Abstract: An apparatus, method and program product locally stores biometric data in response to a user accessing a network (38). Local storage of the biometric data allows the user to biometrically access a local computer (20) in the absence of a network connection (18)and/or submitted ID.

Abstract: An apparatus, method and program product allow two factor token authentication in the presence of multiple tokens. When multiple tokens are detected, a user desiring access needs merely to provide a unique biometric identifier, referred to as a capture BIR, and that capture BIR is evaluated against a stored BIR associated with at least one of the tokens to determine if access is to be granted. If there is a match, that user is given access. If not, the capture BIR is evaluated against the stored BIR associated with another of the detected tokens. The process may repeat until either a match is found and the user is granted access, or none is found and access is denied. The foregoing occurs without the user having to input any user ID or the like and without the inconvenience or risk of error associated with selecting a user ID from a list of potential user ID's.

Abstract: An apparatus, method and program product for enabling biometric authentication that includes receiving a biometric submission (82) at a biometric device (60), and in response to an authentication of the submission (92), providing a cryptographic credential (68) from a computer (15, 30) to the biometric device (60) for use in a subsequent cryptographic purpose (100). In this manner, the biometric device (60) may subsequently mimic properties of a smart card.

Abstract: An apparatus, method and program product for enabling token authentication by generating a secret key using manufacturer controlled information (57) present on a token (34). A computer (30) typically reads the manufacturer controlled information and applies an cryptographic algorithm (41) to determine the secret key (47). The secret key (47) may comprise or be used to generate a one-time password (42) for use in authenticating the token (34). Typical manufacturer controlled information (57) present on the token (34) includes static, non-writeable/erasable information, such as a serial number (56) or manufacturer ID (54). Where desired, the token authentication is accomplished in the absence of memory or processors on the token that are dedicated to the authentication process, itself. This absence reduces token hardware requirements and associated expenses. The dynamic generation of the cryptographic key (47) also reduces risks conventionally associated with duplicating static keys stored within token memory.

Abstract: An apparatus, method and program product allow two factor token authentication in the presence of multiple tokens. When multiple tokens are detected, a user desiring access needs merely to provide a unique biometric identifier, referred to as a capture BIR, and that capture BIR is evaluated against a stored BIR associated with at least one of the tokens to determine if access is to be granted. If there is a match, that user is given access. If not, the capture BIR is evaluated against the stored BIR associated with another of the detected tokens. The process may repeat until either a match is found and the user is granted access, or none is found and access is denied. The foregoing occurs without the user having to input any user ID or the like and without the inconvenience or risk of error associated with selecting a user ID from a list of potential user ID's.

Abstract: An apparatus, method and program product receive remote identification data from an identification device (12) associated with a user account in response to initiation of an electronic transaction at a terminal (22). The identifying device communicates the remote identification data to a processing system (16), where it is compared against stored authentication data associated with the user account. The processing system (16) communicates verification to the terminal (22) if a match is determined, allowing the electronic transaction to proceed.

Abstract: An apparatus, method and program product allow a user (100) who is authenticated (84) in one application to enroll in a different application (95) without having to accomplish conventional enrollment processes. The enrollment credential of the first application (84) is automatically transferred to the second application (95) as the new or updated enrollment credential for the second application (95).

Abstract: An apparatus 10, method and program product 42 logs a delegate user into an account of a principal user on behalf of the principal in response to authentication code, such as biometric data, correlated to the delegate user. Actions taken by the delegate while within the account of the principal may be recorded for evaluation and accountability considerations. Delegate user(s) privileged to access the account of the principal are added and deleted to a profile 44 as necessary to facilitate controlled sharing of resources.