Apparatus and method for securely processing biometric information to control access to a node

[0002] The named inventor of the present application has filed a number of co-pending United States patents and patent applications including U.S. Pat. No. 5,751,809 entitled “Apparatus and Method for Securing Captured Data Transmitted Between Two Sources” and U.S. patent application Ser. No. 08/678,360 entitled “A System and Method for Digitally Signing a Digital Agreement Between Remotely Located Notes.”

[0003] 1. Field of the Invention

[0004] The present invention relates to the field of data security. More particularly, the present invention relates to a biometric processor which locally processes biometric information to authenticate an individual before permitting access to a node.

[0005] 2. Description of Art Related to the Invention

[0006] With more and more businesses utilizing personal computers (“PCs”), the importance of data security has increased dramatically. For a data security system to be highly reliable, it must preserve the “integrity” of data transmitted between two PCs as well as control access to one or both of the PCs. One way of controlling access to a PC is by implementing access control systems that utilize biometric devices and operate in accordance with user authentication or user identification techniques (hereinafter referred to separately as “user authentication biometric systems” and “user identification biometric systems”, or collectively as “biometric systems”).

[0007] Currently, there exist many biometric devices that can digitally scan a characteristic of the user (e.g., finger print, iris, retina, facial and hand geometries, etc.) and capture one or more frames of digital data corresponding to that characteristic. The one or more frames of digital data are collectively referred to as a “data clip”. Normally, for a user authentication biometric system, its biometric device captures a data clip and transmits the data clip to a computer operating as a database through a signal line in a non-encrypted format. The computer processes the data clip, searches for pre-stored “master” characteristics of the individual requesting access to the node who has previously identified oneself through voice, data input and other input means, compares the data clip to the pre-stored master characteristics, and grants access to a node or an area if certain features of the data clip match those of the pre-stored master characteristics contained in the computer. Otherwise, access is denied. Additionally, the data clip may be stored as an additional security measure.

[0008] The user identification biometric systems normally operate in a manner similar to user authentication biometric systems, but are more computationally intensive. The reason is that user identification biometric systems do not rely on any prior identification information by the user to ascertain the user's pre-stored master characteristics for comparison purposes. Instead, the data clip captured by the biometric device is successively compared with each pre-stored characteristics until a match is detected or all of the pre-stored characteristics have been compared to the data clip.

[0009] Currently, both biometric systems suffer from a number of disadvantages. One disadvantage is that, in general, a captured data clip transmitted from a biometric device is susceptible to fraudulent alteration if the biometric device is not physically connected to the electronic device processing and/or storing the captured data clip. The reason is that the signal line, situated between a biometric device and the electronic device responsible for the processing the data clip, is publicly accessible. This allows interlopers an opportunity for the captured data clip to be substituted with (i) prior recorded data, (ii) data transferred in real-time from another location or (iii) data combined with non-existent images or characteristics. Assuming that both the biometric device and the associated processing device are themselves physically protected from being tampered with, a solution to this problem is to apply standard cryptographic techniques to the communications between these devices. These techniques may range from creation of a “secure path” where all communications are encrypted to simple authentication of message authenticity where digital signatures or authentication codes are applied to specific messages. Typically, some type of challenge/response methodology will be used to facilitate mutual authentication of the equipment involved.

[0010] Another disadvantage is that this functional partitioning of the system requires all captured biometric data to be transmitted over the signal line to the corresponding processing device, potentially creating high static bandwidth requirements for that communication line. For example, a remotely located video camera used for biometric authentication is typically continuously capturing and transmitting data clips (video images) over the dedicated signal line back to a computer operating as a centralized authentication processing center. Obviously, if a bad data clip is captured (e.g. one with bad image quality) is captured, there is no mechanism to preclude that data clip from being processed because conventional biometric devices merely act as a conduit in transferring information to the computer regardless of its quality. As a result, processing time of the computer and bandwidth associated with the signal line are wasted because user authentication or identification is virtually guaranteed to fail when processing a bad data clip.

[0011] Therefore, it would be advantageous to develop a biometric system that overcomes the second disadvantage discussed above by localizing the processing of the data clip within the biometric device itself via a biometric processor. This localized processing, if desired, could extend to provide full identification or authentication functions without requiring an additional task being executed by a host processor of the system.

