Biometric authentication system

• US 7,882,363 B2
• Filed: 06/02/2003
• Issued: 02/01/2011
• Est. Priority Date: 05/31/2002
• Status: Expired due to Fees

• Current Assignee: Genkey Netherlands BV
• Original Assignee: Fountain Venture AS
• Inventors: Jones, Aled Wynne, Duffy, Dominic Gavan
• Primary Examiner(s): Korzuch; William R
• Assistant Examiner(s): Wright; Bryan
• Application Number:
  US10/516,174
• Publication Number:
  US 20060075255A1
• Time in Patent Office: 2,801 Days
• Field of Search: 713/186
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06V 40/10 Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
• CPC Class Codes: H04L 2209/20 Manipulating the length of blocks of bits, e.g. padding or block truncation
• CPC Class Codes: H04L 2209/26 Testing cryptographic entity, e.g. testing integrity of encryption key or encryption algorithm
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

There is described an authentication system in which during an enrolment process a distinctive characteristic of a subject being enrolled is measured to generate a reference number representative of the subject. Authentication data is then generated using the reference number, and the authentication data is stored for use in a subsequent verification process. During verification, the representative characteristic of the subject being verified is re-measured to generate a test number representative of the subject being verified and the authentication data during enrolment is retrieved. The authentication system then checks for equality between the test number and the reference number using the retrieved authentication data. If the test number and the reference number are equal, then the authenticity of the subject is verified, otherwise the authenticity is denied.

Claims

1. A method of generating authentication data for authenticating a subject, the method comprising a computer to execute the steps of:

receiving physical data representing a physical characteristic of the subject;

processing the physical data by performing a predetermined processing operation to generate i) a reference number whose value is representative of the subject, and ii) variability correction data for improving the repeatability of the generation of the reference number;

generating identification data comprising at least part of the reference number and at least part of the variability correction data;

encrypting the generated identification data; and

generating authentication data comprising said variability correction data and said encrypted data,

wherein said encrypting step comprises applying a one-way encryption algorithm to said identification data to generate a hash value, and applying a two-way encryption algorithm to encrypt the generated hash value.

2. A method according to claim 1, wherein said encrypting step comprises applying the Secure Hashing Algorithm to generate said hash value.

3. A method according to claim 1, wherein said two-way encryption algorithm applying step comprises encrypting the hash value using the private key of an asymmetric encryption algorithm.

4. A method according to claim 1, further comprising receiving personal data for the subject,

wherein said authentication data generating step comprises generating authentication data comprising said personal data.

5. A method according to claim 1, wherein said processing step comprises:

receiving at least one training set of physical data;

performing a set of measurements on the or each of the at least one training set of physical data to obtain for the or each training set a corresponding set of measurement values;

analysing for at least one of the set of measurement values, the sensitivity of the generated reference number to change in the measurement value, and determining at least one process instruction operable to modify the processing of the measurement value to reduce the sensitivity of the reference number to change in the measurement value; and

generating said variability correction data using the determined processing instructions.

6. A method according to claim 1, wherein said processing step comprises:

receiving at least one training set of physical data;

performing a set of measurements on the or each of the at least one training set of physical data to obtain for the or each training set a corresponding set of measurement values;

generating the reference number using the generated measurement values;

generating error correction data for the generated reference number; and

generating variability correction data using the generated error correction data.

7. A method according to claim 6, wherein the or each set of measurement values is separated into a first subset and a second subset,

wherein said reference number generating step generates the reference number using the or each first subset, and

wherein said variability correction data generating step comprises transforming said error correction data using the or each second subset to generate at least part of the variability correction data.

8. A method of authenticating a subject, the method comprising a computer to execute the steps of:

retrieving authentication data comprising encrypted data indicative of a reference number whose value is representative of a reference subject, and variability correction data relating to the generation of the reference number;

decrypting the encrypted data to generate decrypted data;

receiving physical data associated with a physical characteristic of the subject;

processing the physical data using said variability correction data to generate a test number; and

testing the equality of the reference number and the test number using the retrieved authentication data and the generated test number to determine the authenticity of the test subject,

wherein said testing step comprises generating test identification data using at least part of the test number and at least part of the variability correction data, applying a one-way encryption algorithm to said test identification data to generate a test hash value, and testing the equality of the test hash value and the decrypted data.

