Apparatus for preventing unauthorized access to computer files and for securing medical records
1. A dynamic biologic identifier (“
) system for securely inputting and storing encounter information (“
) documenting at least one encounter between a first person and a second person, said system comprising;
a data memory for storing and providing (A) said EI and (B) identification information including at least one biologic identifier of each of a first person and a second person;
a processor, coupled to the memory;
at least one camera, coupled to the processor, arranged to provide said EI, including images capturing identification information of each of a putative first person and a putative second person, during the encounter, wherein each of a plurality of said images shows the identification information of each of said putative first person and said putative second person;
an identification information enhancement device (“
), located in proximity to said putative first person and said putative second person, coupled to said processor, for producing modified information of said putative first person and said putative second person by providing at least one of;
an IIED output configured and arranged to induce a change in the appearance of at least one distinct biological feature of at least one of said putative first person and said putative second person, wherein enhancement information including a prompt provided by said processor causes said IIED to induce said change by producing said IIED output; and
an IIED output configured and arranged to display a visual representation of enhancement information provided by said processor, wherein said enhancement information causes said IIED to display said visual representation, and wherein said camera is arranged to capture images including each of said displayed visual representation and said images of each of said putative first person and said putative second person;
wherein said IIED modifies at least some of the information received by said at least one camera in response to the enhancement information provided by said processor, wherein at least some of said captured identification information includes said modified information; and
wherein said processor is operative to (A) provide said enhancement information, and (B) receive and compare (1) the identification information of each of said putative first person and said putative second person with (2) said stored identification information of said first person and said second person, and to enable storage of said EI when the identification information of each of said putative first person and said putative second person substantially matches said stored identification information of each one of said first and said second person.
Apparatus for identifying the writer or receiver of a document, where identifying information for each of a plurality of registered human individuals is stored in a database, calls for capturing local images of an individual producing or receiving information and determining whether this individual is the same as one of the registered individuals whose identifying information is stored in the database. The identifying information stored in the database includes both an alphanumeric identifier and at least one image of a unique, visually observable biologic identifier on a body portion of each registered individual. The accuracy of user identification is enhanced by allowing the sender of information to supply visual content which modulates the appearance of a biologic identifier of the user. A human gatekeeper further hardens the system against inappropriate access. Utilization of the system for the document of critical encounters such as medical events is provided.
|Wireless computer wallet for physical point of sale (POS) transactions|
Patent #US 7,784,684 B2
Current AssigneePCMS Holdings Incorporated
Sponsoring EntityFujitsu Limited
|Apparatus and method for utilizing biometrics in medical applications|
Patent #US 20070258626A1
Current AssigneeImprivata Incorporated
Sponsoring EntityBruce Reiner
|Multifunction telemedicine software with integrated electronic medical record|
Patent #US 20050149364A1
Current AssigneeCEL-KOM LLC
Sponsoring EntityCEL-KOM LLC
- 1. A dynamic biologic identifier (“
) system for securely inputting and storing encounter information (“
) documenting at least one encounter between a first person and a second person, said system comprising;
a data memory for storing and providing (A) said EI and (B) identification information including at least one biologic identifier of each of a first person and a second person; a processor, coupled to the memory; at least one camera, coupled to the processor, arranged to provide said EI, including images capturing identification information of each of a putative first person and a putative second person, during the encounter, wherein each of a plurality of said images shows the identification information of each of said putative first person and said putative second person; an identification information enhancement device (“
), located in proximity to said putative first person and said putative second person, coupled to said processor, for producing modified information of said putative first person and said putative second person by providing at least one of;
an IIED output configured and arranged to induce a change in the appearance of at least one distinct biological feature of at least one of said putative first person and said putative second person, wherein enhancement information including a prompt provided by said processor causes said IIED to induce said change by producing said IIED output; and an IIED output configured and arranged to display a visual representation of enhancement information provided by said processor, wherein said enhancement information causes said IIED to display said visual representation, and wherein said camera is arranged to capture images including each of said displayed visual representation and said images of each of said putative first person and said putative second person; wherein said IIED modifies at least some of the information received by said at least one camera in response to the enhancement information provided by said processor, wherein at least some of said captured identification information includes said modified information; and wherein said processor is operative to (A) provide said enhancement information, and (B) receive and compare (1) the identification information of each of said putative first person and said putative second person with (2) said stored identification information of said first person and said second person, and to enable storage of said EI when the identification information of each of said putative first person and said putative second person substantially matches said stored identification information of each one of said first and said second person.
- View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41)
- 42. A dynamic biologic identifier (“
) system for securely inputting and storing and providing access to digital information, said system comprising;
(a) data memory for storing and providing secure information, biological identification information (“
) of at least one authorized person (“
), authorized to access said secure information; and
BII of at least one human gatekeeper person (“
(b) a gatekeeper decision input device for inputting a signal representing an authorization decision of a HGP authorized to make said decision; (c) a putative authorized person (“
) camera arranged to repeatedly input visual information pertaining to the BII of a PAP;
(d) a processor, coupled to each of said gatekeeper decision input device, said PAP camera and said memory;
(i) store and access information in said memory, (ii) repeatedly analyze said inputted PAP BII, (iii) repeatedly generate PAP analysis signals indicating the results of said BII analysis; and (iv) receive said signal representing said HGP decision; (e) a PAP biologic ID modulating device, coupled to said processor, for producing, in the vicinity of said PAP, at least one of; a change in the appearance of an anatomic feature of said PAP, and a visual representation of information represented by PAP ID output signals, wherein said PAP camera is arranged to provide images showing both said visual representation and a biologic identifier of said PAP, which alters the appearance of said inputted PAP BII, in response to said PAP ID output signals from said processor, wherein said processor is further operative to generate said PAP ID output signals; (f) an output device, coupled to said processor, for providing said HGP with the results of said analysis; (g) a putative human gatekeeper (“
) camera coupled to said processor, arranged to input visual information pertaining to the BII of a PGHP; and
(h) a gatekeeper ID modulating device, coupled to said processor, for producing, in the vicinity of said PGHP, at least one of; a change in the appearance of an anatomic feature of said PGHP, and a visual representation of information represented by at least one gatekeeper ID output signal, and wherein said PGHP camera is arranged to provide images showing both said visual representation and a biologic identifier of said PGHP, which alters the appearance of said inputted PGHP BII, in response to said at least one gatekeeper ID output signal from said processor, wherein said processor is further operative to generate said at least one gatekeeper ID output signal; wherein (1) said processor is operative to repeatedly generate said PAP ID output signals which cause said PAP biologic ID modulating device to modulate the content of said PAP BII; (2) said processor is operative to repeatedly compare stored BII of said AP and repeatedly inputted BII of said PAP, and to repeatedly generate said PAP analysis signals representing results of the comparisons; (3) said processor is operative to generate said at least one gatekeeper ID output signal which causes said gatekeeper ID modulating device to modulate the content of said PGHP BII; (4) said processor is operative to compare said stored HGP BII with said inputted PGHP BII; and (5) said processor is operative to allow said PAP access to said memory if; (A) each repeated processor analysis indicated that the inputted BII of said PAP and the stored BII of said AP are substantially similar; (B) said HGP inputs an allow access signal to said gatekeeper decision input device, representing a decision of said HGP to allow said PAP access to said memory; and (c) said comparison performed by said processor indicated that said inputted PGHP BII matches said stored HGP BII.