[0012] Based on the foregoing, it is apparent that there exists a need for a biometric device that regulates access to a node or restricted area. The biometric device comprises a biometric processor including a data capture circuit that captures data associated with a predetermined biometric characteristic and a processing unit that processes the captured data before transmitting information through a cryptographic circuit to the node to control access thereto.

[0013] The features and advantages of the present invention will become apparent from the following detailed description of the present invention in which:

[0014] FIG. 1 is an illustrative block diagram of a biometric system regulating access to a computer system through a secure biometric device.

[0015] FIG. 2 is a block diagram of an embodiment of the biometric processor of FIG. 1.

[0016] FIG. 3 is an illustrative flowchart of the operations of the access control circuitry employed in the node of FIG. 1 in order to control access to that node.

[0017] FIG. 4 is an illustrative flowchart of the operations of the biometric device implemented with the biometric processor of FIG. 2 to control access to a node.

[0018] FIG. 5 is an illustrative perspective view of another embodiment of the present invention.

[0019] The present invention relates to a biometric processor that locally processes biometric information to authenticate an individual before allowing him or her access to a node as well as its corresponding method of operation. In the following description, some terminology is used to discuss certain well-known cryptographic functions. For example, a “data clip” is information digitized into binary data acquired for user authentication or identification. A “message” is digital information transmitted from a source to a destination. A “key” is an encoding and/or decoding parameter used by conventional cryptographic algorithms such as Rivest, Shamir and Adleman (“RSA”), Data Encryption Algorithm (“DEA”) as specified in Data Encryption Standard (“DES”) and the like. A “certificate” is defined as any digital information (typically a public key) associated with an entity, encrypted by a private key held by another entity such as a manufacturer or a widely published trusted authority (e.g., bank, governmental entity, trade association, etc.). A “digital signature” is similar to a certificate but is typically used for authenticating data. Herein, the term “secure” indicates that it is computationally infeasible for an interloper to successfully perpetuate fraud on a biometric system.

[0020] Referring to FIG. 1, an illustrative embodiment of a biometric system 100 regulating access to a node 110 through a biometric device 120 is illustrated. The node 110 may include an electronic device capable of processing data and reserved for use by a particular individual or groups of individuals. The node 110 may include, but is not limited to, a computer, air traffic control equipment, a banking system (e.g., an automated teller machine, vault, etc.). For illustrative purposes, the node 110 is portrayed as a personal computer (“PC”). However, a node may be construed as a physical area described in FIG. 5.

[0021] As shown, the PC 110 includes a display monitor 111 and at least one input device 112. The input device 112 may include an alphanumeric keyboard, cursor control device, or any other electronic device that can input information to the PC such as a numeric pad or card reading device. A biometric device 120 (e.g., a biometric scanner of facial or hand geometries, iris patterns, voice synthesizer) is preferably positioned separate from the display monitor 111 as shown and interconnected to the PC 110 through a communication line 130. It is contemplated, however, that the biometric device 120 may be implemented internally within the casing of the display monitor 111, the casing of the PC 110, positioned on the input device 112 and the like.

[0022] The biometric device 120 includes an input source (e.g., lens, scanner, microphone, etc.) that routes data to a biometric processor 200 having cryptographic functionality contained within the biometric device 120. The biometric processor 200 captures a data clip of desired data (e.g., facial geometries or other characteristics of a user 140 requesting access to the node). The biometric processor 200 further processes the data clip locally therein before sending at least one “secure” message to the PC 110 to remain accessible or shut-down. Security of the message is assured through the use of standard cryptographic techniques such as encryption, digital signatures, digital certificates, etc. These techniques are well known to those skilled in the art, and thus, do not warrant further description herein. The PC 110 may be shut-down by any conventional manner such as, for example, disabling (i) the host processor or any critical element contained in the PC 110, or (ii) circuitry controlling power distribution within the PC 110. Preferably, as shown, the biometric device 120 should be unobtrusive to the requesting user 140 by not requiring active participation by the user. This unobtrusive nature permits continuous capture of the user's characteristics while still avoiding any interference with his or her productivity.

