indicated by arrow 334).

[0075] ATM 106a further prompts the user 102 to draw the same image a third time using the same finger (as indicated by arrow 336). The user 102 draws the image a third time (hereinafter referred to as the "third reference image") on the touch screen 208 (as indicated by arrow 338). The touchscreen 208 records a third reference image (as indicated by arrow 340). Fingerprint sensors 210 record the fingerprint used by the user 102 to draw a third reference image (hereinafter referred to as the "third reference fingerprint"). The pressure sensors 212 record a pressure value corresponding to the pressure applied by the user 102 to draw the third reference image (hereinafter referred to as the "third pressure reference value"). In addition, the timer 214 records a time interval taken by the user 102 to draw a third reference image (hereinafter referred to as the "third reference time interval"). Thus, the ATM 106a records a third reference fingerprint, a third reference pressure value, and a third reference time interval (as indicated by arrow 342).

[0076] The first processing circuits 220 determine whether the first to third reference patterns are the same (as indicated by arrow 344) using art-known pattern comparison techniques. In one example scenario, the first to third reference images may not match each other. In such a scenario, the first processing circuits 220 display a "registration failed" message to the user 102 on the display screen 216 and may prompt the user 102 to re-initiate the registration. For the sake of brevity, it is assumed that the first to third reference images coincide with each other, i.e. the first to third reference images are the same. The first processing circuits 220 further determine whether the first to third reference fingerprints are the same (as indicated by arrow 346) using art-known fingerprint comparison methods. In one example scenario, the first to third reference fingerprints may not match each other. In such a scenario, the first processing circuits 220 display a "registration failed" message to the user 102 on the display screen 216 and may prompt the user 102 to re-initiate the registration. For brevity, it is assumed that the first to third reference fingerprints coincide with each other, i. E. the first to third reference fingerprints are the same.

[0077] When the first to third reference images are the same and the first to third reference fingerprints are the same, the first processing circuits 220 generate a registration request for registering reference information (i.e., first reference PIN, first reference image, first reference finger, first to third reference pressure values and first to third reference time intervals) with the issuer (as indicated by arrow 348). The registration request conforms to one or more standards for transaction messaging (such as the ISO8583 standard) and includes various fields (such as data items) to store various details. The registration request includes transaction card 104 details and reference information. In one embodiment, the first reference fingerprint included in the registration request corresponds to the digital image of the first reference fingerprint. In another embodiment, the first reference fingerprint included in the registration request corresponds to the encrypted fingerprint pattern of the digital image of the first reference fingerprint. The encrypted fingerprint pattern may be generated by the first processing circuits 220 based on the digital image of the first reference fingerprint.

[0078] The first processing chains 220 transmit the registration request to the acquirer server 108 (as indicated by arrow 350). The acquirer server 108 receives the registration request from the ATM 106a and identifies the payment network associated with the transaction card 104 as known to those of skill in the art. The acquirer server 108 transmits the registration request to the payment network server 110 of the identified payment network (as indicated by arrow 352). The payment network server 110 receives the registration request and identifies the issuer that corresponds to the transaction card 104, as known to those of skill in the art. When the issuer is identified, the payment network server 110 transmits a registration request to the issuer server 112 of the identified issuer (as indicated by arrow 354).

[0079] Upon receiving the registration request, the issuing server 112 determines, based on the first to third pressure reference values, a pressure range for authenticating the user 102 (as shown by arrow 356). The pressure range may define a range of pressure values corresponding to the pressures that can be applied by a true user (ie, user 102) to draw the first reference image. In one example, the upper limit of the pressure range may be equal to the highest value of one of the first to third reference pressure values, and the lower limit of the pressure range may be equal to the lowest value of one of the first to third reference pressure values. In addition, the issuing server 112 determines, based on the first to third reference time slots, a time range for authenticating the user 102 (as indicated by arrow 358). The time range may define a range of time intervals that can be occupied by the user 102 to draw the first reference image. In one example, the upper limit of the time range may be equal to the highest value of one of the first to third reference slots, and the lower limit of the time range may be equal to the lowest value of one of the first to third reference slots.

[0080] Issuer server 112 associates the first reference PIN, first reference image, first reference fingerprint, pressure range, and time range to the transaction card 104 (as indicated by arrow 360), thereby registering the reference information of the user 102 with the issuer. The issuing server 112 stores, in the memory of the issuing server 112, information related to the association between the transaction card 104 and the first reference PIN, the first reference, the first reference fingerprint, the pressure range, and the time range (as indicated by arrow 362). In one example, the issuing server 112 adds a row to the tabular database such that the added row includes the username 102, the account number for the user account of the user 102, the unique card number for the transaction card 104, the first reference PIN, the first reference image, the first reference fingerprint, pressure range and time range.

[0081] The issuing server 112 generates a registration response indicating that the registration of the transaction card 104 was successful (as indicated by arrow 364). The registration response is communicated to the ATM 106a by the issuing server 112 via the payment network server 110 and the acquirer server 108 (as indicated by arrows 366, 368, and 370). The first processing circuits 220 display a "registration successful" message to the user 102 (as indicated by the arrow 372) on the display screen 216.

[0082] User 102 may additionally choose to register additional reference information with the issuer. At the time of registration of additional reference information, the user 102 may draw the same reference image by using a different finger, a different reference image by using the same finger, or a different reference image by using a different finger. In addition, upon successful registration, the issuing server 112 may add another row to the table database including additional reference information. The user 102 can thus be authenticated based on any one of the reference information or additional reference information.

[0083] In another embodiment, instead of ATM 106a, the issuing server 112 may determine if the first and second reference PINs are the same, if the first to third reference images are the same, and if the first to third reference fingerprints are the same, without departing from scope disclosure. The scope of the disclosure is not further limited to the registration of reference information when the transaction card 104 is issued. In various other embodiments, the registration of the reference information may correspond to updating the existing reference information registered with the issuer without departing from the scope of the disclosure.