- View Dependent Claims (43, 44, 45, 46, 47, 48, 49, 50)
said processor is operative to alter and control a quality of said light; said camera is situated to view said iris; and the authorized person BII stored in said data memory comprises data representing a plurality of images of said authorized person iris, each obtained under different lighting conditions defined by said controllable parameter; whereby said processor causes the alteration of both the anatomic configuration and the appearance of said PAP iris; and whereby the accuracy of identification of said PAP is enhanced.
- 45. The apparatus defined in claim 42, wherein said PAP biologic ID modulating device is a display device, configured to produce said visual representation, and wherein said PAP camera is arranged to provide images, each image showing both said visual representation and a biologic identifier of said PAP.
- 46. The apparatus defined in claim 42, further comprising an information output device, coupled to said processor, for outputting said secure information, when said processor allows said PAP access to said memory.
- 47. The apparatus defined in claim 42, wherein said the gatekeeper ID modulating device causes a change in the appearance of an anatomic feature of said PGHP.
- 48. The apparatus defined in claim 47, wherein
said gatekeeper ID modulating device comprises a light source for producing light with a controllable parameter, for application to an iris of an eye of said PGHP; said processor is operative to alter and control a quality of said light; said PGHP camera is situated to view said iris; and the human gatekeeper BII stored in said data memory comprises data representing a plurality of images of said human gatekeeper iris, each obtained under different lighting conditions defined by said controllable parameter; whereby said processor causes the alteration of both the anatomic configuration and the appearance of said PGHP iris; and whereby the accuracy of identification of said PGHP is enhanced.
- 49. The apparatus defined in claim 42, wherein said gatekeeper ID modulating device is a display device, configured to produce said visual representation, and wherein said PGHP camera is arranged to provide images, each image showing both said visual representation and a biologic identifier of said PGHP.
- 50. The apparatus defined in claim 42, wherein said processor is operative to prevent PAP access to said memory if any one processor analysis indicates that the inputted BII of said PAP and the stored BII of said AP are not substantially similar.
This present application claims the benefit of priority from U.S. Provisional Application Ser. No. 60/934,043, filed Jun. 11, 2007, entitled “APPARATUS AND METHODS FOR REMOTE VOTING AND FOR GOVERNMENT AND CORPORATE SYSTEMS BASED ON REMOTE VOTING,” and claims the benefit of priority of the U.S. patent application Ser. No. 12/157,469, filed Jun. 11, 2008 (now U.S. Pat. No. 8,233,672) entitled “APPARATUS AND METHOD FOR VERIFYING THE IDENTITY OF AN AUTHOR” and claims the benefit of priority of the U.S. patent application Ser. No. 13/563,399 filed Jul. 31, 2012, entitled “APPARATUS AND METHOD FOR VERIFYING THE IDENTITY OF AN AUTHOR AND A PERSON RECEIVING INFORMATION.” The present application is a continuation-in-part of the this latter application.
The subject matter of the present application also relates to that of U.S. Pat. Nos. 7,835,824 and 7,991,517, both of which are incorporated herein by reference.
There are a multitude of situations in which it is necessary to be able to document the identity of an individual who produces visually observable material or actions indicating the thoughts or decisions of that individual. Examples of such situations involve an individual who (i) produces written text material, (ii) indicates choices on a touch sensitive screen, (iii) produces alphanumeric entries using a keyboard, (iv) produces artwork, (v) produces a musical work with written material.
In addition, there are multiple situations where the determination and documentation of a person who desires to receive computer information, or to have access to a computer memory is vital. The incidence of computer hacking is increasing, and major breaches of a variety of types of assumed-to-be-secure systems has occurred. The invention described herein addresses this need by providing a means of identifying a person requesting information with a high degree of certainty.
The systems which perform such identification may be entirely processor-based, or may rely on the combination of processor and human abilities. Such combinations are a subject of the current invention.
The use of such highly secure systems for the storage and retrieval of critical information in which the participants are reliably identified allows for a secure system of medical records. Such an encounter identification system may be utilized for legal, business, and other transactions.
It is a principal object of the present invention to provide a method and apparatus which links the image of an individual (containing identifying features), obtained during a registration process, to the image of an individual author, during his or her act of generating the observable material that reflects the author'"'"'s thoughts or decisions, thereby to verify the identity of the author with a high degree of confidence.
This object, as well as further objects which will become apparent from the discussion that follows, is achieved, in accordance with the invention, by apparatus which comprises:
(a) a computer database in which are stored an image of a visible identifying feature and other identification data of each of a plurality of registered human individuals;
(b) a computer processor coupled to the database for storing information therein and for accessing selected information therefrom; and
(c) one or more input devices, coupled to the processor and disposed at a local site where an individual is to create writings or make computer entries. The input device(s) includes at least one camera arranged to view and capture a local image of both the identifying feature and at least a portion of a hand of the individual that is engaged in a writing or computer entry process.