[0023] As illustrated by dashed lines in FIG. 1, access control circuitry 150 is implemented within the PC 110 to initiate periodic queries to the biometric processor 200, typically after start-up of the PC 110. The access control circuitry 150 is used to disable the PC 110 if the response to the query is incorrect or no response is made within a prescribed period of time. While shown for illustrative purposes as a specialized circuit, the function of the access control circuitry 150 may be alternatively performed by software executing on the host processor or within other elements in PC 110. The operations of the access control circuitry 150 are described below in FIG. 3.

[0024] Referring now to FIG. 2, one embodiment of the biometric processor 200 is shown. The biometric processor 200 comprises a data capture circuit 210 and a processing unit 220, both of which are preferably integrated into one integrated circuit package to reduce vulnerability to physical tampering. However, it is contemplated that these circuits 210 and 220 may be implemented in a multi-chip package or in separate packages, provided a less secure environment is acceptable.

[0025] When comparison of visual biometric characteristics are used, the data capture circuit 210 includes a conventional sensor such as, for example, a Charge Coupled Device “CCD” (the standard sensor used in camcorders), a video sensor developed by VLSI Vision Limited, Inc. of Edinburgh, Scotland. It is contemplated that other types of sensors or technology may be used in order to capture a data clip associated with a selected biometric characteristic of an access-requesting user, for example when the biometric data is audio in nature. For the sake of clarity, the selected biometric characteristics will be described as visual physical characteristics (e.g., iris patterns, retina patters, finger prints, facial geometries, etc.), while it is contemplated that non-visual characteristics of the user (e.g., voice patterns, data entry patterns, etc.) may be used for authentication or identification purposes.

[0026] As shown, the data capture circuit 210 includes a pixel capture array 211 and control logic 212 controlling the pixel capture array 211. The control logic 212 digitizes biometric characteristics of the user and transmits the digitized version of the biometric characteristic to the processing unit 220.

[0027] The processing unit 220 comprises at least a computational element 221, a memory unit 222, and an optional cryptographic unit 223, all of which may be coupled together through a standard bus architecture. Cryptographic operations required to provide secure communications with the node though communication line 130 are either performed by cryptographic unit 223 or by firmware executing on the computational element 221. The computational element 221, which may be a microprocessor, microcontroller or any other electronic component(s) having processing capabilities, executes at least one computational process (e.g., comparison, transformation, etc.) on the acquired biometric data.

[0028] It is contemplated that processing performed by the processing unit 220 on the acquired biometric data clip received from the data capture circuit 210 may include, but not be limited to, the creation of a composite data clip having better image resolution quality by computationally extrapolating information from multiple samples (e.g., a number of successive data clips). This creation of the composite data clip would be useful where the biometric device includes a relatively low resolution camera that successively captures data clips associated with selected characteristic(s) of the user.

[0029] Another example of processing operations may involve the cropping of a data clip so that certain characteristics relevant to authentication or identification operations are identified and retained while characteristics unnecessary for comparison purposes are excluded. This may further reduce bandwidth usage and increase the processing speed of the biometric system.

[0030] Ultimately, the processing performed by the processing unit 220 may extend to include the actual comparison of pre-stored master characteristics with the processed data clip to determine whether or not to grant the user access to the node.

[0031] Referring still to FIG. 2, the memory element 222 is used for storage of intermediate computational results and may optionally be used to store master characteristics, depending on whether comparisons are being performed by the processing unit 220 or by the host processor contained within the node. If the comparisons are being performed by the processing unit 220, the memory element 222 is modifiable to contain such master characteristics that can be updated. For example, the memory unit 222 may be adapted with all types of memory including, but not limited to Random Access Memory (“RAM”), Electrically Erasable Programmable Read-Only Memory “EEPROM” and other types of Flash memory. It is contemplated that the master characteristics may be updated by transmitting the information from the node through the secure communication line 130. Furthermore, the node may communicate with a remotely located source (e.g., a centralized database) to receive master characteristics of the user downloaded from the remotely located source. The memory unit 222 may also be used to store such cryptographic keying material and digital certificates as may be required to implement the security functions associated with providing secure communications to the node.

[0032] The access control circuitry (see FIG. 1) periodically queries the biometric processor 200 to transmit a “response” message from the biometric device to the node via the communication line 130. The response message signals that access to the node is still authorized or provides data necessary to determine whether such access is authorized.