[0084] Although FIGS. 3A-3D prompts the user 102 to enter the reference PIN twice and draw the reference image three times, it will be apparent to those skilled in the art that the disclosure is not limited thereto. In various other embodiments, the user 102 may be prompted to enter a reference PIN and draw the reference image any number of times without departing from the scope of the disclosure. In another embodiment, the reference PIN may already be registered with the issuer when the issuer issues the transaction card 104 to the user 102. In such a scenario, the user 102 may be required to enter the reference PIN only once during the registration of the reference information with the issuer.

[0085] FIG. 4 illustrates an example scenario 400 that illustrates various reference images and corresponding reference fingerprints that a user 102 registers with an issuer, in accordance with an exemplary embodiment of the disclosure. User 102 can select a different reference image for each finger to register with the issuer. When user 102 initiates registration of reference information in ATM 106a, user 102 is prompted to draw an image on a touch screen 208 that displays first through ninth objects 402a-402i. The user 102 can draw the reference image 404a by connecting the first through the ninth objects 402a through 402i using the thumb 406a. In the image 404a, the third object 402c is the first choice and the seventh object 402g is the last choice. Thus, the reference fingerprint 408a of the thumb 406a is anchored to the reference image 404a, and the reference image 404a and the reference fingerprint 408a are registered with the issuer as the reference information of the user 102.

[0086] Similarly, the user 102 can draw other reference images 404b-404e by connecting objects that are similar to first through ninth objects 402a-402i. The user 102 can draw the reference images 404b-404e by using the index finger 406b, the middle finger 406c of the ring finger 406d, and the little finger 406e, respectively. Thus, the fingerprints 408b-408e of the index finger 406b, the middle finger 406c, the ring finger 406d, and the little finger 406e are linked to the reference images 404b-404e, respectively. In addition, the images 404b-404e that are associated with the reference fingerprints 408b-408e are registered with the issuer as additional reference information of the user 102. Thus, any one of the reference images 404a-404e and the corresponding reference fingerprints 408a-408e can be used to authenticate user 102 for transactions.

[0087] A person skilled in the art will appreciate that the scope of the disclosure is not limited to displaying nine objects (i.e., first to ninth objects 402a-402i) on the touch screen 208. In various other embodiments, a different number of objects (e.g., 16 objects) can be displayed on the touch screen 208 without deviating from the scope of the disclosure. In another embodiment, the user 102 may choose to register the same reference pattern for two or more fingers. In another embodiment, the reference image may be drawn by the user 102 by using two or more fingers at the same time. In such a scenario, two or more referenced fingerprints are linked to a single reference image. For example, the user 102 can draw the reference image 404f using the index finger 406b and the middle finger 406c at the same time. Thus, the reference fingerprints 408b and 408c are linked to the reference image 404f and registered with the issuer as additional reference information of the user 102.

[0088] FIG. 5 depicts a table that illustrates a tabular database 500 maintained in an issuer server 112 in accordance with an exemplary embodiment of the disclosure. The tabular database 500 is stored in the memory of the issuer server 112, in an external database associated with the issuer server 112, or in a cloud server associated with the issuer server 112. The tabular database 500 is created by the issuer server 112 when various users register corresponding reference information with the issuer.

[0089] The tabular database 500 includes lines 502a-502c and columns 504a-504h. Columns 504a-504h represent names of different users, account numbers for user accounts of different users, unique card numbers for transaction cards issued to different users, reference PINs registered with the issuer to authenticate different users, reference images registered with the issuer to authenticate different users, reference fingerprints registered with the issuer to authenticate different users, pressure ranges (in Pascals) registered with the issuer to authenticate different users, and time ranges (in seconds) registered with the issuer to authenticate different users, respectively.

[0090] Lines 502a-502c represent the bindings between transaction cards and reference information of various users registered with the issuer. Line 502a represents the binding between User A's transaction card and User A's reference information, while line 502b represents the binding between User A's transaction card and User A's additional reference information. In one example, User A corresponds to User 102. In addition, row 502c represents the binding between the transaction card of user B and the reference information of user B.

[0091] Line 502a is added by the issuer server 112 when user A registers user A's reference information with the issuer. Line 502a includes the account number for the user account for User A (eg, 100100) and the unique card number for User A's transaction card (eg, 4000400). Line 502a further includes a reference PIN (eg, 5475) and a reference image (eg, reference image 404a) registered with the issuer. Line 502a further includes a reference fingerprint (eg, reference fingerprint 408a) of the thumb 406a used by user A to draw the reference image 404a. Line 502a further includes a pressure range (eg 0.29-0.31 pascal) and a time range (eg 1.60-1.80 seconds) that are associated with the reference image 404a and the reference fingerprint 408a for user authentication. A.

[0092] Line 502b is added by the issuer server 112 when user A registers additional reference information with the issuer. Line 502b includes an account number for User A's user account (eg, 100100) and a unique card number for User A's transaction card (eg, 4000400). Line 502b further includes a reference PIN (e.g., 5475) and another reference image (e.g., reference image 404e) registered with the issuer to authenticate User A. Line 502b further includes a reference fingerprint (i.e., reference fingerprint 408e finger) of the little finger 406e used by user A to draw the reference image 404e. Line 502b further includes a pressure range (for example, 0.25-0.27 pascal) and a time range (for example, 1.32-1.54 seconds), which are associated with the reference image 404e and the reference fingerprint 408e for user authentication. A.

[0093] Line 502c is added by the issuer server 112 when user B registers reference information with the issuer. Line 502c includes the account number for User B's user account (eg, 200200) and the unique card number for User B's transaction card (eg, 5000500). Line 502c further includes a reference PIN (e.g., 1201) and a reference image (e.g., reference image 506) registered with the issuer to authenticate user B. Line 502c further includes a reference fingerprint (i.e., reference fingerprint 508 ) for the finger used by user B to draw reference image 506. Line 502c further includes a pressure range (eg 0.28-0.30 pascal) and a time range (eg 1.05-1.30 seconds) that associated with the reference image 506 and the reference fingerprint 508 to authenticate user B.

[0094] A person skilled in the art will appreciate that data stored in the table database 500 can be stored in an encrypted format. One of ordinary skill in the art will further appreciate that the pressure and time ranges disclosed in the tabular database 500 are exemplary values. Thus, in another embodiment, the pressure and time ranges may vary without deviating from the scope of the disclosure.