The processor is operative to store the local image(s) in said database for later retrieval, and to compare the stored identifying feature of said registered human individuals with the local image(s) of the individual'"'"'s identifying feature generated during the writing or computer entry process.
By such comparison, the apparatus can thus verify that the identity of the individual who made the writing or computer entry is the same as one of the registered individuals.
Similarly, the aforementioned objects of the present invention are achieved by a method for identifying the writer of a document which comprises the steps of:
(a) storing in a database identifying information for each of a plurality of registered human individuals, this identifying information including both an alphanumeric identifier and an image of a unique, visually observable biologic identifier on a body portion of the respective individual;
(b) capturing local images which include both:
- (i) making of at least one of writings and keyboard entries by an individual whose identifying information may be stored in the database; and
- (ii) a body portion of said one individual on which is visible said biologic identifier; and
(c) determining whether said individual making the writings and/or keyboard entries is the same as one of the registered individuals whose identifying information is stored in said database, by verifying the substantial equivalence of the local image of the visually observable biological identifier and one said images of the body portion stored in the database.
Techniques for the identification of the receiver of information, the subject of U.S. patent Ser. No. 13/563,399, are complementary to the aforementioned techniques for author identification.
Such techniques utilize what is referred to herein as biodynamic identification, i.e. the use of a device in the vicinity of a person to be identified based on a visible or audible biologic feature, wherein the device causes a modification of the biologic identifier. For example, though a fingerprint provides a static identification, with a pattern that is unchanging during an encounter, the pattern of an iris of an eye will change based on constriction or dilation of the associated pupil in response to changing light conditions. Thus comparing a plurality of iris images obtained during a plurality of light conditions will enhance the biologic information available for identification. Furthermore, the identity of the receiver of information may be even more securely determined by allowing the sender of information to cause the manipulations which result in the change of the biologic identifier. For example, if the sender of information can repeatedly or continuously manipulate the amount of light impinging on the eye of a potential receiver of information, and can do so with a pattern of manipulations known only to the sender of information, then an analysis of iris images of the potential receiver of information by the potential sender of secure information will allow better identification of the receiving person than a simple static comparison (of a single iris pattern with data stored in the sender'"'"'s computer memory).
Another technique of biodynamic identification is the provision of a display screen containing a detailed changing pattern in proximity to a biologic identifier of a receiving person. The screen may display white noise, other visual displays of noise, or other coded information. The content of the display is determined by the sender of the secure information. A composite image of (i) the potential receiver with biologic identifier (i.e. a face, an iris, etc.), and (ii) the displayed, changing coded pattern, when returned to the potential information sender will serve to indicate to the sender who the receiver is.
A device which documents the parties to an encounter and the details of the encounter and which securely stores such encounter information is obtained by combining, with other apparatus and concepts, the use of:
(1) the author identification apparatus and techniques presented in U.S. Pat. No. 8,233,672, incorporated herein by reference, and
(2) the identification apparatus and techniques for a receiver of information presented in Ser. No. 13/563,399, also incorporated herein by reference.
Such encounter identification (“EID”) apparatus might, for example, provide a basis for a medical records system, wherein the parties to the encounter might be (i) a medical professional such as a physician, nurse, nurse practitioner, physicians assistant, dentist, etc.; and (ii) a patient treated by one of the aforementioned medical professionals.
Medical records systems, in order to be useful must combine ease of information entry and security of data storage. Currently available medical record systems have limitations including:
(i) time consuming aspects of data entry;
(ii) failure to document critical conversations between patients and medical professionals; and
(iii) failure to securely store information.
The system described hereinbelow addresses these limitations. By providing video and audio documentation of encounters between medical professionals and patients, both of (i) and (ii) above are addressed. By identifying medical professionals and patients using biologic identifiers during a medical encounter, using the techniques of the above-cited '"'"'672 patent, a document which demonstrates the details of a medical encounter with an extraordinary degree of certainty (as to participants and information exchanged) is obtained.
Furthermore by requiring the biodynamic identification of a person who later desires to utilize the information contained in this medical record, the problem of inappropriate use of the information is addressed.
In a preferred embodiment of the invention, a hierarchy of registration persons determine
- (i) who may access secure information,
- (ii) what information may be accessed, and
- (iii) who may determine the individuals who are allowed to grant such access.
To maintain and enhance the security of the system, means are presented for the determination of the identity of these registration and supra-registration individuals using the aforementioned techniques of biodynamic identification.
The invention allows for all of the conventional techniques of medical record keeping and annotation. Conversion of voice to text is also possible, using techniques known in the art. Annotation with keyboard entries by a medical professional during or after an encounter are possible using techniques known in the art. Computer files may be inserted into the record indicating the results of examinations and tests.
The techniques herein may also be used to fully or partially capture a surgical procedure, with biodynamic identification of the participants.
The techniques herein may also be used to capture medical consent discussions, which in turn will largely if not completely resolve the problem of malpractice lawsuits related to the allegation of failure to provide informed consent.
The techniques herein may be applied to other types of encounters which depend critically on proper documentation, including proper identification of the individuals involved in the encounter. Such events include but are not limited to:
- (i) the parties to a contract;
- (ii) the parties to a sale of property;
- (iii) the parties to a law enforcement encounter;
- (iv) the parties to critical government proceedings; and
- (v) the parties to critical international proceedings.
To further enhance the computer file protection afforded by the biodynamic receiver identification apparatus which is the subject of Ser. No. 13/563,399, the addition of apparatus which enables a human gatekeeper is the subject of another embodiment of the invention. In such apparatus, a the human gatekeeping person, “HGP”, must authorize access to computer memory, in addition to the authorization provided by the biodynamic identification performed by computer processors. In a first embodiment, the processor presents the results of such an analysis to the HGP, and the HGP makes a yes/no decision allowing or preventing information access. In a second embodiment, a yes/allow access decision requires both a suitable identification match by the processor, and a permission by the HGP.
