System and method of fast biometric database searching using digital certificates

• US 6,505,193 B1
• Filed: 12/01/1999
• Issued: 01/07/2003
• Est. Priority Date: 12/01/1999
• Status: Expired due to Term

• Current Assignee: Iridian Technologies, Inc. (Advent International Corporation)
• Original Assignee: Iridian Technologies, Inc. (Advent International Corporation)
• Inventors: Cambier, James L., Musgrave, Clyde
• Primary Examiner(s): Amsbury, Wayne
• Assistant Examiner(s): NGUYEN, CAM LINH T
• Application Number:
  US09/452,603
• Time in Patent Office: 1,133 Days
• Field of Search: 707/3, 707/5, 713/186, 713/156, 713/176, 380/25, 380/23, 379/142.05, 382/117
• US Class Current: 1/1
• CPC Class Codes: G06F 18/00 Pattern recognition
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06V 40/18 Eye characteristics, e.g. of the iris
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching

Abstract

A system and method for conducting fast biometric database searches using iris recognition and digital certificates. Authentication of a computing platform is provided based on a digital certificates attached thereto. Fast database searching and identification of a person at the computing platform are provided based on the digital certificate which is used to point to a database partition having stored biometric images and an obtained biometric image, such as an iris template, which is compared to the stored biometric images in order to identify the person. Access to the database containing stored biometric images may be granted based on the results of the digital certificate authentication process. The use of digital certificates narrows the database search to only those individuals who have authorized access to a particular computing platform by using the digital certificates. The inclusion of the iris template allows for the reliable identification of an individual at the computing platform using digital certificates both as the secure transport method and as the means to ensure the privacy of the individual and their iris template. A level of access and other entitlements to use the computing platform may also be granted to the person based on the results of the identification process.

Claims

1. A system for biometric database searching for identification of a person at a computing platform comprising:

a database having a plurality of stored biometric images, said database being separated into a plurality of partitions;

a plurality of computing platforms coupled to said database;

a digital certificate attached to each of said plurality of computing platforms and stored in said database to point to an associated one of said partitions;

a biometric imager disposed at each of said plurality of computing platforms for obtaining a biometric image of said person; and

a template comprising said digital certificate and said obtained biometric image, wherein an authentication of said computing platform and an identification of said person is based on a said template.

2. The system of claim 1 further comprising a certifying authority and identity server having a processor for authenticating said computing platform based on said digital certificate attached thereto and for identifying said person based on a comparison of said obtained biometric image to said plurality of said stored biometric images within said database partition pointed to by said digital certificate.

3. The system of claim 2 wherein said certifying authority is disposed between said computing platform and said database, wherein said certifying authority assigns each of said digital certificates to said computing platforms and controls access to said database based on a comparison of said digital certificate of said template to said stored digital certificates.

4. The system of claim 1 wherein said template comprises at least two digital fields.

5. The system of claim 4 wherein said at least two digital fields comprises one digital field including information relating to said digital certificate and one digital field including information relating to said biometric image.

6. The system of claim 1 wherein said template further comprises a third digital field, said third digital field including information relating to one of a person'"'"'s identification, a computing platform authentication, a level of access, entitlements.

7. The system of claim 1 wherein said computing platform to said certifying authority authentication is accomplished using one of X.9 and X.509 technologies.

8. The system of claim 1 wherein said digital certificate further comprises a logical element and a functional element, one of which contains said obtained iris image imbedded or attached to said digital certificate.

9. The system of claim 1 wherein said plurality of computing platforms comprises two or more computing platforms that have one of a common and a related digital certificate attached thereto.

10. The system of claim 1 wherein said database is separated into said partitions based on at least one of:

said persons whose biometric image is enrolled;

said biometric traits that are enrolled;

one or more level of accesses said person is entitled to;

one or more entitlements to use said computing platform;

a geographical location of said computing platform; and

a function of said computing platform.

11. The system of claim 10 wherein said digital certificate contains a pointer to one or more partitions thereby narrowing a database search to said partition designated by said pointer and those persons who are authorized to access said computing platform.