[0095] FIGS. 6A-6C collectively represent a flow diagram 600 that illustrates an example scenario for authenticating a user 102 for a transaction, in accordance with an exemplary embodiment of the disclosure. The issuer issues the transaction card 104 to the user 102 to perform transactions from the user account of the user 102. Before using the transaction card 104 to perform transactions, the user 102 is required to register the user reference information with the issuer. The user 102 may register a plurality of reference information items with the issuer, for example, five reference information items (ie, five pairs of reference image-fingerprint items), as shown in FIG. For brevity, it is assumed that the user 102 has registered only one item of reference information (i.e., the reference information of the user 102) with the issuer. However, it will be apparent to a person skilled in the art that when a plurality of items of reference information of the user 102 are registered with the issuer, each item of reference information can be used to authenticate the user 102 in a similar manner, as described below. In addition, in one embodiment, the user 102 may not be able to use the same reference information to conduct two consecutive transactions.

[0096] The transaction card 104 may be used by the user 102 to perform various transactions in an ATM (such as ATM 106a) or a POS device (such as a POS device 106b). For brevity, it is assumed that the user 102 initiates a transaction (eg, a cash withdrawal) in the ATM 106a using the transaction card 104 (as indicated by arrow 602). The card reader 202 records the details of the transaction card 104 (as indicated by arrow 604).

[0097] ATM 106a prompts the user 102 to enter a PIN via display screen 216 (as indicated by arrow 606). User 102 enters a PIN, i.e. "input PIN", via numeric keypad 206 (as indicated by arrow 608). Numeric keypad 206 records the input PIN (as shown by arrow 610). ATM 106a prompts the user 102 to draw an image (as indicated by arrow 612). User 102 draws an image, i.e. "input image", on the touch screen 208 (as indicated by arrow 614). The touchscreen 208 records an input image (as indicated by arrow 616). In addition, the fingerprint sensors 210 record the fingerprint used by the user 102 to draw an input image (hereinafter referred to as the "input fingerprint"). The pressure sensors 212 record a pressure value corresponding to the pressure applied by the user 102 to draw an input image (hereinafter referred to as the "pressure input value"). Additionally, the timer 214 records a time interval taken by the user 102 to draw an input image (hereinafter referred to as an "input time interval"). Thus, the ATM 106a records the input fingerprint, input pressure value, and input time interval (as indicated by arrow 618). The input PIN, input image, input fingerprint, input pressure value, and input time interval are collectively referred to as user authentication information 102.

[0098] ATM 106a further prompts the user 102 to enter transaction details for the transaction (as indicated by arrow 620). User 102 enters transaction details (as indicated by arrow 622). In one example, user 102 enters transaction details via numeric keypad 206. In addition, ATM 106a (eg, numeric keypad 206) records transaction details for a transaction initiated by user 102 (as indicated by arrow 624). The first processing chains 220 generate an authorization request to authorize the transaction (as indicated by arrow 626). An authorization request conforms to one or more standards for transaction messaging (such as the ISO8583 standard) and includes various fields (such as data items) to store various details. The authorization request includes transaction card 104 details, authentication information, and transaction details. In one example, the input fingerprint included in the authorization request corresponds to a digital image of the input fingerprint. In another example, the input fingerprint included in the authorization request matches the encrypted fingerprint pattern of the digital image of the input fingerprint. The encrypted fingerprint template may be generated by the first processing circuits 220 based on the digital image of the input fingerprint.

[0099] The first processing chains 220 transmit the authorization request to the acquirer server 108 (as indicated by arrow 628). The acquirer server 108 transmits an authorization request to the payment network server 110 in the payment network associated with the transaction card 104 (as indicated by arrow 630). The payment network server 110 receives the authorization request and transmits the authorization request to the issuer server 112 for the issuer associated with the transaction card 104 (as indicated by arrow 632).

[0100] Based on the details of the transaction card 104, the issuing server 112 retrieves the first reference PIN, first reference image, first reference fingerprint, pressure range, and time range that are associated with the transaction card 104 (as indicated by arrow 634). For example, the issuing server 112 may access the tabular database 500 stored in the issuer's server 112 and retrieve the first reference PIN, first reference image, first reference fingerprint, time range, and pressure range that are associated with the transaction card 104.

[0101] The issuing server 112 determines if the input PIN matches the first reference PIN (as shown by arrow 636). The issuing server 112 determines if the input PIN matches the first reference PIN using art-known PIN matching methods. In one example scenario, the input PIN and the first reference PIN are the same. The issuing server 112 then determines if the input image matches the first reference image (as indicated by arrow 638). The issuer server 112 determines whether the input pattern matches the first reference pattern using art-known pattern matching techniques. In one example scenario, the first reference image and the input image are the same. The issuing server 112 then determines if the input fingerprint matches the first reference fingerprint (as indicated by arrow 640). The issuer server 112 determines if the input fingerprint matches the first reference fingerprint using art-known fingerprint comparison techniques. In one example scenario, the first reference fingerprint and the input fingerprint are the same. The issuer server 112 then determines if the input pressure value is within the pressure range (as indicated by arrow 642). In one example scenario, the input pressure value is within the pressure range. The issuer server 112 then determines if the input timeslot is within the time range (as indicated by arrow 644). In one example scenario, the input timeslot is within a time range. Issuer server 112 then successfully authenticates user 102 (as indicated by arrow 646). When the user 102 is successfully authenticated, the issuing server 112 updates the pressure range and the time range based on the input pressure value and the input time slots, respectively (as indicated by arrow 648).

[0102] The issuing server 112 authorizes the transaction based on the transaction amount and the user's account balance (as indicated by arrow 650). In one example, the issuing server 112 determines whether the transaction amount is less than or equal to the account balance. If the transaction amount is less than or equal to the account balance, the issuing server 112 authorizes the transaction. If the transaction amount is greater than the account balance, the issuing server 112 rejects the transaction. For brevity, it is assumed that the issuing server 112 authorizes the transaction. Issuer server 112 generates an authorization response indicating that the transaction is authorized (as shown by arrow 652) and transmits the authorization response to ATM 106a via payment network server 110 and acquirer server 108 (as indicated by arrows 654, 656, and 658). Upon receipt of the authorization response, the first processing chains 220 display a "transaction successful" message to the user 102 via the display screen 216 (as indicated by arrow 660). In addition, the first processing chains 220 execute the transaction. In other words, cash equal to the transaction amount is dispensed to the user 102 through the cash dispenser 218 (as indicated by arrow 662).