9. A method according to claim 8, wherein said testing step comprises applying the Secure Hashing Algorithm to said test identification data to generate the test hash value.

10. A method according to claim 8, wherein said decrypting step comprises decrypting the encrypted data using the public key of an asymmetric encryption algorithm.

11. A method according to claim 8, wherein said authentication data comprises transform data, and

wherein said test identification data generating step comprises transforming said test number, using said transform data, to generate a test identification number, and generating the test identification data using at least part of the test identification number.

12. A method according to claim 8, further comprising the step of receiving personal data for the subject being authenticated,

wherein said test identification data generating step comprises generating test identification data using at least part of said personal data.

13. A method according to claim 8, wherein said testing step comprises comparing said test hash value and said decrypted data.

14. A method according to claim 8, wherein said testing step comprises the steps of:

generating token data; and

applying a mathematical algorithm to the token data using one of said test hash value and said decrypted data as a parameter of the algorithm to generate a first result; and

applying the mathematical algorithm to the token data using the other of said test hash value and said decrypted data as a parameter of the algorithm to generate a second result; and

comparing the first result and the second result.

15. A method according to claim 8, wherein said testing step comprises the steps of:

generating token data; and

applying a first mathematical algorithm to the token data using one of said test hash value and said decrypted data as a parameter of the algorithm to generate a first result; and

applying a second mathematical algorithm, which is the inverse of the first mathematical algorithm, to the token data using the other of said test hash value and said decrypted data as a parameter of the algorithm to generate a second result; and

directly comparing the token data and the second result.

16. A method according to claim 8, wherein the subject is a human being.

17. A method according to claim 16, further comprising a step of measuring a distinctive physical characteristic of the human being to generate said physical data.

18. An apparatus for generating authentication data to authenticate a subject, the apparatus comprising:

a receiver operable to receive physical data representing a physical characteristic of the subject;

a processor operable to perform a predetermined processing operation on the physical data to generate i) a reference number, whose value is representative of the subject, and ii) variability correction data for improving the repeatability of the generation of the reference number;

an identification data generator operable to generate identification data comprising at least part of the reference number and at least part of the variability correction data;

an encrypter operable to encrypt the generated identification data to generate encrypted data;

an authentication data generator operable to generate authentication data comprising said variability correction data and said encrypted data,

wherein said encrypter is operable to apply a one-way encryption algorithm to said identification data to generate a hash value, and to apply a two-way encryption algorithm to encrypt the generated hash value.

19. An apparatus according to claim 18, wherein said encrypter is operable to apply the Secure Hashing Algorithm to said identification data to generate said hash value.

20. An apparatus according to claim 18, wherein said encrypter is operable to encrypt the hash value using the private key of an asymmetric encryption algorithm.

21. An apparatus according to claim 18, further comprising a receiver operable to receive personal data for the subject,

wherein said authentication data generator is operable to generate authentication data comprising said personal data.

22. An apparatus according to claim 18, wherein said processor is operable to:

receive at least one training set of physical data;

perform a set of measurements on the or each of the at least one training set of physical data to obtain for the or each training set a corresponding set of measurement values;

analyse for at least one of the set of measurement values, the sensitivity of the generated reference number to change in the measurement value, and determine at least one process instruction operable to modify the processing of the measurement value to reduce the sensitivity of the reference number to change in the measurement value; and

generate said variability correction data using the determined processing instructions.

23. An apparatus according to claim 18, wherein said processor is operable to:

receive at least one training set of physical data;

perform a set of measurements on the or each of the at least one training set of physical data to obtain for the or each training set a corresponding set of measurement values;

generate the reference number using the generated measurement values;

generate error correction data for the generated reference number; and

generate variability correction data using the generated error correction data.

24. An apparatus according to claim 23, wherein the processor is operable to:

separate the or each set of measurement values into a first subset and a second subset,

to generate the reference number using the or each first subset, and to transform said error correction data using the or each second subset to generate at least part of the variability correction data.

