Secure biometric verification of identity

• US 7,278,025 B2
• Filed: 09/10/2003
• Issued: 10/02/2007
• Est. Priority Date: 09/10/2002
• Status: Expired due to Fees

• Current Assignee: IVI Holdings Limited
• Original Assignee: IVI Smart Technologies Incorporated
• Inventors: Aida, Takashi, Drizin, Wayne, Saito, Tamio
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Hoffman; Brandon S
• Application Number:
  US10/659,834
• Publication Number:
  US 20040129787A1
• Time in Patent Office: 1,483 Days
• Field of Search: 713/202
• US Class Current: 713/185
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06K 19/07 with integrated circuit chips
• CPC Class Codes: G06K 19/07354 by biometrically sensitive means, e.g. fingerprint sensitive fingerprint sensors in general G06V40/12; biometrically activated access control G07C9/25
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/26 using a biometric sensor integrated in the pass
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A high security identification card includes an on-board memory for stored biometric data and an on-board sensor for capturing live biometric data. An on-board processor on the card performs a matching operation to verify that the captured biometric data matches the locally stored biometric data. Only if there is a positive match is any data transmitted from the card for additional verification and/or further processing. Preferably, the card is ISO SmartCard compatible. In one embodiment, the ISO SmartCard functions as a firewall for protecting the security processor used for storing and processing the protected biometric data from malicious external attack via the ISO SmartCard interface. In another embodiment, the security processor is inserted between the ISO SmartCard Interface and an unmodified ISO SmartCard processor and blocks any external communications until the user'"'"'s fingerprint has been matched with a previously registered fingerprint. Real-time feedback is provided while the user is manipulating his finger over the fingerprint sensor, thereby facilitating an optimal placement of the finger over the sensor. The card may be used to enable communication with a transactional network or to obtain physical access into a secure area.

Claims

1. An intelligent identification card comprising:

an on-board sensor for capturing live biometric data;

a first on-board processor coupled with said on-board sensor, said first on-board processor including a memory storing reference data, said first on-board processor comparing the captured biometric data with corresponding stored reference data within a predetermined threshold and generating a verification message only if there is a match within a predetermined threshold;

a second on-board processor coupled with said first on-board processor, for executing intelligent card functions, the verification message enabling said second on-board processor; and

an interface coupled to either one of said first on-board processor and said second on-board processor, for communicating with an external network.

2. The identification card of claim 1, wherein said second on-board processor is an ISO SmartCard processor.

3. The identification card of claim 2, wherein the first on-board processor is functionally separated from the ISO SmartCard processor by a firewall.

4. The identification card of claim 2, wherein all external data to and from the first on-board processor passes through the ISO SmartCard processor.

5. The identification card of claim 2, wherein all external data to and from the ISO SmartCard processor passes through the first on-board processor.

6. The identification card of claim 5, wherein the first on-board processor has a first connection used for loading data during a loading process and a second connection connected to an external network.

7. The identification card of claim 1, further comprising:

an on-board location detector for determining current location of the identification card; and

means for restricting use of the card based on the detected location.

8. The identification card of claim 7, wherein said on-board location detector includes:

a Global Positioning Satellite (GPS) signal receiver.

9. The intelligent identification card of claim 1, further comprising:

an indicator for providing real-time feedback for finger placement while the user is manipulating his or her finger over the fingerprint sensor, thereby facilitating an adequate placement of the finger over the sensor.

10. The identification card of claim 1, wherein said interface includes at least one of:

a wireless interface coupled to said second on-board processor; and

a wired electrical interface coupled to said second on-board processor.

11. The identification card of claim 10, wherein said wireless interface is an ISO compatible antenna providing both data and power transmissions.

12. The identification card of claim 10, wherein said interface further includes:

a security antenna coupled to said first on-board processor via a power circuit, said security antenna only providing power to said first on-board processor.

13. The identification card of claim 12, wherein said security antenna also provides power to said on-board sensor via the power circuit.

14. A method for identifying a user of an intelligent identification card, the intelligent identification card including an on-board memory storing reference data, an on-board biometric sensor, a security processor, and an ISO card processor, said method comprising:

capturing live biometric data using the on-board sensor;

comparing, using the security processor, the captured biometric data with corresponding reference data stored in the on-board memory within a predetermined threshold;

generating, using the security processor, a verification message only if there is a match within the predetermined threshold, the verification message enabling the ISO card processor; and

allowing operation of the ISO card processor if the identity of the user is verified.

15. The method of claim 14, further comprising:

loading data onto the security processor via a first connection during a loading process; and

permanently disabling the first connection after the loading process has been completed.

16. The method of claim 14, wherein all external data to and from the ISO card processor passes through a second connection of the security processor.

17. The method of claim 14, wherein all external data to and from the security processor passes through the ISO card processor.

18. The method of claim 14, wherein the biometric data includes fingerprint data and the sensor is a fingerprint sensor which captures data from a user'"'"'s finger placed on the sensor.

19. The method of claim 18, further comprising:

providing real-time feedback for finger placement while the user is manipulating his or her finger over the fingerprint sensor, thereby facilitating an adequate placement of the finger over the sensor.

20. The method of claim 14, wherein the matching process utilizes a hybrid matching algorithm that takes into account both minutiae and overall spatial relationships in the captured biometric data.

21. The method of claim 14, further comprising:

providing real-time feedback for finger placement while the user is manipulating his or her finger over the fingerprint sensor, thereby facilitating an adequate placement of the finger over the sensor.

22. The method of claim 14, wherein said communicating the verification message includes at least one of:

communicating via a wireless interface coupled to the ISO card processor; and

communicating via a wired electrical interface coupled to the ISO card processor.

23. The method of claim 22, wherein said wireless interface is an ISO compatible antenna providing both data and power transmissions.

24. The method of claim 22, further comprising:

providing power to the security processor via a security antenna and a power circuit coupled to the security processor, the security antenna and the power circuit being provided on the card.

25. The method of claim 24, further comprising:

providing power to the on-board biometric sensor via the security antenna and the power circuit.

26. An apparatus for identifying a user of an intelligent identification card, the intelligent identification card including an on-board memory storing reference data, an on-board biometric sensor, a security processor, and an ISO card processor, said apparatus comprising:

means for capturing live biometric data using the on-board sensor;

means for comparing, using the security processor, the captured biometric data with corresponding reference data stored in the on-board memory within a predetermined threshold;

means for generating, using the security processor, a verification message only if there is a match within the predetermined threshold, the verification message enabling the ISO card processor;

and

means for allowing operation of the ISO card processor if the identity of the user is verified.

27. The apparatus of claim 26, further comprising:

means for providing real-time feedback for finger placement while the user is manipulating his or her finger over the fingerprint sensor, thereby facilitating an adequate placement of the finger over the sensor.