Biometric based multi-party authentication

[0002] The present invention relates to authentication of users and more particularly to multi-party authentication.

[0003] In user authentication, it may be useful to provide access to certain resources or allow certain operations only if multiple users have been authenticated. For example, in software code revision, it may be beneficial to only allow certain revisions, such as publication of a new version, if such revisions are authorized by multiple authenticated users. Similarly, it may be beneficial for certain financial transactions or to maintain privacy to require multiple user authentication before completing the transaction or allowing access to the private information.

[0004] Previously, threshold systems have been devised to control access to resources, information, or to authorize transactions or activities only if a specified number of users are authenticated. Such systems provide increased security over single user authentication or verification systems because an attacker would have to impersonate each of the specified number of users to break the security system. Alternatively, a sharing scheme could be utilized where only a subset of the users are required for authentication or verification.

[0005] While such multi-party authentication and sharing schemes are known in the art, the potential still remains for an attacker to overcome the multi-party system by acquiring user identifications for multiple users and then impersonating those users utilizing the acquired user identifications. Thus, further improvements may be needed to increase the security of multi-party systems.

[0006] In view of the above discussion, it is an object of the present invention to provide improved security in multi-party authentication/verification systems.

[0007] These and other objects of the present invention may be provided by methods, systems and computer program products for multi-party authentication which receive a plurality of biometric authentication messages from a corresponding plurality of users. The biometric authentication messages include biometric data corresponding to the user. It is determined if each of the plurality of received biometric authentication messages is a valid message based on the biometric data contained in the biometric authentication messages so as to determine a quantity of valid biometric authentication messages. An indication of authentication is then provided if the quantity of the valid messages of the received plurality of messages is at least an authentication threshold value.

[0008] By providing multi-party authentication based on biometric information, the present invention provides for the increased difficulty in impersonating an authorized user which may be provided by the use of biometric information.

[0009] In a particular aspect of the present invention, the received biometric authentication messages include a user identification and user biometric data. In such a case, the received user biometric data is compared with previously stored biometric data corresponding to the user identification of the received biometric authentication message. The received biometric authentication message is considered a valid message if the comparison indicates that the received user biometric data corresponds to the stored biometric data. The received and stored user biometric data may be a canonical biometric template generated from a plurality of biometric samples. Preferably, the canonical biometric templates are generated by majority decoding the plurality of biometric samples.

[0010] In a further embodiment of the present invention, the biometric data is compared by determining a closeness between the received user biometric data and the previously stored biometric data. The received user biometric data corresponds to the previously stored biometric data if the closeness between the received user biometric data and the previously stored biometric data is within a predefined closeness threshold.

[0011] The closeness between the received user biometric data and the previously stored biometric data may be determined based on a difference in value between the user biometric data and the previously stored biometric data. Alternatively, the closeness between the received user biometric data and the previously stored biometric data may be determined based on a Hamming distance between the received user biometric data and the previously stored biometric data.

[0012] Preferably, the user biometric data and the stored biometric data comprise at least one of fingerprint, hand geometry, iris pattern, facial features, voice characteristics, handwriting dynamics, earlobe characteristics and keystroke dynamics.

[0013] In still another embodiment of the present invention, the received biometric authentication message includes a sample of biometric information from a user and a signed tuple comprising a user identification and a biometric template corresponding to the user. In such a case, the signature of the signed tuple and the received sample of user biometric data compared with the biometric template of the received tuple if the signature of the signed tuple is verified. The received biometric authentication message is a valid message if the comparison indicates that the received sample of user biometric data corresponds to the biometric template of the signed tuple.

[0014] The comparison of the received sample of user biometric data and the biometric template of the signed tuple may be a closeness comparison as described above.

[0015] In another embodiment of the present invention, the received biometric authentication message includes an encrypted biometric sample of the user. The received encrypted biometric sample is compared with encrypted biometric templates of valid users. The received biometric authentication message is considered a valid message if the comparison indicates that the received encrypted biometric sample corresponds to an encrypted biometric template of a valid user.

[0016] The comparison of the received encrypted biometric sample and the encrypted biometric template may be a determination of closeness between the received encrypted biometric sample and a candidate encrypted biometric template. The encrypted biometric sample corresponds to the candidate encrypted biometric template if the closeness between the received encrypted biometric sample and a candidate encrypted biometric template is within a closeness threshold.

[0017] As described above, the closeness between the received encrypted biometric sample and a candidate encrypted biometric template may be determined based on a difference in value between the biometric sample and the biometric template. Similarly, the closeness between the received encrypted biometric sample and a candidate encrypted biometric template may be determined based on a Hamming distance between the biometric sample and the biometric template.

[0018] In an embodiment where the closeness between the received encrypted biometric sample and a candidate encrypted biometric template is determined based on a difference in value between the biometric sample and the biometric template, the number of bits in the biometric templates (T) corresponding to the encrypted biometric templates is denoted by f, a publicly known prime number (p) larger than 2^fis fixed, and a non-secret integer (g) between 2 and p−2 is selected. In such a case, the biometric templates (T) of valid users may be encrypted by determining z=g^T(mod p) to provide the encrypted biometric templates (z) of valid users. Valid closeness indicator values (x) may be generated where x=g^v(mod p) for integers between 0 and the closeness threshold. The valid closeness indicators are then stored.