For a full understanding of the present invention, reference should now be made to the following detailed description of the preferred embodiments of the invention as illustrated in the accompanying drawings.
The preferred embodiments of the invention will now be described with reference to
- 1) At a registration event: a link between the name of the author (and/or other author identification data) 100 and a video image 102 that identifies the author;
- 2) At an authorship event (the time an author produces an original document): a simultaneously recorded image of
- a. the document as it is being authored 104, and
- b. an author image 106, i.e. an image of an identifiable feature of the author; and
- 3) At a verification event (a time when verification of the author identity is confirmed): a determination that the registered author image 102 is substantially identical to the author image 104 which is recorded at the time that the document is authored.
The registration event links 100 and 102; the authorship event links 106 and 104; and the verification event links 102 and 106. The net effect, symbolically is:
. . . thereby establishing that the author is the same person as a registered person.
The document may be one of many types in which there needs to be certainty about the identity of the person who signed it, who authored it, or who indicated his or her thought(s) by one or more writings or keyboard entries. Examples include, but are not limited to:
- a) a financial matter which requires a verified signature, such as a check, a loan application, a promissory note, a funds transfer, etc.;
- b) a test, in which the test taker answers questions to demonstrate mastery of certain matters;
- c) an original work—literary, scientific, artistic, musical, etc.
- d) a vote—in a government election, a shareholder matter, etc.
- e) a medical record—including an entry by a physician or nurse, a signature on a “do not resuscitate order”; a signature (by a patient or physician) on a document indicating that informed consent was obtained;
- f) a legal document; such as a contract, a death certificate; a court document; a will; and
- g) a political document such as presidential signature on a legislative bill, a treaty, etc.
The term “author” is intended to include each of the types of person listed in a)-g) hereinabove; and in general is anyone whose identity is to be linked to an observable event. This identity may be a name, a social security number, a medical license number, etc. The observable event generally refers to events which may be seen; But embodiments of the invention which involve only video data, or only audio data (e.g. verification of a speaker or singer) are possible. The events which may be seen include writing using a pen, pencil etc. on a piece of paper, using a virtual pen to write on a touch sensitive screen, selecting a choice from a menu using a touch sensitive screen; using an actual keyboard, and using artistic tools to create a work of art.
Once the registrar accepts the association between the ID data and the registering person'"'"'s image, the data-image pair is stored as a computer file in a database. The image of the data-image pair is then considered to be a registered image. A database may hold:
a) one or multiple registered images of one person;
b) registered images of multiple persons (which may include one or more images for each such person).
At block 202, at a time later than the registration process, an author (as defined hereinabove) who has previously registered (by the process indicated hereinabove) and who wishes to have his (male pronoun used hereinbelow without any intention of the choice indicating a preference, limitation, or advantage) identity confirmed, produces a document while simultaneous images are obtained showing:
- (i) the authored data, i.e. the actual writing as it is being produced, or (ii) keystrokes as they are being registered (on either an actual or virtual keyboard); and
- (ii) the author image, i.e. an identifiable biologic feature of the author.
In one preferred embodiment of the invention, the camera which captures the authored data also captures—within the same image—the author image. For example, the camera may be situated so as to capture both the face and the hands of the author, with the portion showing the hands also showing the written material/keystrokes in enough detail to identify its content. Ideally the camera would also show enough of the body region between the face and the hands, so that it was clear that the face and the hands belonged to the same person.
An example (discussed hereinbelow) which clearly demonstrates textual material and author identification in a single image, uses a device which shows author fingerprints, as the author makes keyboard entries.
In another preferred embodiment of the invention, two separate cameras may be used: one to capture the image of the biologic identifier, and one to capture the image of the textual material. The two images may stored as separate files with a secure label for each file, indicating the time and location of each image (to thereby allow for the conclusion that the two were recorded in essentially the same space and time); Alternatively, the two images may be merged into a single file, by techniques known in the art.
At block 204, the author image is compared with either (i) the registered image of the person believed to be the same person as the author; or (ii) some or all of the registered persons, if the identity of the author is either unknown, or substantially uncertain.
At block 206, a determination is made as to whether the author image and a registered image are a match. The definition of a match is further discussed hereinbelow in conjunction with
Registration video camera 300 allows inputting of images of a biologic identifier such as a face, palm, fingerprint(s), iris or retinal image, to processor 304. A registrar confirms the name or other textual identifier (the ID data) to be associated with the image from 300, and enters the textual identifier through input 302, to processor 304. 304 produces a file which contains both the ID data and the associated video image, and stores the information as a file in registration database 306. 306 contains multiple files (e.g. FILE 1), each of which contains one person'"'"'s ID data and that person'"'"'s identifying image (e.g. I1-NAME1). 306 is preferably maintained in a highly secure environment. Various means to prevent corruption of the data contained in 306 are known in the art. Maintaining multiple copies of the database in different locations, and requiring a match with two or more copies, each in a different location is one means of enhancing the security of the database.
An author wishing to prove his identity, enters video images of (i) his work as it is being produced by him, and (ii) himself, through input device 308. Video camera 308A is used to produce file 308B, which contains simultaneously recorded author image(s) 307 and authored data image(s) 309. In an alternate embodiment of the invention, as discussed hereinabove and hereinbelow, there may be more than one camera 308A. 308B is sent to processor 304, which then compares the author image 307 with one or more registered images in database 306. If a match is found, the author data 309—i.e. the signature, composition, document, etc. produced by the author—is then stored as verified writing or keyboard entries in storage apparatus 310. Storage apparatus 310 may be part of 306, or separate from it.
The comparison of the author image and the registered image may be:
- a) performed entirely by processor 304;
- b) performed entirely by optional human 312, who views the two images on display 314;
- c) performed by processor 304, unless the result of the evaluation by 304 results in a state of uncertainty (e.g. if there is a less than good match between the two images); In this case, the task of comparison may be handed off to human 312. Processor 304 may be pre-programmed to indicate the level of goodness of match required to bypass human 312. Processor 304 may use neural networks to facilitate the process of visual comparison.
