SECURITY CHECK PROVISION

• US 20010014167A1
• Filed: 05/14/1998
• Published: 08/16/2001
• Est. Priority Date: 03/03/1997
• Status: Active Grant

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: GIFFORD, MAURICE M, SEAL, CHRISTOPHER H, MCCARTNEY, DAVID JOHN
• Granted Patent: US 6,907,135 B2
• Time in Patent Office: Days
• US Class Current: 382/117
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition

Abstract

Methods and apparatus for providing a security check are disclosed. Many conventional security checks require the recording or transmission of a user data sets associated with respective authorized users. A problem arises with these systems if the user data set becomes known by unauthorized persons. In order to address this problem the present invention proposes the recording or transmission of only part of the user data set in insecure sections of the system. For example, a security check preventing unauthorized remote access to a shared computer (20) is provided by capturing a user data set representing a user'"'"'s iris, operating the user'"'"'s personal computer (10) to select only a portion of the captured data set requested by the shared computer (20) and transmitting the portion along a telecommunications line (16). The shared computer (20) derives partial data sets from stored user data sets using a similar selection to that used by personal computer (10) and compares the partial data set it has derived with the partial data set transmitted by the personal computer (10) in deciding whether to grant access. Point-of-sale devices and cards recording only partial user data sets are also disclosed.

Claims

1. A method of providing an automatic security check, said method comprising the steps of:

operating a user data capture device to;

(a) obtain, from a user attempting to pass the security check, a user data set; and

(b) derive a user partial data set from the user data set, the derivation involving the selection of elements from the user data set;

transmitting said partial data set via a communications link to an authentication apparatus operable to provide one or more acceptable data sets;

operating said authentication apparatus to compare said user partial data set with at least one of said one or more acceptable data sets to determine whether said user is a person authorised to pass said security check.

2. A method according to

claim 1

further comprising the step of automatically altering the selection process to be used in deriving said user partial data set in dependence upon time.

3. A method according to

claim 1

further comprising the step of operating said authentication apparatus to transmit a challenge signal to said capture device specifying which elements are to be selected from the user data set to derive the user partial data set.

4. A method according to

claim 2

or

3

wherein said authentication apparatus stores one or more enrolled data sets and said provision of acceptable data sets involves selecting elements from said enrolled data set to derive an acceptable data set using a selection process similar to that used in deriving the user partial data set from the user data set.

5. A method according to any preceding claim wherein said user data set comprises a user biometric data set captured by a user biometric capture device, said user partial data set comprises a user partial biometric data set, said enrolled data set comprises an enrolled biometric data set and said acceptable data set comprises an acceptable partial biometric data set.

6. A method according to

claim 5

wherein said user boimetric data set represents an image biometric and said biometric capture device comprises an imaging device.

7. A method according to

claim 6

wherein said imaging device has externally controllable parameters and said method further comprises the step of operating said authentication apparatus to transmit a challenge signal to said imaging device effective to specify one or more of said optical parameters.

8. A method according to

claim 7

wherein said externally controllable optical parameters comprise the focal length of the imaging device and the challenge signal is effective to specify the focal length.

9. A method according to any of

claims 5

to

8

wherein said user biometric data set represents a luminance pattern of the one of the user'"'"'s irises.

10. A method according to any preceding claim further comprising the step of encrypting said partial user data set before transmission.

20. A method according to

claim 5

wherein said user biometric data relates to only one type of biometric.

11. A security check terminal comprising:

a user partial data acquisition device operable to;

(a) obtain, from a user attempting to pass the security check, a user data set; and

(b) derive a user partial data set from the user data set, the derivation involving the selection of elements from the user data set.

12. A terminal according to

claim 11

wherein said user partial data acquisition device comprises:

a user data acquisition device; and

one or more processing means;

wherein said user data acquisition device is operable to capture a user data set and is directly connected to said one or more processing means which are operable to select elements from said user data set to derive a user partial data set.

13. A terminal according to

claim 12

wherein:

said user data capture device comprises a user biometric data capture device; and

said user data set, user partial data set comprise a user biometric data set and a user partial biometric data set respectively.

16. A security check terminal according to

claim 11

further comprising:

a reader for reading an acceptable data set stored on a portable device according to

claim 14

or

15

;

a comparison means for comparing said user partial data set with said acceptable data set; and

an authenticity signal generating means operable to generate a signal indicative of whether the user is an authorised person on the basis of the comparison made by said comparison means.

18. A communications network comprising:

one or more authentication apparatuses according to

claim 17

;

one or more security check terminals according to

claim 11

,12 or 13; and

one or more data communications links between said authentication apparatuses and terminals.

14. A portable device for use in enabling an authorised person to pass a security check, said device comprising storage means storing an acceptable data set comprising elements selected from a user data set associated with said authorised user, without encoding any of the remaining elements in said user data set.

15. A portable device according to

claim 14

wherein said acceptable data set and said user data set comprise an authorised partial biometric data set and an authorised biometric data set respectively.

17. An authentication apparatus comprising:

a partial user data set input means;

an authentication signal output means;

one or more storage media having recorded therein one or more stored data sets, and processor readable code executable to verify that a remote user is an authorised person, said code comprising;

user partial data set input code executable to read a user partial data set via said input means;

acceptable data set acquisition code executable to provide one or more acceptable data sets on the basis of one or more of said stored data sets;

data set comparison code executable to establish whether the user partial data set and the acceptable data set are sufficiently similar to verify that the remote user is an authorised person; and

authentication signal generation code operable to cause an authentication signal to be output via said output means on said data sets being sufficiently similar.

19. A method of providing an automatic security check, said method comprising the steps of:

operating a user data capture device to;

(a) obtain, from a user attempting to pass the security check, a user data set; and

(b) derive a user partial data set from the user data set, the derivation involving the selection of elements from the user data set;

operating said authentication apparatus to compare said user partial data set with a stored acceptable partial data set to determine whether said user is a person authorised to pass said security check, without storing the remainder of the acceptable data set from which said acceptable partial data set is derived.

21. A method of providing a security check substantially as hereinbefore described with reference to and as illustrated in the accompanying drawings.

22. A security check terminal substantially as hereinbefore described with reference to and as illustrated in the accompanying drawings.

23. An authentication apparatus substantially as hereinbefore described with reference to and as illustrated in the accompanying drawings.