Personal identification system

• US 6,484,260 B1
• Filed: 04/24/1998
• Issued: 11/19/2002
• Est. Priority Date: 04/24/1998
• Status: Expired due to Fees

• Current Assignee: Identix, Inc. (Advent International Corporation)
• Original Assignee: Identix, Inc. (Advent International Corporation)
• Inventors: Scott, John D., Curtis, Terence Patrick
• Primary Examiner(s): Hayes, Gail
• Application Number:
  US09/066,643
• Time in Patent Office: 1,670 Days
• Field of Search: 380/23, 380/24, 382/124, 382/125, 382/126, 382/127, 382/115, 382/116, 382/313, 356/71, 340/825.34, 713/202, 713/182, 713/183, 713/184, 713/185, 713/186
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07C 2009/00769 with data transmission performed by wireless means
• CPC Class Codes: G07C 9/00563 using personal physical data of the operator, e.g. finger prints, retinal images, voicepatterns
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A portable, hand-held personal identification device for providing secure access to a host facility includes a biometric sensor system capable of sensing a biometric trait of a user that is unique to the user and providing a biometric signal indicative of the sensed biometric trait. A processing unit responsive to the biometric signal is adapted to compare the biometric signal with stored biometric data representative of the biometric trait of an enrolled person that is unique to the enrolled person, and to provide a verification signal only if the biometric signal corresponds sufficiently to the biometric data to verify that the user is the enrolled person. The verification signal includes information indicative of the enrolled person or the device. A communication unit, including a transmitting circuit, is adapted to transmit the verification signal to a host system.

Claims

1. A method of providing secure access to a host facility, comprising:

registering one or more persons with the host facility, including storing a unique ID code and a public encryption key for each registered person;

receiving a first transmission comprising a first user signal at the host facility;

generating and then transmitting a random number signal only if the first user signal represents one of the stored ID codes;

receiving a second transmission comprising a second user signal at the host facility;

decrypting the second user signal with the public encryption key associated with the registered person who is also associated with the stored ID code represented by the first user signal; and

providing access to the host facility only if the decrypted second user signal represents the random number.

2. A method of providing access to a secure host facility only to registered persons, comprising:

registering one or more registered persons with the host system, wherein registering each registered person includes storing an ID code associated only with a portable hand-held device under the control of that registered person;

transmitting an ID code signal from a portable hand-held device to a facility of the host system, wherein the ID code signal represents an ID code associated with the transmitting device;

generating, at the host facility, a random number signal representing a random number in response to the ID code signal only if the ID code signal is representative of the ID code of the device controlled by one of the registered persons;

retrieving, with the host system, a public key associated with the one of the registered persons only if the ID code signal is representative of the ID code of the one the device controlled by the one of the registered persons;

transmitting the random number signal from the host facility to the transmitting device;

receiving the random number signal with the transmitting device;

generating a user fingerprint signal representing a fingerprint image of a user'"'"'s finger being placed on a platen of the transmitting device;

comparing, with the transmitting device, the user fingerprint signal to a fingerprint template stored in the transmitting device, the fingerprint template representing a fingerprint image of a person who is enrolled with the transmitting device;

encrypting the random number signal with the transmitting device, the random number signal being encrypted according to an encryption algorithm employing a private key associated only with the transmitting device;

transmitting the encrypted random number signal from the transmitting device to the host facility only if the fingerprint image represented by the user fingerprint signal corresponds sufficiently to the fingerprint image represented by the fingerprint template to verify that the user is the enrolled person;

decrypting the encrypted random number signal with the host system, including employing the retrieved public key; and

providing the user access to the host facility only if the decrypted encrypted random number signal represents the random number.

3. The method of claim 2, wherein retrieving the public key includes retrieving the public key from a trusted third party.

4. The method of claim 2, wherein transmitting the ID code signal, transmitting the random number signal, and transmitting the encrypted random number signal each includes transmitting via a wireless transmission.

5. The method of claim 2, wherein transmitting the ID code signal, transmitting the random number signal, and transmitting the encrypted random number signal each includes transmitting via at least one of a modem, a cable access TV line, and a computer communication medium.