[0103] It will be obvious to a person skilled in the art that if the issuer determines that the input PIN does not match the first reference PIN, the input image does not match the first reference image, the input finger does not match the first reference finger, the input pressure value does not is within the pressure range or the input time interval is not within the time range, the issuing server 112 sends a "Transaction Failed" message to the user 102 as an authorization response. It will be further understood by one of ordinary skill in the art that other types of transactions (such as cash deposits, funds transfers, and the like) may be handled in a manner similar to flowchart 600.

[0104] Although the disclosure describes that fingerprints that are recorded while images are drawn by users are used to authenticate users, the scope of the disclosure is not limited thereto. In various other embodiments, other biometric user information (such as an iris) may also be used to authenticate users without deviating from the scope of disclosure.

[0105] Although the disclosure describes that the acquirer and the issuer are different financial institutions (ie, the acquirer server 108 and the issuer server 112 are shown as separate entities), the scope of the disclosure is not limited thereto. In various other embodiments, the acquirer and the issuer may be the same financial institution without departing from the scope of the disclosure. Therefore, the acquirer server 108 and the issuer server 112 may correspond to a single entity. In such a scenario, the ATM 106a and the POS device 106b may send registration and authorization requests directly to the issuer server 112.

[0106] The scope of the disclosure is not limited to authenticating the user 102 for the transaction. In various other embodiments, the user 102 may be authenticated by the above-described user authentication method prior to accessing an account (e.g., a social network account, an e-commerce account, an email account, or the like), entering an establishment, etc. without deviations from the volume of disclosure.

[0107] FIG. 7 is a block diagram that illustrates a perspective view of a POS device 106b in accordance with an exemplary embodiment of the disclosure. The POS device 106b includes a card reader 702 having a card slot 704. The POS device 106b further includes a numeric keypad 706 and a touch screen 708. In addition, the POS device 106b includes fingerprint sensors 710 and pressure sensors 712 that are below the touch screen 708. The POS device 106b further includes a timer 714. In addition, the POS device 106b is equipped with a display screen 716. Card reader 702, numeric keypad 706, touch screen 708, fingerprint sensors 710, pressure sensors 712, timer 714, and display screen 716 are functionally similar to card reader 202, numeric keypad 206, touch screen 208, fingerprint sensors 210, sensors 212 pressure, timer 214 and display screen 216 of the ATM 106a, respectively. POS device 106b may further include processing circuits (not shown), memory (not shown), and transceiver (not shown) that are functionally similar to first processing circuits 220, first memory 222, and first transceiver 224 of ATM 106a, respectively.

[0108] One of ordinary skill in the art will appreciate that when registration of reference information with an issuer is initiated in the POS device 106b, the operations performed by the POS device 106b to register the reference information with the issuer are similar to those performed by ATM 106a in flowchart 300. Likewise, when a transaction (eg, a purchase from a merchant associated with POS device 106b) is initiated at POS device 106b, operations performed by POS device 106b to execute the transaction are similar to operations performed by ATM 106a in flowchart 600.

[0109] FIG. 8 is a block diagram that illustrates various components of an issuer server 112, in accordance with an exemplary embodiment of the disclosure. Issuer server 112 includes second processing circuits 802, memory of issuer server 112 (hereinafter referred to and referred to as "second memory 804") and second transceiver 806. Second processing circuits 802, second memory 804, and second transceiver 806 communicate with each other via the second bus 808 communication.

[0110] The second processing chains 802 register reference information of users (such as user 102) with the issuer and authorize transactions initiated at ATM 106a or POS device 106b. The second processing chains 802 include a registration manager 810 and an authorization manager 812.

[0111] The registration control means 810 includes suitable logic, circuits, interfaces, and / or code executed by the circuits to ensure that users' reference information is registered with the issuer. When the registration of the reference information of the user 102 with the issuer is initiated in the ATM 106a or the POS device 106b, the registration manager 810 receives, via the second transceiver 806, a registration request generated by the ATM 106a or the POS device 106b, respectively. The recording control means 810 determines a pressure range and a time range based on the first to third reference pressure values and the first to third reference time intervals, respectively. In addition, the enrollment manager 810 binds the first reference PIN, the first reference image, the first reference fingerprint, the pressure range, and the time range to the transaction card 104, and stores the binding related information in the second memory 804. The enrollment manager 810 generates a registration response indicating that registration was successful. Examples of enrollment manager 810 may include an ASIC processor, RISC processor, CISC processor, FPGA, or the like.

[0112] Authorization control means 812 includes suitable logic, chains, interfaces, and / or code executed by the chains to authenticate users and authorize transactions. When a transaction is initiated by user 102 at ATM 106a or POS device 106b, authorization manager 812 receives, via second transceiver 806, an authorization request generated by ATM 106a or POS device 106b, respectively. The authorization manager 812 retrieves, based on the details of the transaction card 104, the first reference PIN, the first reference image, the first reference fingerprint, the pressure range, and the time range that are associated with the transaction card 104. In addition, the authorization control means 812 determines whether the first reference PIN and the input PIN match, whether the first reference image and the input image match, whether the first reference fingerprint and the input fingerprint match, whether the input pressure value is within the pressure range, and whether input time interval within the time range. Based on the determination, the authorization manager 812 authenticates the user 102. The authorization manager 812 further authorizes the transaction based on the transaction amount for the transaction and the account balance and generates an authorization response indicating whether the transaction is authorized or rejected. Examples of authorization control 812 may include an ASIC processor, RISC processor, CISC processor, FPGA, or the like.