If the final decision regarding the comparison is made by the processor, the result may be indicated on display 314. Clock 316 allows for time-stamping of images and of comparisons.
The recording by any of the cameras—either during the registration step or the authoring step—may be of a single image or of a sequence of images (e.g. a video or a “movie”). Hereinabove and hereinbelow, “image” is intended to refer to either one of these cases.
- a) registration;
- b) entries by an author who wishes to be a verified author; or
- c) both a) and b).
In the registration process, person 400 may use the apparatus to input two or more unique identifiers simultaneously, in the same image. For example, 400 may sign his name on 402. 402 may represent:
a) a transparent or semi-transparent surface/paper which allows a signature to be observed and recorded by video camera 404 which is situated below 402;
b) a touch sensitive screen with enough resolution to provide a good quality copy of a signature. 404 may be used to capture both the signature and
a) an image of the face, iris or retina of 400; and/or
b) an image of one or more fingerprints, or a palm print of 400, visualized through transparent surface 414.
Alternatively, 404 may capture both a fingerprint/palm print and a signature, without capturing the facial/iris/retinal image.
In yet another embodiment of the apparatus used for registration, multiple identifiers may be simultaneously captured in the same image using camera 410 which is situated behind and, if necessary, somewhat to the side of (or above) person 400, and may be pointed at mirror 412. With proper placement of 410 and 412, and proper angulation of 412, camera 410 may visualize both:
- a) the signature of person 400 on 402 (which need not be transparent or semi-transparent in this case); and
- b) the face/iris/retina of person 400.
In yet another alternate embodiment of the registration apparatus, 410 and 404 may both be used to input registration information. Each may be used to input the type of information described hereinabove. The information may be stored:
a) as two separate files, one for each camera, with each having associated ID data for the registrant, and each confirmed by the registrar (with each file preferably indicating the presence of additional registration information for the same person in another file); or
b) as a single file.
The information from 404 and 410 may be obtained simultaneously or at separate times.
A simplified form of the registration process would be to enter only a single identifier for 400, e.g. one of the signature, facial image, etc. The apparatus in
Embodiments of the registration apparatus with more than two cameras are possible. The operating principles parallel those of the two-camera case.
The apparatus shown in
- a) written entries or touch sensitive screen based entries; and
- b) at least one visual identifier of the author (e.g. face, signature, fingerprint(s), etc.).
The mode of operation would be the similar to that described hereinabove for the registration process, except that it may be desirable to enter more text (perhaps a lot more text) than just the author'"'"'s signature. Furthermore, screen 408 may be viewed by camera 410, and may be used to display either:
(i) textual material in a document that the author is signing; or
(ii) a display of what the author is writing on 402 (as observed by camera 404 or another camera (not shown in this Figure) which may be placed above 402). In addition, by angulating mirror 412 so that it shows the author'"'"'s face, and by properly angulating 408 and 412 and properly positioning 410, both the face (and/or iris, and/or retina) and the authored data as shown on screen 408, may be recorded in a single image by 410 (or in each of a series of images recorded by 410).
In an alternate embodiment of the invention, a largely transparent keyboard could be used for 510. This would facilitate 404 observing the face of 400.
Furthermore, a keyboard in which the key surfaces are largely transparent—shown in
a) the author'"'"'s fingerprint, and
b) the sequence of selected keystrokes.
In the Figure, camera 604 is positioned underneath keyboard 610, to show both fingerprints and keystrokes in each image.
a) a camera 704A located behind the transparent or semitransparent touch sensitive screen which records an image which shows each of (i) the finger touching the “no” choice box, 703, (ii) the contiguous parts of the hand lying between the finger which selects the touch sensitive region and the finger which is the source of the print, and, optionally (iii) the fingerprint itself, viewable through 706; and
b) a camera 704B which is located behind the individual, and records the selection of the “no” choice at the same moment that the fingerprint is visualized by 706.
In the case of a “yes” choice, the functioning of the apparatus is analogous to its functioning for a “no” choice: The left hand of 700 may be used to simultaneously touch fingerprint identification apparatus 708 and touch box 701 on the touch sensitive screen.
Apparatus similar to that shown in
- (i) the authored material;
- (ii) the author image; and
- (iii) the witness image;
a highly verifiable and very difficult to corrupt/hack, system is the result. If in addition (not shown in the Figure), the witness is also a person who has been registered by the same process that the author has, an even greater degree of hardening of the system is the result.
Since the registrar has the role of matching the ID data and the registered images, the robustness of the system will depend on the reliability of the registrar. Various methods of enhancing registrar reliability are possible including having multiple registrars, each of whom reviews the correctness of a paired ID data-registration image set. Yet another method of security enhancement would be to have super-registrars, i.e. people with a high level of security clearance who are responsible for registering ordinary registrars.
Another method of enhancing security during the registration step is shown in
The concept of linking a particular person to a particular body of information has, hereinabove, been considered with respect to providing a strong linkage between provided information and the person providing the information. Hereinbelow, the concept and invention is presented with respect to providing a strong linkage between provided information and the person requesting the information. It will be clear that such a strong link will be useful for (a) providing secure communications, (b) for preventing access to information stored in a computer memory or other digital device by an inappropriate person, and (c) for preventing the modification of information stored in a computer memory or other digital device by an inappropriate person.
(a) repeatedly examining a biologic feature of the person and comparing it to information in a database which contains files which comprise
- (i) information pertaining to the details of the biologic feature of a registered person, the information having been obtained under a plurality of different conditions, and
- (ii) alphanumeric identification [e.g. name, social security number, date of birth, etc. are also stored in correspondence to the biologic] of the registered person; and
(b) providing a prompt which induces a change in the appearance of the biologic identifier.
By providing a prompt which alters the appearance of the identifier, and by repeatedly observing the identifier, the invention provides a far more secure system than the static approach, known in the art, of simply comparing an image of a biologic identifier (“BI”) of a person requesting access to a digital system to file images. An example of the static approach is described in U.S. Pat. No. 8,189,096 to Azar.
