Method and apparatus for securely transmitting and authenticating biometric data over a network

• US 6,332,193 B1
• Filed: 01/18/1999
• Issued: 12/18/2001
• Est. Priority Date: 01/18/1999
• Status: Expired due to Term

• Current Assignee: Sensar, Inc. (Advent International Corporation)
• Original Assignee: Sensar, Inc. (Advent International Corporation)
• Inventors: Salganicoff, Marcos, von Seelen, Ulf Cahn, Glass, Randal
• Primary Examiner(s): Hayes, Gail
• Assistant Examiner(s): Seal, James
• Application Number:
  US09/232,538
• Time in Patent Office: 1,065 Days
• Field of Search: 713/170
• US Class Current: 713/170
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/608 Watermarking
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method and apparatus for collecting and securely transmitting biometric data over a network contains a sensor, preferably a camera, for collecting biometric data and code generating hardware and software. The camera data is digitized and a unique code which is a function of the digitized camera data, a secret key and a transaction token is attached to the digital file. The code may identify the sensor which acquired the biometric information, a time at which the biometric information was acquired, or a time interval during which the data is considered to be valid, and a unique transaction code. The data and code are transmitted over a network to a server which authenticates that the data has not been altered by recomputing the code using its own knowledge of the secret key and transaction token needed to generate the code. If the data is authentic the server then computes a biometric template using the data. This biometric template is then compared to a previously defined biometric template to identify the user and give the user access to a secured resource. The system can be used for online banking and Internet commerce transactions.

Claims

1. An apparatus for collecting and transmitting biometric data over a network, the apparatus comprised of:

a sensor having a unique identifier, the sensor collecting biometric data;

a token generator, coupled to the sensor, the token generator sending a token to the sensor;

a digitizer coupled to the sensor, the digitizer converting the biometric data collected by the sensor into a digital file;

a combiner coupled to the sensor, the combiner creating a data package comprising the digital file, the unique identifier and the token;

a code generator coupled to the data package, the code generator creating a signed data package; and

an output interface coupled to the combiner, the interface outputting the signed data package to a network.

2. The apparatus of claim 1 where the digital file is one of a memory and frame store.

3. The apparatus of claim 1 also comprising an image processor connected to the sensor, the image processor containing the digitizer, memory and a compressor for compressing the image.

4. The apparatus of claim 1 also comprising a cropper connected to the digital file to reduce the size of the image in memory before compression.

5. The apparatus of claim 1 wherein the sensor is a camera.

6. The apparatus of claim 5 wherein the camera is a two dimensional imaging device.

7. The apparatus of claim 6 wherein the imaging device is one of a CCD and a CMOS imaging device.

8. The apparatus of claim 1 wherein the code generator creates a code which is selected from the group consisting of watermarks, digital signatures, encryption keys, codes prepended to the digital file and codes appended to the digital file.

9. The apparatus of claim 1 also comprising a tamper resistant package in which the sensor, code generator, combiner and output interface are contained.

10. The apparatus of claim 9 also comprising a switch which is activated if the tamper resistant package is opened.

11. The apparatus of claim 10 wherein activation of the switch causes the apparatus to go to a non-functioning state.

12. The apparatus of claim 1 also comprising a personal computer connected to the output interface.

13. The apparatus of claim 1 also comprising an embedded processor connected to the output interface.

37. The apparatus of claim 1 wherein said token further comprises a time component.

14. A system for collecting and transmitting biometric data over a network comprised of:

a. at least one client system comprised of;

a sensor for collecting biometric data, the sensor having a unique identifier;

a token-generator coupled to the sensor, the token generator sending a token to the sensor;

a digitizer coupled to the sensor, the digitizer converting the biometric data collected by the sensor into a digital file;

a combiner coupled to the digital file and the sensor, the combiner creating a data package comprising the digital file, the unique identifier and the token;

a code generator coupled to the data package, the code generator creating a signed data package; and

an output interface coupled to the combiner, the interface outputting the signed data package to a network;

b. at least one server containing a program for receiving, authenticating biometric data, computing the biometric template and performing a verification/recognition function based on the data received from the at least one client system; and

c. a network connecting the at least one client system to the at least one server.

15. The system of claim 14 where the digital file is one of a memory and frame store.

16. The system of claim 14 also comprising a image processor connected to the sensor, the image processor containing the digitizer and a compressor for compressing the image.

17. The system of claim 14 wherein the sensor is a camera.

18. The system of claim 17 wherein the camera is a two dimensional imaging device.

19. The system of claim 14 wherein the imaging device is one of a CCD and a CMOS imaging device.

20. The system of claim 14 wherein the code generator creates a code which is selected from the group consisting of watermarks, digital signatures, encryption keys, codes prepended to the digital file and codes appended to the digital file.

21. The system of claim 14 also comprising a tamper resistant package in which the sensor, digitizer, code generator, combiner and output interface are contained.

22. The system of claim 21 also comprising a switch which is activated if the tamper resistant package is opened.

23. The system of claim 22 wherein activation of the switch causes the apparatus to go to a non-functioning state.

24. The system of claim 14 wherein the server contains at least one of a token generator, an image authentication module, a biometric template generating module, a biometric identification module and a database.

25. The system of claim 14 wherein the at least one server contains a log.

26. The system of claim 14 also comprising a certification authority connected to the server.

27. The system of claim 14 also comprising a cropper connected to the digital file to reduce the size of the image in memory before compression.

38. The system of claim 14 wherein said token comprises a time component.

39. The system of claim 38 wherein the server containing a program for receiving, authenticating biometric data, computing the biometric template and performing a verification/recognition function based on the data received from the at least one client system, further contains a program which verifies that the token received from the client system is approximately equal to the token which was sent from the token-generator.

40. The system of claim 39 wherein the program which verifies that the token received from the client system is approximately equal to the token which was sent from the token-generator is adapted to further verify that the time interval between the time that the token was sent from the token-generator and the time the token was sent from the client system falls within a specified interval.

28. A method for collecting and transmitting biometric data over a network to a server comprising:

receiving a token from an authentication server;

acquiring biometric information from a sensor, the sensor having a unique identifier;

converting the biometric information into a biometric digital file;

combining the digital file, the token and the unique identifier into a data package;

signing the data package;

transmitting the signed data package over a network to a server; and

authenticating the signed data package.

29. The method of claim 28 wherein the data package contains information which identifies at least one of:

a time at which the biometric information was acquired, an encryption key, a location at which the biometric information was acquired, and a time interval.

30. The method of claim 28 also comprising converting the biometric digital file to a biometric template.

31. The method of claim 30 also comprising:

a. comparing the biometric template to a stored biometric template; and

b. giving or refusing access to a secured resource based upon such comparison.

32. The method of claim 28 wherein the network is comprised of the Internet.

33. The method of claim 28 wherein the biometric information is acquired by a client system and also comprising the steps of:

a. requesting the server to authorize access to a secured resource by transmitting a request from the client system through the network to the server; and

b. giving or refusing access to a secured resource based upon a review of the biometric information.

34. The method of claim 28 also comprising the steps of:

a. issuing a token from the server to the client system;

b. appending the token to the digital file at the client system prior to transmitting the digital file to the server; and

c. checking for the presence of the token with the digital file at the server.

35. The method of claim 28 also comprising encrypting the data package before transmitting and then decrypting at the server.

36. The method of claim 28 also comprising at least one of the steps of cropping the digital file and compressing the digital file before transmitting.

41. The method of claim 28 wherein said token comprises a time component.