[0113] The second memory 804 includes suitable logic, circuits, interfaces, and / or code executed by the circuits for storing account profiles for various user accounts that are supported by the issuer. The second memory 804 additionally stores the table database 500. In addition, the second memory 804 can store registration and authorization requests. Examples of second memory 804 may include RAM, ROM, removable storage, HDD, flash memory, solid state memory, or the like. One skilled in the art will appreciate that the scope of the disclosure is not limited to the implementation of the second memory 804 in the issuing server 112 as described herein. In another embodiment, the second memory 804 may be in the form of a database server or cloud storage, operating in conjunction with an issuer server 112, without departing from the scope of the disclosure.

[0114] The second transceiver 806 includes suitable logic, circuits, interfaces, and / or code executed by the circuits for transmitting and receiving data over the communications network 114 using one or more communications protocols. The second transceiver 806 receives various requests and messages from the payment network server 110. For example, the second transceiver 806 receives registration and authorization requests from the payment network server 110. The second transceiver 806 transmits various requests and messages to the payment network server 110. For example, the second transceiver 806 transmits registration and authorization responses to the payment network server 110. Examples of the second transceiver 806 may include, but are not limited to, an antenna, an RF transceiver, a wireless transceiver, an Ethernet port, a USB port, or any other device configured to transmit and receive data.

[0115] FIGS. 9A and 9B collectively represent a block diagram 900A that illustrates a method for providing registration of reference information with an issuer, in accordance with an exemplary embodiment of the disclosure. The user 102 can initiate registration of the reference information with the issuer in an ATM (such as ATM 106a) or a POS device (such as a POS device 106b). For brevity, it is assumed that the user 102 initiates registration of the reference information with the issuer in the ATM 106a.

[0116] User 102 can use the transaction card 104 in ATM 106a to initiate registration. Now referring to FIG. 9A, in step 902, the card reader 202 records the details of the transaction card 104. ATM 106a prompts user 102 to enter a PIN for the first time. The user 102 enters the first reference PIN via the numeric keypad 206. In step 904, the numeric keypad 206 records the first reference PIN. ATM 106a prompts the user 102 to enter the same PIN a second time. The user 102 enters the second reference PIN via the numeric keypad 206. In step 906, the numeric keypad 206 records the second reference PIN. At block 908, the first processing circuits 220 determine if the first and second reference PINs are the same. If in step 908 the first processing circuits 220 determine that the first and second reference PINs are the same, step 910 is performed.

[0117] ATM 106a prompts the user 102 to draw an image for the first time. The user 102 draws the first reference image on the touch screen 208. At block 910, the touch screen 208 records the first reference image. At 912, the fingerprint sensors 210, pressure sensors 212, and timer 214 record a first reference fingerprint, a first reference pressure value, and a first reference time interval, which are associated with the first reference image, respectively.

[0118] ATM 106a then prompts the user 102 to draw the same image a second time using the same finger. The user 102 draws the second reference image on the touch screen 208. At block 914, the touch screen 208 writes the second reference image. At 916, the fingerprint sensors 210, pressure sensors 212, and timer 214 record a second reference fingerprint, a second reference pressure value, and a second reference time interval, which are associated with the second reference image, respectively.

[0119] ATM 106a further prompts the user 102 to draw the same image a third time using the same finger. The user 102 draws the third reference image on the touch screen 208. At block 918, the touch screen 208 records the third reference image. In step 920, fingerprint sensors 210, pressure sensors 212, and timer 214 record a third reference fingerprint, a third reference pressure value, and a third reference time interval, which are associated with the third reference image, respectively.

[0120] Now referring to FIG. 9B, in step 922, the first processing circuits 220 determine whether the first to third reference patterns are the same. If, in step 922, the first processing circuits 220 determine that the first to third reference patterns are the same, then step 924 is performed. In step 924, the first processing circuits 220 determine whether the first to third reference fingerprints are the same. If in step 924 the first processing circuits 220 determine that the first to third reference fingerprints are different, then step 926 is performed. If in step 922 the first processing circuits 220 determine that the first to third reference images are different, step 926 is performed. if in step 908 the first processing circuits 220 determine that the first and second reference PINs are different, then step 926 is performed. In step 926, the first processing circuits 220 display a "registration failed" message to the user 102 via the display screen 216 and may prompt the user 102 to re-initiate the registration.

[0121] If in step 924 the first processing circuits 220 determine that the first to third reference fingerprints are the same, then step 928 is performed. In step 928, the first processing circuits 220 generate a registration request to register the reference information of the user 102 (i.e., the first reference fingerprint). PIN, first reference pattern, first reference fingerprint, first to third reference time intervals and first to third reference pressure values) with the issuer. At block 930, the first processing chains 220 transmit the registration request to the acquirer server 108. At 932, the first processing chains 220 receive a registration response from the acquirer server 108 indicating that the registration was successful. In step 934, the first processing circuits 220 display a "registration successful" message to the user 102 via the display screen 216.

[0122] Although the disclosure describes that a user 102 can initiate a registration with an issuer through a terminal device (such as an ATM 106a or a POS device 106b), the scope of the disclosure is not limited thereto. In various other embodiments, the user 102 may initiate a registration through the user device (e.g., smart phone, laptop, tablet, or the like) of the user 102, or by visiting the issuer's building and using the registration device (e.g., an electronic touchscreen-enabled device) in the issuer's building. deviations from the volume of disclosure.

[0123] FIG. 9C depicts a block diagram 900B that illustrates a method for executing a transaction initiated by a user 102, in accordance with an exemplary embodiment of the disclosure. User 102 may initiate a transaction at an ATM (such as ATM 106a) or a POS device (such as a POS device 106b). For brevity, it is assumed that user 102 initiates a transaction at ATM 106a.

[0124] User 102 uses the transaction card 104 to initiate a transaction (eg, cash withdrawal). At block 936, the card reader 202 records the details of the transaction card 104. ATM 106a prompts the user 102 to enter a PIN. The user 102 enters the input PIN through the numeric keypad 206. In step 938, the numeric keypad 206 records the input PIN. ATM 106a prompts the user 102 to draw an image. The user 102 draws an input image on the touch screen 208. At block 940, the touch screen 208 writes the input image. At block 942, fingerprint sensors 210, pressure sensors 212, and timer 214 record the fingerprint input, pressure input value, and input time interval that are associated with the input image, respectively.