Defeating the static approach, i.e. causing a computer or communication system protected by the requirement of providing a static image, entails (i) obtaining and storing a BI image, during a process that is perhaps unknown to the person associated with the BI, and (ii) providing the previously stored image of the BI, at a time when information or computer system access is desired by someone who is not the person associated with the BI [i.e. an inappropriate person (“IP”)], but who is in possession of and can provide the information contained in the static BI.
The static system becomes harder to defeat if multiple (static) images must be provided to gain access to the system. But it still may be defeatable by an IP, by obtaining a multiplicity of static images of the BI of a person registered to use the system.
In one embodiment of the current invention, advantage is taken of the ability to change the appearance of a BI upon the request of the person or system providing secure information or desiring secure communication. A simple approach is a voluntary request to the RP to perform a motion which results in a change in the appearance of that person'"'"'s BI. Examples of such changes include a request to turn the RP'"'"'s face in one direction or another, to wink one eye, to look to the right, left, up, down, etc. (with or without moving the head) or to move a finger containing a fingerprint in a particular way, or a palm containing a palm print or a pattern of blood vessels in a particular way.
Still other requests may involve moving one part of the body containing one BI so that its relationship with another part of the body containing another BI is geometrically altered. The value of such a voluntary prompt is that the nature and timing of the request is entirely under the control of the information source (“IS”), whether the source is a person or a computational device.
Still other requests may be for the RP to follow a moving point or object on a display screen, using apparatus in which the IS controls the trajectory of the point on the screen, while a camera observes the user eye motion, iris image, retinal vein image, image of blood vessels on the surface of the eye, or facial motion. Although the tracking of such a point by the RP would not perfectly match the apparent motion of the point, software methods to compensate, and statistical techniques to assess a match could be applied as are known in the art. Clearly, attempts by an IP to communicate inappropriately with such a system would be extremely difficult, requiring the IP to very quickly provide a sequence of BI images which match a not previously expected pattern of variance. By making such the choice and timing of prompts random or pseudo random (e.g. by using a variety of techniques to generate such random information including the digitization of white noise, the use of minutae related to sports information [e.g. number of milliseconds between pitches in an ongoing baseball game], stock market minutae [e.g. ongoing trades and their timing], astronomic information [e.g. solar activity], traffic information minutae [patterns of people walking through Times Square], by electronically generating pseudorandom number patterns), the task of the IP becomes more difficult.
A still greater burden on the inappropriate person attempting to gain access entails the use of prompts resulting in entirely involuntary physiologic actions. One such example is the application of light to the human eye.
As shown in
In turn, the extent of incident light may be controlled by apparatus at the information source. Prompts can control the light intensity, the wavelength, the spatial placement of the light, the size of the light source, the number of light impulses, the time interval between impulses, the duration of each impulse, etc. Furthermore, the IS may store prompt details and generate and expected iris response for comparison with an observed one. Furthermore, the IS may generate linear and other combinations of iris images stored in a computer database, thereby potentially expanding the database limitlessly. The IS may also adjust the amount of applied light to attempt to match an iris image on file.
In addition, alteration in iris size may be induced by having the RP change focus from a distant object to a near one (which may be presented on a computer or digital device display screen), or vice versa. In addition, dilation of the pupil/constriction of the iris may be induced by a painful stimulus, which may be applied to the RP under remote control via a device attached to the patient (e.g. one which provides a mild electric shock).
A given induced change in iris image, (i.e. the varying biologic identifier,) may not always occur identically for a given amount of light. The system administrators and architects will overcome this by either (a) storing a variety of responses to each prompt, obtained during a registration period for the person who is to be an authorized user of the system, (b) utilizing linear or other combinations of previously observed responses by a particular user, or (c) by utilizing neural networks to learn the patterns of authorized system users.
The pupil/iris changes, in turn, will change the appearance of another BI, the pattern of retinal blood vessels. A constricted pupil narrows the area of retinal surface (and vascular pattern) available for view, while a dilated pupil has the opposite effect. Thus another embodiment of the invention entails RP identification using retinal vessels as the BI, and prompts cause a change in iris/pupil geometry which changes the viewable retinal field.
The aforementioned involuntary changes in the appearance of the BIs caused by IS prompts in essentially unpredictable manner would create a situation that would be extremely difficult for an IP to defeat.
Referring again to
As indicated hereinabove, the certification that AP information stored in 1600 is indeed correct may be accomplished by utilizing a registrar, i.e. a registration person who is authorized to input information to 1600. This input occurs via input device 1624, which may also input alphanumeric and/or biologic identification information pertaining to the registrar.
Whereas the connections between (i) processor 1602 and (ii) each of camera 1616 and prompt device 1612 comprise a wired connection or a series of wired connections, FIG. 16B shows embodiment of the invention in which camera 1642 and prompt producing device 1644 are in communication with processor 1646 by wireless means. The link from 1646 to 1644 is via transmitting device or output device 1648 and receiving device or input device 1650. The link from processor 1646 to camera 1642 is via transmitting device or output device 1652 and receiving device or input device 1654. 1648 and 1654 may comprise a single transmitting and receiving device. 1652 and 1650 may comprise a single transmitting and receiving device. A wide variety of such communication devices and methods will be known to those skilled in the art. Combinations of wired and wireless links for the system, which embody features of each of
Communication between (i) the processor 1646 and (ii) each of camera 1642 and prompt device 1644 may be by a public or private telephone network, the internet, a private digital or analog communication network, radiofrequency communication (including the microwave portion of the spectrum, and Bluetooth communication), satellite-based communication, light communication (including infrared and ultraviolet), communication by modulated magnetic fields, and communication by sound, ultrasound, or subsonic longitudinal wave modulation means.
RP 1640, camera 1642 and prompt device 1644 may be situated in a location which is different, and possibly remote from processor 1646, and its associated input devices and memory devices. Such a separation between the corresponding elements of
Each of the remaining elements in
As is known in the art, each processor 1670 (which is analogous to processor 1646 in
Visible ID database 1804 may also contain biologic ID images which show a body part from a variety of vantage points and angles.