25. An apparatus for authenticating a subject, the apparatus comprising:

a retriever operable to retrieve authentication data comprising encrypted data indicative of a reference number whose value is representative of a reference subject, and variability correction data relating to the generation of the reference number;

a decrypter operable to decrypt the encrypted data to generate decrypted data;

a receiver operable to receive physical data associated with a physical characteristic of the subject;

a processor operable to process the physical data using said variability correction data to generate a test number; and

a tester operable to test the equality of the reference number and the test number using the retrieved authentication data and the generated test number to determine the authenticity of the test subject,

wherein said tester comprises a test identification data generator operable to generate test identification data using at least part of the test number and at least part of the variability correction data and an encrypter operable to apply a one-way encryption algorithm to said test identification data to generate a test hash value, wherein the tester is operable to test the equality of the test hash value and the decrypted data.

26. An apparatus according to claim 25, wherein the encrypter is operable to apply the Secure Hashing Algorithm to the test identification date to generate the test hash value.

27. An apparatus according to claim 25, wherein said decrypter is operable to decrypt the encrypted data using the public key of an asymmetric encryption algorithm.

28. An apparatus according to claim 25, wherein said authentication data comprises transform data, and

wherein said apparatus further comprises a transformer operable to transform said test number, using said transform data, to generate a test identification number, and

wherein said identification data generator is operable to generate test identification data comprising at least part of the test identification number.

29. An apparatus according to claim 25, further comprising a receiver operable to receive personal data for the subject being authenticated,

wherein said identification data generator is operable to generate test identification data using said personal data.

30. An apparatus according to claim 25, wherein said tester is operable to compare said test identification data and said decrypted data.

31. An apparatus according to claim 25, wherein said tester comprises:

a data generator operable to generate token data; and

a mathematical algorithm applier operable to apply a mathematical algorithm to the token data using one of said test identification data and said decrypted data as a parameter of the algorithm to generate a first result, and to apply the mathematical algorithm to the token data using the other of said test identification data and said decrypted data as a parameter of the algorithm to generate a second result; and

a comparator operable to compare the first result and the second result.

32. An apparatus according to claim 25, wherein said tester comprises:

a data generator operable to generate token data; and

a first mathematical algorithm applier operable to apply a first mathematical algorithm to the token data using one of said test identification data and said decrypted data as a parameter of the algorithm to generate a first result; and

a second mathematical algorithm applier operable to apply a second mathematical algorithm, which is the inverse of the first mathematical algorithm, to the token data using the other of said test identification data and said decrypted data as a parameter of the algorithm to generate a second result; and

a comparator operable to compare the token data and the second result.

33. An apparatus according to claim 25, further comprises a biometric data measurer operable to measure a distinctive physical characteristic of a human being to generate said physical data.

34. A storage device storing instructions including instructions for causing a programmable apparatus to perform a method of generating authentication data for authenticating a subject, the method comprising the steps of:

receiving physical data representing a physical characteristic of the subject;

processing the physical data by performing a predetermined processing operation to generate i) a reference number whose value is representative of the subject, and ii) variability correction data for improving the repeatability of the generation of the reference number;

generating identification data comprising at least part of the reference number and at least part of the variability correction data;

encrypting the generated identification data; and

generating authentication data comprising said variability correction data and said encrypted data,

wherein said encrypting step comprises applying a one-way encryption algorithm to said identification data to generate a hash value, and applying a two-way encryption algorithm to encrypt the generated hash value.

35. A storage device storing instructions including instructions for causing a programmable apparatus to perform a method of authenticating a subject, the method comprising the steps of:

retrieving authentication data comprising encrypted data indicative of a reference number whose value is representative of a reference subject, and variability correction data relating to the generation of the reference number;

decrypting the encrypted data to generate decrypted data;

receiving physical data associated with a physical characteristic of the subject;

processing the physical data using said variability correction data to generate a test number; and

testing the equality of the reference number and the test number using the retrieved authentication data and the generated test number to determine the authenticity of the test subject,

wherein said testing step comprises generating test identification data using at least part of the test number and at least part of the variability correction data, applying a one-way encryption algorithm to said test identification data to generate a test hash value, and testing the equality of the test hash value and the decrypted data.