[0125] ATM 106a prompts the user 102 to enter transaction details for the transaction. In one example, user 102 enters transaction details via numeric keypad 206. At block 944, numeric keypad 206 records transaction details for a transaction initiated by user 102. At block 946, first processing chains 220 generate an authorization request to authenticate user 102 and authorize the transaction.

[0126] At block 948, the first processing chains 220 transmit an authorization request to the acquirer server 108. At 950, the first processing chains 220 receive an authorization response from the acquirer server 108. At block 952, first processing chains 220 determine if the transaction is authorized. If at block 952, the first processing chains 220 determine that the transaction is authorized, then block 954 is performed. At block 954, the first processing chains 220 display a "transaction successful" message to the user 102 via the display screen 216. At block 956, the first processing chains 220 execute the transaction, i. E. cash equal to the transaction amount is dispensed to the user 102 through the cash dispenser 218. If at block 952 the first processing chains 220 determine that the transaction is declined, then block 958 is performed. At block 958, the first processing chains 220 display a "transaction unsuccessful" message to the user 102 via the display screen 216 and may prompt the user 102 to re-initiate the transaction.

[0127] Although the disclosure describes that a user 102 can initiate a transaction through a terminal device (such as an ATM 106a or a POS device 106b), the scope of the disclosure is not limited thereto. In various other embodiments, the user 102 can initiate a transaction through the user device (eg, smart phone, laptop, tablet, or the like) of the user 102 without departing from the scope of disclosure.

[0128] FIG. 10A is a flowchart 1000A that illustrates a method for registering reference information of a user 102 with an issuer, in accordance with an exemplary embodiment of the disclosure. Registration of user 102 reference information with the issuer may be initiated by user 102 at ATM 106a or POS device 106b.

[0129] In step 1002, the issuing server 112 receives a registration request from the payment network server 110 when the user 102 initiates a registration with the ATM 106a or POS device 106b. In step 1004, the issuing server 112 determines, based on the first to third reference pressure values, a pressure range for authenticating the user 102. In step 1006, the issuing server 112 determines, based on the first to third reference time slots, a time range for authenticating the user 102.

[0130] In step 1008, the issuing server 112 associates the first reference PIN, the first reference image, the first reference fingerprint, the pressure range, and the time range to the transaction card 104, thereby registering the reference information of the user 102 with the issuer. In step 1010, the issuer server 112 stores information related to the association between the transaction card 104 and the first reference PIN, the first reference image, the first reference fingerprint, the pressure range and the time range in the second memory 804. In step 1012, the issuer server 112 generates a registration response indicating that registration was successful. In step 1014, the issuing server 112 transmits the registration response to the payment network server 110.

[0131] FIGS. 10B and 10C collectively represent a block diagram 1000B that illustrates a method for authorizing a transaction initiated by a user 102, in accordance with an exemplary embodiment of the disclosure. Upon successful registration, the user 102 can use the transaction card 104 to perform various transactions. Now referring to FIG. 10B, in step 1016, the issuing server 112 receives an authorization request from the payment network server 110 when the user 102 initiates a transaction at the ATM 106a or POS device 106b. In step 1018, the issuing server 112 retrieves, based on the details of the transaction card 104, the first reference PIN, the first reference image, the first reference fingerprint, the pressure range, and the time range that are associated with the transaction card 104.

[0132] At block 1020, the issuing server 112 determines if the input PIN matches the first reference PIN. If, in step 1020, the issuing server 112 determines that the input PIN matches the first reference PIN, then step 1022 is performed. In step 1022, the issuing server 112 determines if the input pattern matches the first reference image. If in step 1022 the issuing server 112 determines that the input image matches the first reference image, then step 1024 is performed. In step 1024, the issuing server 112 determines if the input fingerprint matches the first reference finger. If, in step 1024, the issuing server 112 determines that the input fingerprint matches the first reference fingerprint, then step 1026 is performed.

[0133] At step 1026, the issuer server 112 determines if the input pressure value is within the pressure range. If in step 1026 the issuer server 112 determines that the input pressure value is within the pressure range, then step 1028 is performed. In step 1028, the issuer server 112 determines if the input time slot is within the time range. If in step 1028 the issuer server 112 determines that the input timeslot is within the time range, then step 1030 is performed. Referring now to FIG. 10C, in step 1030, the issuer server 112 successfully authenticates the user 102. In step 1032, the issuer server 112 updates the pressure range and a time range based on the input pressure value and the input time intervals, respectively.

[0134] At step 1034, the issuing server 112 determines whether the transaction amount is less than or equal to the account balance. If in step 1034 the issuing server 112 determines that the transaction amount is less than or equal to the account balance, then step 1036 is performed. In step 1036, the issuing server 112 authorizes the transaction. At block 1038, the issuing server 112 generates an authorization response indicating that the transaction is authorized.

[0135] If in step 1034, the issuing server 112 determines that the transaction amount is greater than the account balance, then step 1040 is performed. Similarly, if in steps 1020 and 1022, the issuing server 112 determines that the first reference PIN and the input PIN do not match and the first reference the image and the input image do not match, respectively, step 1040 is performed. Additionally, if in steps 1024, 1026 and 1028 the issuing server 112 determines that the first reference fingerprint and the input fingerprint do not match, the input pressure value is not within the pressure range and the input time slot is not within the time range, so step 1040 is performed.

[0136] At block 1040, the issuing server 112 rejects the transaction. At block 1042, the issuing server 112 generates an authorization response indicating that the transaction is declined. Additionally, the issuing server 112 may generate an alert message and transmit the alert message to the user device of the user 102. In step 1044, the issuing server 112 transmits an authorization response to the payment network server 110. Block 1044 is also performed after block 1038.