6. A method of providing a secure function at a host facility only to a registered person, comprising:

registering a person with the host facility by storing an ID code associated only with a portable registered device controlled by the registered person, learning a synchronization counter of the registered device, storing an encryption key associated with the registered device and associating the encryption key of the registered device with the stored ID code;

generating a user fingerprint signal representing a fingerprint image of a user'"'"'s finger being placed on a platen of a portable user device;

comparing, with the user device, the user fingerprint signal to a fingerprint template stored in the user device, the fingerprint template representing a fingerprint image of an enrolled person who is enrolled with the user device;

generating an access signal with the user device only if the fingerprint image represented by the user fingerprint signal corresponds sufficiently to the fingerprint image represented by the fingerprint template to verify that the user is the enrolled person, the access signal comprising an ID code associated only with the user device, button press information representing a requested function, and encrypted data encrypted with an encryption key associated with the user device, the encrypted data including a synchronization counter associated with the user device;

transmitting the access signal from the user device to the host facility;

determining, with the host facility, if the ID code in the access signal matches the stored ID code;

retrieving the encryption key of the registered device if the match is successful;

employing the encryption key of the registered device to decrypt the encrypted data and determine the synchronization counter of the user device;

comparing the synchronization counter of the user device with the synchronization counter of the registered device; and

providing the requested function represented by the button press data only if the synchronization counter of the user device matches the synchronization counter of the registered device.

7. A method of providing secure access to a host facility, comprising:

registering one or more persons with the host facility, including storing a unique ID code and a public encryption key for each registered person;

receiving a first wireless transmission comprising a first user signal at the host facility from a portable hand-held device under the control of a registered person;

generating and then wirelessly transmitting a random number signal only if the first user signal represents one of the stored ID codes;

receiving a second wireless transmission comprising a second user signal at the host facility from the portable hand-held device;

decrypting the second user signal with the public encryption key associated with the registered person who is also associated with the stored ID code represented by the first user signal; and

providing access to the host facility only if the decrypted second user signal represents the random number.

8. A portable, hand-held personal identification device for providing secure access to a host facility, comprising:

a biometric sensor system capable of sensing a biometric trait of a user that is unique to the user and providing a biometric signal indicative thereof;

a processing unit responsive to the biometric signal, being adapted to compare the biometric signal with stored biometric data representative of the biometric trait of an enrolled person that is indicative of the identity of the enrolled person, and to provide a verification signal; and

a communication unit, including a transmitter circuit, adapted to transmit the verification signal to a remote host system;

wherein the processing unit includes a processor circuit, a memory and an encoder, wherein the memory stores the biometric data, and wherein the verification signal includes an encrypted signal encrypted by the encoder;

wherein the encoder comprises an encryption algorithm, and wherein the encryption algorithm employs a private key indicative of the enrolled person or the device; and

wherein the communication unit further includes a receiver circuit, wherein the memory further stores an ID code indicative of the enrolled person or the device, wherein the processing unit is further adapted to first cause the transmitter circuit to transmit an ID code signal indicative of the ID code to the remote host system, wherein the receiver circuit is adapted to receive a host response signal which is transmitted by the remote host system only if the ID code signal matches an ID code stored at the remote host system, and wherein the processor unit employs the encryption algorithm and the private key to encrypt the host response signal to create the verification signal, and causes the transmitter circuit to transmit the verification signal to the remote host system only if the biometric signal corresponds sufficiently to the biometric data to verify that the user is the enrolled person.

9. The personal identification device of claim 8, wherein the biometric sensor system includes a fingerprint sensor.

10. The personal identification device of claim 9, wherein the fingerprint sensor includes a platen adapted for placing a finger thereon.

11. The personal identification device of claim 10, wherein the fingerprint sensor further includes an optical image sensor.

12. The personal identification device of claim 8, wherein the biometric sensor system includes an optical image sensor.

13. The personal identification device of claim 12, wherein the optical image sensor comprises a CMOS chip.

14. The personal identification device of claim 8, wherein the encoder comprises an encoding circuit, and wherein the verification signal further comprises an ID code indicative of the enrolled person or the device.

15. The personal identification device of claim 8, wherein the memory is located in a removable plug-in module, the personal identification device further comprising a socket adapted to receive the module.

16. The personal identification device of claim 8, wherein the communication unit further includes a receiving circuit being adapted to receive a host response signal from the host system.

17. The personal identification device of claim 8, wherein the communication unit is adapted for remote communication with the host system via a wireless communication medium.

18. The personal identification device of claim 8, further comprising a display.

19. The personal identification device of claim 18, further comprising a keypad.

20. A portable, hand-held personal identification device for providing secure access to a host facility, comprising:

a biometric sensor system capable of sensing a biometric trait of a user that is unique to the user and providing a biometric signal indicative thereof;

a processing unit responsive to the biometric signal, being adapted to compare the biometric signal with stored biometric data representative of the biometric trait of an enrolled person that is indicative of the identity of the enrolled person, and to provide a verification signal only if the biometric signal corresponds sufficiently to the biometric data to verify that the user is the enrolled person; and

a communication unit, including a transmitter circuit, adapted to transmit the verification signal to a remote host system;

wherein the biometric sensor system includes a fingerprint sensor and wherein the biometric trait is a fingerprint;

wherein the communication unit further includes a receiver circuit adapted to receive a signal transmitted by the remote host system;

wherein the processing unit includes memory to store an ID code associated only with the device, a personal encryption key associated only with the device, and the biometric data;

wherein the processing unit is further adapted to first cause the transmitter circuit to transmit an ID code signal indicative of the ID code to the host system, wherein the receiver circuit is adapted to receive a host response signal which is transmitted by the remote host system only if the ID code signal matches an ID code stored at the remote host system, and to employ the encryption algorithm and the private encryption key to create the verification signal by encrypting the host response signal.