[0033] If the access control circuitry does not receive a response message after a prescribed time period has elapsed, it disables further user access to the node. The periodicity of the prescribed time period may be static or dynamic. If dynamic, the time period may be modified depending on the preferred security at the node. For example, if the node is a PC, the periodicity may be more frequent than that for a vehicle.

[0034] Referring now to FIG. 3, the operational steps performed by the access control circuitry operating in tandem with the biometric processor to authenticate or identify a requesting user of the node is shown. In Step 310, either continuously on a periodic basis or triggered by some action of the requesting user (e.g., depressing a key, flipping a switch, etc.), the access control circuitry queries the biometric device by transmitting a message to the biometric processor and awaits a response before expiration of the prescribed time period. Thereafter, one of two operational procedures may occur, depending on whether the biometric device responds within the predetermined time period (Step 320).

[0035] If the biometric device does not respond within the required time, access to the node is denied to the requesting user (Step 330). The access control circuitry then proceeds to reset a timing circuit (Step 370) as described below.

[0036] If a response is received from the biometric device within the required time period, optional processing of the biometric data clip may be completed by the node represented by dashed lines in Step 340. This may include additional resolution enhancement, feature extraction, etc. If all biometric processing, including comparison to master characteristics, is performed within the biometric device, optional processing is not required. In Step 350, the results of the biometric processing are used to determine whether the requesting user should have access to the node. This may be as simple as acting on a “yes/no” response from the biometric device. Based on this determination, the requesting user is either granted access to the node (Step 360) or denied access to the node (Step 330).

[0037] After disabling the node or refraining from such disablement, the timing circuit within the node is reset so that the access control circuitry performs another query within a prescribed period of time (Step 370). As suggested previously, the timing circuit may be static in nature or dynamic, allowing the requesting user or other authorized entity (e.g. a corporate enterprise Information Systems Manager) to adjust the periodicity of successive queries. However, these may be imposed limitations on the degree of adjustment to avoid circumventing the authentication procedure.

[0038] Referring now to FIG. 4, the operational steps performed by the biometric processor in authenticating and/or identifying the user who desires access to the node are illustrated. First, since the biometric device and access control circuitry have been in previous operation, access to the node has been disabled when no authorized user is proximate to the node. In the absense of a requesting user, the biometric device typically remains idle as shown in Step 410, waiting for a query from the access control circuity. As previously described in FIG. 3, when a requesting-user approaches the node and requests usage of that node by any selected request mechanism (e.g., depressing a key of a numeric pad or alphanumeric keyboard, speaking into a voice synthesizer, presenting a physical characteristic, etc.), the access control circuitry generates a query to the biometric device. In response to this request, the biometric device begins to capture a selected characteristic of the user (Step 420). Subsequently, the biometric device begins processing the digital data associated with the selected characteristic (Step 430). Such processing may include creating a data clip narrowly tailored to a more specific biometric characteristic than received as input (e.g., a finger print from a scanned hand pattern), creating a composite data clip having better image resolution quality through extrapolation of information from multiple samples, spacial rotation of the data clip, cropping the data clip, retrieving master characteristics based on user identification from a centralized source, and/or comparing biometric characteristics of the requesting user to the master characteristics.

[0039] Next, as shown in Step 440, the biometric processor prepares a response message including the processed digital data along with any other data as needed. The biometric processor then transmits the response message to the node (Step 450). Thereafter, the capturing of biometric characteristics in response to further periodic queries from the node continues to ensure that the requesting user is still using the node.

[0040] Referring to FIG. 5, another embodiment of the secure biometric device for use in home or business security is illustrated. Similar to that shown in FIG. 1, the secure biometric device 500 prevents access by an unauthorized user 510, however, this access is not to the contents or control features of electronic equipment, but rather access to a security area or dwelling space 520. Conventionally, it is clear that a communication line 530 between a standard video camera 540 and a lock control mechanism 550 for the door is unsecure allowing a person to transmit incorrect information to the lock control mechanism 550 by simply disconnecting the communication line 530 and interconnecting another communication line thereto.

[0041] With respect to the present invention, processing is performed within the secure biometric device (e.g., the video camera 540) through implementation of the biometric processor of FIG. 2 for example. This would preclude fraudulent video from being transferred to the lock control mechanism 550 to cause it to mistakenly believe that an authorized user is waiting access to the security area or dwelling space.