[0137] FIG. 11 is a high-level flowchart 1100 that illustrates a method for authenticating a user 102 for a transaction, in accordance with an exemplary embodiment of the disclosure. In step 1102, the terminal device (such as ATM 106a or POS device 106b) records the input PIN entered by the user 102, the input image drawn by the user on a touch screen (such as the touchscreen 208) of the terminal device, and the input biometric information (such as an input fingerprint). finger) of the user 102 while the input image is drawn by the user 102. The terminal device records the input PIN, the input image, and the input fingerprint when a transaction is initiated by the user 102 at the terminal device via a form of payment (such as a transaction card 104). In step 1104, the terminal device executes a transaction based on the authentication of the user 102. The user 102 is authenticated when the login PIN, login image, and login fingerprint match the first reference PIN, first reference image, and reference biometric information (i.e., first reference fingerprint) that are linked to the form of payment, respectively. The reference biometric information is associated with the reference image.

[0138] FIG. 12 is a block diagram that illustrates a system architecture of computer system 1200, in accordance with an exemplary embodiment of the disclosure. An embodiment of the disclosure, or portions thereof, may be implemented as machine-readable code in computer system 1200. In one example, ATM 106a, POS device 106b, acquirer server 108, payment network server 110, and issuer server 112 may be implemented as computer system 1200.

[0139] The hardware, software, or any combination thereof may be an implementation of modules and components used to implement the methods of FIGS. 9A-9C, 10A-10C, and 11. Computer system 1200 includes a processor 1202, which may be specialized or a universal processing device. Processor 1202 can be a single processor, multiple processors, or a combination thereof. In addition, processor 1202 may be coupled to communications infrastructure 1204, such as a bus, message queue, multicore messaging, and the like. Computer system 1200 may further include main memory 1206 and secondary memory 1208. Examples of main memory 1206 may include RAM, ROM, etc. Secondary memory 1208 may include an HDD or removable storage device such as a floppy disk drive, magnetic tape drive, CD-ROM, optical disk drive, flash memory, etc. NS.

[0140] Computer system 1200 further includes an input / output (I / O) interface 1210 and a communication interface 1212. I / O interface 1210 includes various input and output devices that are configured to communicate with processor 1202. Examples of input devices can include a keyboard, mouse, joystick, touch screen, microphone, and the like. Examples of output devices can include including a display screen, speaker, headphones, and the like. Communication interface 1212 can be configured to allow data transfer between computer system 1200 and various devices that are in communication with computer system 1200. Examples of communication interface 1212 can include a modem , network interface, i.e. an Ethernet card, a communications port, and the like. Data carried over the communications interface 1212 may correspond to signals such as electronic, electromagnetic, optical, or other signals as would be apparent to one of ordinary skill in the art.

[0141] One of ordinary skill in the art will understand that embodiments of the disclosed invention may be practiced with various computer system configurations, including multi-core multi-processor systems, minicomputers, mainframe computers, computers associated or grouped with distributed functions, and pervasive or miniature computers that can be embedded in virtually any device. In addition, the operations can be described as a sequential process, however, some of the operations can actually be performed in parallel, concurrently, and / or in a distributed environment. Additionally, in some embodiments, the order of operations may be rearranged without departing from the spirit of the disclosed invention.

[0142] The user 102 is authenticated based on a combination of an input PIN, an input image, an input fingerprint, input time slots, and an input pressure value. The use of factors such as an input image and an input fingerprint in authenticating a user 102 makes it difficult for an intruder to gain unauthorized access to the user's 102 funds. In addition, the time taken to draw the image and the pressure applied to draw the image may be different. for different individuals. Hence, authenticating the user 102 based on the time intervals (i.e., input time intervals) taken to draw the input image, and the pressure value (i.e., the input pressure value) corresponding to the pressure applied while the input image is being drawn , additionally complicates the access to the user's funds for the violator. Thus, the multiple parameters used to authenticate the user 102 protect the user 102 from fraud, especially when an attacker maliciously obtains a PIN (i.e., an entry PIN), thereby preventing financial losses for user 102 as well as a financial institution. associated with a user 102. Therefore, the user authentication method according to the disclosure is a more secure method for authenticating users as compared to standard user authentication methods that do not use images, fingerprints associated with images, time slots taken to draw images, and pressures applied to paint images to authenticate users. In addition, the method for authenticating a user according to the disclosure may also be implemented in existing terminal devices.

[0143] Techniques in accordance with the disclosure provide, among other features, systems and methods for authenticating users (eg, user 102). While various exemplary embodiments of the disclosed system and method have been described above, it should be understood that they have been presented for purposes of example only and not limitation. They are not exhaustive and do not limit the disclosure to the exact form disclosed. Modifications and variations are possible in light of the above ideas, or may be derived from practical application of the disclosure without departing from the degree of protection or scope.

[0144] In the claims, the words "comprising", "including" and "having" do not exclude the presence of elements or steps other than those listed in the claim. The term "one" as used herein is defined as "one or more of one". Unless otherwise stated, terms such as "first" and "second" are used to arbitrarily distinguish between elements that such terms describe. Thus, these terms are not necessarily intended to indicate a temporary or other prioritization of such items. The fact that specific measures are listed in mutually different claims does not indicate that a combination of these measures cannot be used to obtain an advantage.

Claims (61)