21. The personal identification device of claim 20, wherein the memory is located in a removable plug-in module, the personal identification device further comprising a socket adapted to receive the module.

22. A portable, hand-held personal identification device for providing secure access to a host facility, comprising:

a housing;

a fingerprint sensor system capable of sensing a fingerprint of a user and providing a fingerprint signal indicative thereof, the fingerprint sensor system including a platen on a surface of the housing adapted to receive a finger;

a communication unit in the housing being adapted for wireless communication with a separate host system, including a transmitting circuit and a receiving circuit;

a processing circuit; and

a slot in the housing for receiving a smart card that includes a memory;

wherein the memory in the smart card stores a fingerprint template representative of the fingerprint of an enrolled person, and an ID code and a personal encryption key being associated with the device, wherein the processing circuit is adapted to cause an ID code signal indicative of the ID code from memory to be transmitted by the transmitting circuit, and wherein the processing circuit is further adapted to cause a host response signal received by the receiving circuit, and which is only transmitted if the ID code signal matches an ID code stored at the host system, to be encrypted according to an encryption algorithm employing the personal encryption key and to cause the encrypted host response signal to be transmitted by the transmitting circuit only if the fingerprint signal corresponds sufficiently to the fingerprint template to verify that the user is an enrolled person.

23. The personal identification device of claim 22, further comprising an alphanumeric display.

24. The personal identification device of claim 23, further comprising a keypad for inputting data.

25. A portable, hand-held personal identification device for providing secure access to a host facility, comprising:

a biometric sensor system capable of sensing a biometric trait of a user that is unique to the user and providing a biometric signal indicative of the biometric trait;

a processing unit responsive to the biometric signal, being adapted to compare the biometric signal with stored biometric data representative of the biometric trait of an enrolled person that is indicative of the identity of the enrolled person, and to provide a verification signal only if the biometric signal corresponds sufficiently to the biometric data to verify that the user is the enrolled person; and

a communication unit, including a transmitter circuit, adapted to transmit the verification signal and an ID code signal to a remote host system associated with the host facility, wherein the ID code signal is indicative of an ID code associated only with the portable device, and wherein the host system provides access to the host facility in response to the verification signal only if host system determines that the personal device associated with the ID code belongs to a registered person.

26. A method of accessing a secure host facility, comprising:

sensing a biometric trait of a user that is unique to the user with a biometric sensor system of a portable device, and providing a biometric signal indicative of the biometric trait;

comparing, with the portable device, the biometric signal with stored biometric data representative of the biometric trait of an enrolled person that is indicative of the identity of the enrolled person;

providing a verification signal only if the biometric signal corresponds sufficiently to the biometric data to verify that the user is the enrolled person;

encrypting the verification signal;

wirelessly transmitting the encrypted verification signal and an ID code signal to a remote host system associated with the host facility, wherein the ID code signal is indicative of an ID code associated only with the portable device;

decrypting the encrypted verification signal only if the personal device associated with the ID code belongs to a registered person; and

providing access to their host facility only if certain verification information in the decrypted verification signal matches information stored at the host system.

27. A portable, hand-held personal identification device for providing secure access to a host facility, comprising:

a biometric sensor system capable of sensing a biometric trait of a user that is unique to the user and providing a biometric signal indicative of the biometric trait;

a processing unit responsive to the biometric signal, being adapted to compare the biometric signal with stored biometric data representative of the biometric trait of an enrolled person that is indicative of the identity of the enrolled person, and to provide an encrypted verification signal only if the biometric signal corresponds sufficiently to the biometric data to verify that the user is the enrolled person; and

a communication unit, including a transmitter circuit, adapted to wirelessly transmit the encrypted verification signal and an ID code signal to a remote host system associated with the host facility, wherein the ID code signal is indicative of an ID code associated only with the portable hand-held device, and wherein the host system decrypts the encrypted verification signal only if the host system determines that the portable hand-held device associated with the ID code belongs to a registered person and provides access to the host facility only if certain verification information in the decrypted verification signal matches verification information stored at the host system.