Another approach to further increasing the security and accuracy of identification of a user, and the location of the user of the system is shown in each of
It is to be understood that each step in the passage of the information reflected by the code may involve a degree of distortion/degradation of the information. The conversion of the information from digital signal to visual display is one such step, as is the conversion of the screen information to a camera image, and the conversion of the camera image to a camera signal. Further losses of integrity may occur during each limb of signal transmission from and to the processor. Thus the analysis of the received code by the processor, and its comparison with the sent code will result in a less than perfect match even when system integrity is uncompromised. Algorithms for assessing the goodness of fit of the received version of the code information to the sent version will be apparent to those skilled in the art.
The difficulty of having an inappropriate person gain access to processor 1700 is enhanced by including the code component in the composite image: Gaining such access would require the IP to be able to reproduce the BI and reproduce the image of the code, and to do so within a single image. The difficulty of such reproduction is enhanced by rapidly changing the code. Each of the elements (the noise generator, the random outside events information and the processor itself) utilized to generate random and pseudorandom variations discussed in conjunction with
This variation may utilize either a single image of biologic ID/code image or repeated ones. In addition, a prompt producing device and activation means (not shown in the Figure), could be added to further augment the degree of security.
Each of the remaining elements of
A flow diagram of the algorithm which embodies the schematics of
Yet another technique for merging the code screen and the BI is shown in
In the aforementioned detailed description of each of
Although a two way version of the invention is possible, in which two people communicate each having a respective RP camera and display screen (or RP camera and prompt producing device), and each having a respective processor for analysis of the aforementioned matches, the two way transmission would increase the chance of interception and/or diversion of the message.
An additional means of security entails projecting a code image onto a reflective portion of the eye of the RP, and then imaging the reflected image. This is shown in
(a) camera positioner 2312, which receives positioning signals from processor 2308. Camera 2316, which views eye and face position provides information for 2308, as does the image viewed by 2306;
(b) the addition of alternate cameras, such as camera 2314;
(c) (not shown in the Figure) a positioning device similar to 2312, electrically linked to processor 2308 and mechanically linked to projection device 2302.
In addition, prompts directed to the RP indicating instructions for orienting the face and eyes will enhance the success of this approach. Once such apparatus is shown in
Referring again to
Camera 2322, referred to as an anti-tamper camera is configured to view the one or more of the elements in the Figure to prevent tampering with them. It can also view a screen 2324 on the housing of camera 2306, which displays a code (either the same of a different code as reflected off of the eye), for verifying the identity of camera 2306. Alternatively, or in addition, camera 2306 can view a code on screen 2326 attached to the housing of the anti-tamper camera. The code displayed by 2326 may be the same as either of the aforementioned codes or different.
Referring again to
The inventions described herein are applicable for preventing an inappropriate person from gaining access to secret or classified information in a remote computer memory. Gaining access includes copying the information and corrupting the information.
An alternative to enhancing the information contained in the biologic ID is the provision of a complex pattern of information on a screen, near enough to the person to be identified that a single camera can visualize both the screen and the Persons.
In the Figure, camera 2600 visualizes each of Person #1/element #2601, Person #2/element #2602, and may image prompt or code screen 2604 if the display of code is utilized for biologic identification enhancement. The code or prompt manipulation is controlled by system processor(s) 2606. Information concerning the medical encounter is inputted to memory 2610 by processor 2606. The identity of Person #1 and Person #2 is stored in database 2612, having been inputted to the database by a registration person utilizing input apparatus 2614.
The camera may visualize the iris, retinal blood vessels, veins of the hand, a fingerprint, a face. It may visualize veins in other parts of the body. It may visualize arteries. In the case of the iris the response to light of circular muscle fibers and radiating muscle fibers of the iris will modulate the iris pattern. A voluntary change in focus (which may occur as a result of a prompt requesting this) will also produce a change in the size of the iris. For visualized retinal vessels, the change in pupil size caused by iris manipulation will affect the size of the viewable vessel field. The movement of other parts of the body containing biologic identifiers in response to a request will provide a dynamic aspect to the identification. Screen 2604 is intended to also indicate a speaker for providing such audio instruction.
Microphone 2616 serves the dual purpose of (i) providing an audio record of the encounter, and (ii) providing a voiceprint of each participant.
If the encounter is a medical one, then information from medical instruments and equipment 2618 used in an examination (such as a stethoscope or an ECG machine) are inputted. Pertinent text and other data are inputted via 2620.
The aforementioned setup is applicable in all phases of medical encounter including a doctor'"'"'s office consultation room, a doctor'"'"'s office examining room, an operating room, a hospital room, etc.
In the case of a non-medical encounter, each of the elements in the Figure is applicable except for 2618.
The upper part of the Figure shows the mechanism by which a person 2622 (i) requesting access to information about the encounter may gain such access, and (ii) requesting to enter information in conjunction with the encounter may do so. Camera 2624 images both 2622 and screen 2626 if code is used for identification enhancement. The image information is conveyed to 2606 via link. The link may be a direct/hard-wired connection, a radiofrequency connection, an internet connection, a fiber-optic cable connection, private network connection or other means of broadband linkage. Another link 2630 allows (i) the conveyance of prompts or code to 2626, and (ii) the conveyance of access of person 2622 to secure information memory 2610 via processor 2606 and information access device 2632. Link 2630 may comprise any of the means recited in conjunction with link 2628; the 2630 means need not be the same type as the 2628 means. Furthermore, the information access component of the link need not be the same as the prompt/code conveying component.
When the biologic identifier enhancement technique involves a code containing screen, techniques for synchronizing screen 2626 changes and camera 2624 image acquisition may be utilized, as are known in the art, and may be performed by processor 2606 or another processor.
As indicated in conjunction with the receiver identification technology of Ser. No. 13/563,399, audio instructions may serve as prompts, and noise and other codified random events or pseudorandom events may serve as a basis for code.
