Match template protection within biometric security systems

• US 7,454,624 B2
• Filed: 05/14/2003
• Issued: 11/18/2008
• Est. Priority Date: 05/15/2002
• Status: Active Grant

• Current Assignee: Bio-Key International Incorporated
• Original Assignee: Bio-Key International Incorporated
• Inventors: LaCous, Mira Kristina
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Gee; Jason K
• Application Number:
  US10/438,161
• Publication Number:
  US 20030217276A1
• Time in Patent Office: 2,015 Days
• Field of Search: 713/186
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition

Abstract

Biometric security systems are disclosed wherein a match template is unique as compared to a corresponding authentication model generated during enrollment and/or attempts at authentication. In accordance with one embodiment, the uniqueness of the match template as compared to a corresponding biometric authentication model is complete and non-reversible. Accordingly, the data in the match template cannot be directly utilized to produce an authentication model. Accordingly, match templates stored in a database need only be protected to assure that they are not substituted, altered or supplemented. Replication of match template data is not of paramount concern, as it cannot be used for a direct authentication.

Claims

1. A method for performing user authentication in the context of a biometric security system, the method comprising:

obtaining a first collection of biometric data based on a first biometric source;

applying a transform function to the first collection of biometric data to generate a match template;

receiving from a biometric data collector a second collection of biometric data based on the first biometric source;

generating an authentication model based on the second collection of biometric data, the authentication model being different than the match template, wherein the process utilized to generate the authentication model is distinct from the processing associated with applying the transform function such that the representation of biometric data associated with the authentication model will be different than the representation of biometric data associated with the match template even if the first and second collections of biometric data were identical;

comparing the authentication model to the match template, wherein comparing comprises evaluating the relationship between the authentication model and the match template without directly comparing one to the other, and wherein comparing comprises comparing the authentication model to a set of database keys that describe a plurality of match template characteristics; and

granting or denying an access right based on the result of the comparison of the authentication model to the match template.

2. The method of claim 1, wherein applying the transform function to generate the match template further comprises applying the transform function to generate the match template as a non-reversible derivation of the first collection of biometric data.

3. The method of claim 1, wherein the transform function is an entity-specific transform function.

4. The method of claim 1, wherein comparing comprises comparing without applying the transform function to the authentication model.

5. The method of claim 1 wherein granting or denying an access right is based upon a similarity of the authentication model to the set of database keys and wherein a level of similarity is adjustable.

6. A method of providing security in the context of a biometric security system, the method comprising:

obtaining a first data representation of a first collection of biometric information;

obtaining a second data representation of a second collection of biometric information;

applying an entity specific transform function to the first and second data representations to produce an entity specific match template, wherein data from both the first and second data representations are used to produce the entity specific match template;

obtaining a third data representation of a third collection of biometric information;

generating an authentication model based on the third data representation;

comparing the authentication model to the entity specific match template to determine whether they are sufficiently related to be deemed matching, wherein comparing comprises comparing without applying the entity specific transform function to the authentication model; and

granting at least one access right if they are sufficiently related to be deemed matching.

7. The method of claim 6, wherein granting at least one access right comprises granting access in association with a physical access point.

8. The method of claim 6, wherein granting at least one access right comprises granting access in association with an electronic access point.

9. The method of claim 6, wherein the processing steps utilized to generate the authentication model are different than the processing steps associated with applying the entity specific transform function.

10. The method of claim 6, wherein comparing comprises evaluating the relationship between the authentication model and the entity specific match template without comparing one to the other.

11. The method of claim 6 wherein the size of the entity specific match template is larger than the size of the authentication model.

12. The method of claim 6 wherein the entity specific match template includes more data than the authentication model.

13. The method of claim 6 wherein the first and second collections of biometric information are collected close in time to one another.

14. The method of claim 6 wherein the first and second collections of biometric information are collected over a period of time.

15. The method of claim 6 and further comprising deleting the first and second data representations.

16. The method of claim 15 wherein the first and second data representations are deleted before the third data representation is obtained.

17. A method for performing user authentication in the context of a biometric security system that simultaneously monitors a plurality of access points, the method comprising:

obtaining a first collection of biometric data based on a first biometric source;

applying a transform function to the first collection of biometric data to generate a match template, wherein the match template is a non-reversible derivation of the first collection of biometric data;

deleting the first collection of biometric data;

storing an indication of access rights in correspondence to the match template;

receiving from a biometric data collector a second collection of biometric data based on the first biometric source;

generating an authentication model based on the second collection of biometric data, the authentication model being different than the match template, wherein the process utilized to generate the authentication model is distinct from the processing associated with applying the transform function such that the representation of biometric data associated with the authentication model will be different than the representation of biometric data associated with the match template even if the first and second collections of biometric data were identical;

comparing the authentication model to the match template, wherein comparing comprises evaluating the relationship between the authentication model and the match template;

comparing the indication of access rights to a required access right of at least one of the plurality of access points; and

granting or denying an access right based on the result of the comparison of the authentication model to the match template and based on the result of the comparison of the indication of access rights and the required access right.