12. The system of claim 1 wherein said database is a central database containing all biometric images associated with a particular identification application.

13. The system of claim 1 further comprising at least one communications device for communicating at least one of said digital certificate, said biometric image, and other identification information between said computing platform and said certifying authority.

14. The system of claim 13 wherein said at least one communications device further comprises a transmitter/receiver device disposed at said computing platform, a transmitter/receiver device disposed at said certifying authority, and one of a wired and wireless connection connecting said transmitter/receiver devices together.

15. The system of claim 1 further comprising an activation device for commencing said person identification and said computing platform authentication process.

16. The system of claim 1 further comprising a feedback mechanism coupled between said certifying authority and said computing platform for authorizing a level of access to said person to use said computing platform.

17. The system of claim 1 wherein each of said computing platforms further comprises:

an input device;

a memory for storing said digital certificate;

a processor coupled to said imager and said memory for forming a template containing information regarding said digital certificate and said biometric image; and

an output device adapted for transmitting said biometric template from said computing platform to said network.

18. The system of claim 17 wherein said processor further comprises one or more of private and public keys for encrypting said biometric template and said digital certificate template for security of transmission.

19. The system of claim 1 wherein said imager for obtaining a biometric image obtains an image of an iris of an eye, said imager comprising:

an iris acquisition device having a front surface;

a lens having an image plane disposed in front of said front surface of said iris acquisition device;

a mirror disposed on a side of said lens opposite said iris acquisition device; and

an illuminator disposed along a side of said mirror.

20. The system of claim 19 wherein said iris acquisition device comprises a camera, and said mirror is a cold mirror.

21. The system of claim 1 wherein said system is automatically and dynamically reconfigurable.

22. The system of claim 1 wherein said system is scalable to allow computing platforms to be added or removed and database partitions to be created or terminated.

23. A system for identification of a person at a remote computing platform and for authorizing said person a level of access to use said computing platform comprising:

a plurality of computing platforms, each computing platform comprising;

an input device for receiving input from said person;

a biometric imaging device for obtaining a biometric image of said person;

a display device for displaying one or more of said person input and said obtained biometric image;

a processor for forming a template containing information regarding said computing platform and said obtained biometric image;

a first communications device adapted for transmitting said template from said computing platform;

a digital certificate attached to each of said computing platforms;

a certifying authority coupled to each of said plurality of computing platforms, said certifying authority comprising;

a second communications device capable of communicating with said first communications device of each of said computing platforms;

a database having a plurality of stored biometric templates and being separated into a plurality of partitions, each partition being keyed to one of said digital certificates attached to each of said plurality of computing platforms;

a second processor for authenticating said computing platform based on said digital certificate and for comparing said obtained biometric image to said plurality of said stored biometric images within said database partition designated by said certificate to identify said person; and

a feedback mechanism coupled between said certifying authority and said computing platform for authorizing a level of access to said person to use said computing platform.

24. The system of claim 23 wherein said imager for obtaining a biometric image obtains an image of an iris of an eye, said imager comprising:

an iris acquisition device having a front surface;

a lens having an image plane disposed in front of said front surface of said iris acquisition device;

a mirror disposed on a side of said lens opposite said iris acquisition device; and

an illuminator disposed along a side of said mirror.

25. The system of claim 23, further comprising:

a first memory for storing at least one template comprising at least one image of an iris of at least one person'"'"'s eye and at least one digital certificate;

a second memory for storing a template of an iris image previously obtained by said iris acquisition device and for storing a template of said digital certificates attached to said computing platforms; and

a comparator for comparing said template of said digital certificate of said second memory with said at least one stored digital certificate template of said first memory to authenticate said computing platform and for comparing said biometric template of said iris image of said second memory with said at least one stored biometric template of said first memory to identify said person.

26. The system according to claim 25, wherein said comparator comprises a processor responsive to an output of said computing platform for comparing said template of said digital certificate and said template of said iris image of said second memory with said stored templates of said first memory.