1. A method for authenticating a user for a transaction, the method comprising the steps of: recording, by the terminal device, when a transaction is initiated by the user in the terminal device through a form of payment that is a means of payment that is tied to the user's account, an input personal identification number (PIN) entered by the user, an input image drawn by the user on the touch screen of the terminal device, and input biometric information of the user, while the input image is drawn by the user; and execute, by the terminal device, a transaction based on user authentication, the user being authenticated by the server receiving the input PIN, the input image and input biometric information, which are sent by the terminal device when the input PIN, input image and input biometric information match the reference PIN, in a reference manner and reference biometric information that are associated with the form of payment, respectively, and wherein the reference biometric information is associated with the reference image. 2. The method of claim 1, wherein the terminal device is at least one of an ATM or a point of sale device. 3. The method of claim 1, wherein the input and reference biometric information correspond to input and reference fingerprints used by the user to draw the input and reference images, respectively. 4. The method of claim 1, further comprising the step of recording, by the terminal device before the user initiates the transaction, a reference image drawn by the user multiple times, reference biometric information while the reference image is drawn by the user multiple times, and a variety of reference images. time intervals taken by the user to draw the reference image multiple times, respectively, with: the reference image and the reference biometric information are linked to the form of payment when the reference image is the same for each of a plurality of times and the reference biometric information is the same for each of a plurality of times, and a time range for user authentication is determined based on a plurality of reference time intervals, and the specific time range is associated with a form of payment. 5. The method of claim 4, further comprising the step of recording, by the terminal device, when the transaction is initiated by the user, an input time slot taken by the user to draw an input image, the user being authenticated when the input time slot is within a specified time range and wherein when the user is authenticated, the determined time range is updated based on the input time slot. 6. The method of claim 1, further comprising the step of recording, by the terminal device before the user initiates the transaction, a reference image drawn by the user multiple times, reference biometric information, while the reference image is drawn by the user multiple times, and a variety of reference images. pressure values corresponding to the pressures applied by the user to draw the reference image many times, respectively, with: the reference image and the reference biometric information are linked to the form of payment when the reference image is the same for each of a plurality of times and the reference biometric information is the same for each of a plurality of times, and a pressure range for user authentication is determined based on a plurality of reference pressure values, and the determined pressure range is tied to a form of payment. 7. The method according to claim 6, further comprising the step of recording, by the terminal device, when the transaction is initiated by the user, the input pressure value corresponding to the pressure applied by the user to draw the input image, wherein the user is authenticated when the input pressure value is within the specified the pressure range, and wherein when the user is authenticated, the determined pressure range is updated based on the input pressure value. 8. Terminal device containing: a numeric keypad configured to record an input PIN entered by a user to initiate a transaction at the terminal device; a touch screen configured to display a first plurality of objects and record an input image that is drawn by a user by connecting a second plurality of objects from the first plurality of objects; and a set of biometric sensors configured to record the user's input biometric information while the input image is drawn by the user, with the user being authenticated for a transaction by the server receiving the input PIN, the input image and input biometric information, which are sent by the terminal device when the input PIN is input the image and the input biometric information match the reference PIN, the reference image and the reference biometric information that are tied to the form of payment that is the means of payment associated with the user's account and used to initiate the transaction, respectively, and wherein the reference biometric information is associated with the reference image ... 9. The terminal device of claim 8, wherein the terminal device is at least one of an ATM or a point of sale device. 10. The terminal apparatus of claim 8, wherein the input and reference biometric information correspond to input and reference fingerprints used by the user to draw input and reference images, respectively. 11. A terminal device according to claim 8, wherein before the user initiates the transaction: the touch screen is further configured to record a reference image that is drawn by the user a plurality of times; and the set of biometric sensors is further configured to record the reference biometric information, while the reference image is drawn by the user multiple times, the reference image and the reference biometric information being linked to the payment form when the reference image is the same for each of a plurality of times and the reference image biometric information is the same for each of the many times. 12. The terminal device according to claim 11, further comprising: timer configured with the ability to: record a plurality of reference time intervals spent by the user to draw the reference image a plurality of times, respectively; and record an input time interval taken by the user to draw an input image, the user authenticating when the input time interval is within a time range associated with a form of payment, and wherein the time range is determined based on a plurality of reference time intervals; and set of pressure sensors configured with the ability to: record a plurality of reference pressure values corresponding to pressures applied by the user to draw the reference image a plurality of times, respectively; and record the input pressure value corresponding to the pressure applied by the user to draw the input image, the user being authenticated when the input pressure value is within the pressure range associated with the form of payment, and the pressure range being determined based on the plurality of reference pressure values. 13. A system for authenticating a user for a transaction, where the system contains: terminal device containing: a numeric keypad configured to record an input PIN entered by a user to initiate a transaction at the terminal device; a touch screen configured to display a first plurality of objects and record an input image that is drawn by a user by connecting a second plurality of objects from the first plurality of objects; and a set of biometric sensors configured to record the user's input biometric information while the input image is drawn by the user; and a server that is connected by communication with the terminal device and is configured to authenticate the user when the input PIN, input image and input biometric information that are recorded by the terminal device match the reference PIN, reference image and reference biometric information that are associated with the form of payment, which is a means of payment that is tied to the user's account and used to initiate a transaction, respectively, wherein the reference biometric information is associated with the reference image. 14. The system of claim 13, wherein the terminal device is at least one of an ATM or point of sale device. 15. The system of claim 13, wherein the input and reference biometric information correspond to input and reference fingerprints used by the user to draw the input and reference images, respectively. 16. The system of claim 13, wherein before the user initiates the transaction: the touch screen is further configured to record a reference image that is drawn by the user a plurality of times; the set of biometric sensors is further configured to record reference biometric information while the reference image is drawn by the user a plurality of times; and the server is further configured to bind the reference image and the reference biometric information to the payment form when the reference image is the same for each of a plurality of times and the reference biometric information is the same for each of a plurality of times. 17. The system of claim 16, wherein the terminal device further comprises a timer, and wherein: the timer is configured to record a plurality of reference times taken by the user to draw the reference image a plurality of times, respectively; and the server is additionally configured with the ability to: determine, based on the plurality of reference time slots recorded by the terminal device, a time range for user authentication; and tie a time range to a form of payment. 18. The system of claim 17, wherein when a transaction is initiated by a user: the timer is further configured to record the input time interval taken by the user to draw the input image; and the server is additionally configured with the ability to: determine if the input time slot is within a time range associated with the form of payment, the user authenticating when the input time slot is within the time range; and update, when the user authenticates, the time range based on the input time slot. 19. The system of claim 16, wherein the terminal device further comprises a set of pressure sensors, and wherein: the set of pressure sensors is configured to record a plurality of reference pressure values corresponding to pressures applied by the user to draw the reference image a plurality of times, respectively; and the server is additionally configured with the ability to: determine, based on the plurality of reference pressure values recorded by the terminal device, a pressure range for user authentication; and tie the pressure range to the form of payment. 20. The system of claim 19, wherein when a transaction is initiated by a user: the set of pressure sensors is further configured to record an input pressure value corresponding to the pressure applied by the user to draw the input image; and the server is additionally configured with the ability to: determine if the input pressure value is within a pressure range associated with the form of payment, the user authenticating when the input pressure value is within the pressure range; and update when the user authenticates, the pressure range based on the input pressure value.

Images