A dotted line in the Figure indicates a possible separation of the access requesting person, who may be at the scene of the secure memory 2610, or remote from it.
When the biologic identifier enhancement technique involves a code containing screen, techniques for synchronizing screen 2702 changes and camera 2701 image acquisition may be utilized, as are known in the art, and may be performed by processor 2606 or another processor.
In addition, a gatekeeper or gatekeeping person, HGP, observes the analysis of a comparison of (i) the inputted biodynamic (i.e. manipulated by prompt and or code-containing screen 2702) identification information of 2700 with (ii) the corresponding biologic information of the person that 2700 claims to be. If the person that 2700 claims to be is authorized to use the system, then their biologic identification information will be stored in 2712. Processor 2716 performs this comparison, and reports the results to 2710 via output device. A match signal sent to 2718 may indicate a simple binary result (i.e. “yes” or “no”), a numerical value of goodness of fit, or a multidimensional analysis of goodness of fit. It may include a request for more information such as a specific suggestion for prompt manipulation. Based on the HGP inputs a response to 2620, which may be to accept the request for information by 2700, to deny the request or to continue with a further identification analysis.
The human may be expected to have certain advantages useful for a final “yes” or “no” decision, that may relate to factors other than just the identification, including, patterns of information request(s) over time, the nature of a particular request, current events related to information system breaches, other current events and the like. Furthermore, the human gatekeeper may prefer to analyze the biologic information himself/herself, and may not necessarily agree with the outputted analysis of processor 2716.
In another embodiment of the invention, access of 2700 to memory 2702 is provided only if both (i) the analysis of processor 2716, and (ii) the HGP analysis are in agreement to provide access. In this case, the human gatekeeper cannot overrule the processor analysis result.
Since the enhancement of security by adding a gatekeeper depends on having the gatekeeper be the person that he/she claims to be, gatekeeper identification is desirable. There are various possible levels of such HGP identification. In
As discussed hereinbelow in conjunction with
- HGP input is sought only when the analysis of the identification match of 2700 with stored memory images in 2712 by processor 2716 yields an intermediate value. For high levels of match or non-match, the processor may act autonomously;
- Arrays of multiple HGPs may include hierarchies where a high level gatekeeper person monitors the activity of one or more lower level gatekeeper persons;
- Still more complex arrays of monitoring may include one or more processors which monitor the decision making of one or more gatekeepers—i.e. these processors carry a higher level of decision making weight than the gatekeeper; and
- Still other complex arrays involve a plurality of identification information analyzers (persons or gatekeepers) wherein a decision may be made by a majority vote, a ⅔ or more vote, etc.
A dotted line in the Figure indicates a possible separation of the access requesting person, who may be at the scene of the secure memory 2702, or remote from it. The gatekeeper is shown in proximity to the processor and memory, which would be expected to increase information security; however, invention configurations with the HGP not near the secure memory are possible as well.
(1) a first representation, which specifies the exact coded information;
(2) a second representation, which is the combined image of the biologic identifier and the code; and
(3) a third representation, which is the extracted image of the code, after it has been separated from the returned composite image.
The third representation is compared with the first representation in the determination of authenticity of the composite image. The distortion implicit in imagining techniques will prevent a perfect match of the first and the third representation. But even lesser degrees of match are expected to be very difficult for a hacker or unauthorized attempting user to duplicate.
In conjunction with
Analyses with larger numbers of representations are possible; each such scheme recognizes the concept that (i) there are many steps along the “round trip” that the code makes from the processor to the remote access requester and back, and that (ii) the code may suffer some degree of distortion/degradation as it makes each such step.
3106 comprises identification information of registration persons; In order for there to be secure entry of biologic identification information of access persons to be newly entered into memory as acceptable users, biologically identifiable registration persons, known to pass security muster, must be allowed to access the system.
3110, the identification information of supervisory personnel is intended to indicate one step up in the hierarchy of trusted individuals; The supervisory personnel are persons allowed to register registration persons. Some supervisory personnel may be allowed to enter the identification information of other supervisory personnel. Some registration personnel may be allowed to enter the identification information of other registration personnel. Some supervisory personnel may be allowed to enter the identification information of other accessing persons. Systems with fewer or greater numbers of levels of hierarchy are possible.
After manufacture of the system, there must be at least one person who is allowed access. This can be accomplished with a similar hierarchical setup in the manufacturing facility. It can also be accomplished by allowing the first person who uses the system to enter his/her own identification information without the permission/approval of another person. It can also be accomplished by having at least one person'"'"'s identification information inserted in a write-once-only memory 3112 at the time of production.
Systems are possible with one memory or more than one memory. Systems are possible without a write-once-only memory or with more than one write-once-only memories. The memory may reside in a microprocessor, microcontroller, a hard drive, or other digital information repository, as is known in the art. The write-once-only memory may be PROM-based, EPRO-based, EEPROM-based or use other non-labile configurations as are known in the art.
The memory may be protected by tamper-detecting seal(s) 3114 (shown as a broken line in the Figure; the broken line is not intended to specify a construction feature of such seals, which are known in the art). The seals communicate with a processor 3116. In the Figure this is the processor which provides information for the memory and retrieves information from it. There may be more than one processor involved in management of memory information. Seal information may be managed by the same processor(s) as used in user identifying information management or another processor. A camera 3118 may constantly observe the memory to enhance security, relaying information to either 3116 or another processor.
(i) a person desiring to gain access to a computer memory (
(ii) a gatekeeping person (
These figures show an information path to the receiving person which traverses the reflective surface of the eye (3200 for the information accessing person/
There has thus been shown and described a novel system for verifying the identity of an author and for verifying the identity of a person receiving information or using a computer system, which fulfills all the objects and advantages sought therefor. Many changes, modifications, variations and other uses and applications of the subject invention will, however, become apparent to those skilled in the art after considering this specification and the accompanying drawings which disclose the preferred embodiments thereof. All such changes, modifications, variations and other uses and applications which do not depart from the spirit and scope of the invention are deemed to be covered by the invention, which is to be limited only by the claims which follow.