27. In a system involving a transaction between a computing platform and a certifying authority having a central database, a computer-readable media being provided at one of said computing platform and said controlling authority having computer-executable instructions for performing the following steps:

assigning a digital certificate from said certifying authority, said digital certificate containing information pertaining to said computing platform, and said digital certificate being keyed to a partition in said database;

attaching said assigned digital certificate to said computing platform;

obtaining a biometric image of a user at said computing platform;

processing said attached digital certificate and said obtained biometric image to form a template, said template containing information relating to said digital certificate and said obtained biometric image;

transmitting said template from said computing platform to said certifying authority;

authenticating said computing platform by comparing said digital certificate to a plurality of stored digital certificates stored in said database;

accessing said database based on said step of authenticating;

searching a partition established within said database keyed to said digital certificate;

identifying said user by comparing said obtained biometric image to a plurality of stored biometric images stored in said partition of said database; and

authorizing said user to use said computing platform based on said step of identifying.

28. A method of biometric database searching for identification of a person at a computing platform, said method comprising:

attaching a digital certificate to each of a plurality of computing platforms;

storing a copy of said attached digital certificates with a certifying authority and identity server

initiating a transaction by said person at one of said plurality of computing platforms;

obtaining an image of a biometric trait of said person;

processing said obtained image and said digital certificate to form a template;

communicating said template to a certifying authority and identity server;

providing a database containing a plurality of stored images of persons authorized to use said computing platform and said stored digital certificates;

segregating said database into a plurality of partitions keyed to said digital certificates;

comparing said communicated digital certificate to said stored digital certificates;

authenticating said computing platform based on said comparison of said digital certificates;

searching one or more partitions based on said partitions pointed to by said communicated digital certificate contained in said template;

comparing said obtained biometric image of said template to said stored biometric images in said partition; and

identifying said person based on said comparison of said biometric images.

29. The method of claim 28, wherein said step of identifying said person further comprises authorizing one of a level of access and an entitlement to use said computing platform based on said step of identifying.

30. The method of claim 28 wherein said step of obtaining an image of a biometric trait of said person further comprises obtaining an iris image of said person.

31. The method of claim 30 wherein said step of obtaining an iris image further comprising:

(a) illuminating an iris of said person;

(b) forming an approximately centered image of said iris at an image plane of a camera;

(c) storing said image in a memory;

(d) determining if said image is an image of sufficient quality; and

(e) repeating steps (a) through (d) until said image of sufficient quality is obtained.

32. The method according to claim 28, wherein said communicating said template further comprises transmitting said template via a transmitter/receiver device at said computing platform over one of a wired and wireless connection, and receiving said template via a transmitter/receiver device at said certifying authority.

33. The method according to claim 28, wherein said authorizing further comprises communicating said authorization between said certifying authority and said computing platform using said transmitter/receiver device at said certifying authority, one of said wired and wireless connection, and said transmitter/receiver device at said computing platform.

34. A method of biometric database searching for authentication of an identity of a person to use one or more of a plurality of computing platforms, said method comprising:

(a) storing image information of an iris of at least one person'"'"'s eye in a database that is separated into a plurality of partitions keyed to a digital certificate assigned to each of said plurality of computing platforms;

(b) illuminating an eye of an unidentified person having an iris;

(c) obtaining an image of said iris of said unidentified person;

(d) storing said image in a memory;

(e) determining if said image is an image of sufficient quality for a step (h) of comparing;

(f) repeating steps (b) through (e) until said image of sufficient quality is obtained;

(g) transmitting a template having said digital certificate and said iris image to a certifying authority and identity server;

(h) authenticating said computing platform based on said digital certificate portion of said template;

(i) accessing a partition of said database pointed to by said digital certificate;

(h) comparing said obtained image portion of said template with said stored image information to identify said unidentified person; and

(i) identifying said person based on said step of comparing.

35. The method according to claim 34, further comprising authorizing said person to have one of a level of access and an entitlement to use said computing platform based on said step of identifying.

36. Computer-readable media being resident in one of a computing platform and a controlling authority having computer-executable instructions for performing the method of claim 34.