[0019] The biometric sample (B) is also encrypted by determining y=g^B(mod p) so as to provide the encrypted biometric sample (y). The closeness between the received encrypted biometric sample and a candidate encrypted biometric template and the determination that the encrypted biometric sample corresponds to the candidate encrypted biometric template if the closeness between the received encrypted biometric sample and a candidate encrypted biometric template is within a closeness threshold may then be performed by determining if either y/z (mod p) or (y/z)⁻¹(mod p) is equal to one of the stored valid closeness indicator.

[0020] Furthermore, a plurality of biometric templates having a plurality of closeness thresholds may be associated with a user. In such a case, the valid closeness indicator values (x), where x=g^v(mod p), may be generated for integers between 0 and a highest value of the closeness thresholds associated with the plurality of biometric templates.

[0021] In another embodiment, the closeness between the received encrypted biometric sample and a candidate encrypted biometric template is determined based on a Hamming distance between the biometric sample and the biometric template. Again, the biometric templates (T) corresponding to the encrypted biometric templates comprise f bits, a publicly known prime number (p) is larger than 2^fand a non-secret integer (g) is between 2 and p−2. The biometric templates (T) of valid users are encrypted by determining z=g^T(mod p) to provide the encrypted biometric templates (z) of valid users. A biometric sample (B) is encrypted by determining y=g^B(mod p) so as to provide the encrypted biometric sample (y). The set of values 2ⁿfor each m and n are stored as a set of initial closeness indicators (c), where n is the set of integer values from 0 to 2 and m is the set of integer values from 0 to f−1. The encrypted biometric sample corresponds to the candidate encrypted biometric template if the closeness between the received encrypted biometric sample and a candidate encrypted biometric template is within a closeness threshold where the closeness between the encrypted biometric sample (y) and the encrypted biometric template (z) is determined utilizing the initial closeness indicators (c).

[0022] In particular, the closeness between the encrypted biometric sample (y) and the encrypted biometric template (z) may be determined by determining if either y/z (mod p) or (y/z)⁻¹(mod p) is equal to one of the stored initial closeness indicators. Alternatively, the closeness between the encrypted biometric sample (y) and the encrypted biometric template (z) may be determined by determining if either cy/z (mod p), c(y/z)⁻¹(mod p), c⁻¹(y/z) (mod p) or c⁻¹(y/z)⁻¹(mod p) is equal to one of the stored initial closeness indicators.

[0023] In still another embodiment of the present invention, a secret value is distributed across multiple users by dividing the secret value into a plurality of shares. A canonical biometric template is determined for each of the multiple users and each of the canonical biometric templates encoded to provide corresponding check digits. An offset is determined for each of the multiple users where the offset associated with a users is determined based on the canonical biometric template of the user and a share of the secret value associated with the user. The corresponding offset and check digits are then provided to corresponding ones of the multiple users.

[0024] To recover the secret value, a sampled canonical biometric template is obtained from a plurality of the multiple users. Corresponding offset and check digits of the plurality of multiple users are also obtained. The sampled canonical biometric templates are then error corrected utilizing the corresponding check digits of the plurality of multiple users so as to provide corrected canonical biometric templates for the plurality of the multiple users. Shares of the secret value corresponding to the plurality of the multiple users are then determined from the corresponding offset and corrected canonical biometric templates of the plurality of the multiple users. The secret value is then recovered from the determined shares of the secret value.

[0025] The canonical biometric template for each of the multiple users may be determined by obtaining a plurality of biometric samples for each of the multiple users and majority decoding the plurality of samples for corresponding ones of the multiple users so as to provide corresponding canonical biometric templates. Furthermore, the canonical biometric templates may be encoded by generating an (N,M,D) code having an M-bit information vector and N-M bits of error correction check digits where the canonical biometric templates comprise M bits. Preferably, the secret value is divided into a plurality of shares where the secret value can be reconstructed from fewer than all of the plurality of shares. The secret value may be a secret key utilized with a public key cryptographic algorithm.

[0026] The sampled canonical biometric template may be obtained from a plurality of the multiple users and the corresponding offset and check digits of the plurality of multiple users obtained by receiving from the plurality of multiple users a signed triple which comprises the offset, check digits and sampled canonical biometric templates corresponding to the user. The authenticity of the signature of the signed triple may be verified and the signed triple rejected if the verification fails to authenticate the signature of the signed triple.

[0027] In still another embodiment of the present invention, biometric information is stored by storing a user identification associated with the biometric information, storing each of a plurality of templates of biometric data associated with the user identification and storing an identification of at least one of the plurality of templates as a primary biometric authentication type. Furthermore, a biometric type identification associated with each of the plurality of templates may also be stored. Preferably, the plurality of templates and the identification of the primary biometric authentication type are stored in an array indexed by the user identification.

[0028] The primary biometric authentication type may be changed by receiving a message to change the identification of the primary biometric authentication type associated with a user. In such a case, a plurality of biometric validations may be required prior to changing the identification of the primary biometric authentication type associated with the user.

[0029] As will further be appreciated by those of skill in the art, the present invention may be embodied as methods, apparatus/systems and/or computer program products.

[0030] FIG. 1 is diagram of a data processing system suitable for use with the present invention;

[0031] FIG. 2 is a detailed view of a data processing system suitable for use with the present invention;

[0032] FIG. 3 is a flowchart illustrating operations according to one embodiment of the present invention;

[0033] FIG. 4 is a flowchart illustrating operations according to a first alternative embodiment of the present invention;

[0034] FIG. 5 is a flowchart illustrating operations for determining a canonical biometric template for use with the present invention;

[0035] FIG. 6 is a flowchart illustrating operations carried out by a user requesting authentication according to one embodiment of the present invention;

[0036] FIG. 7 is a flowchart illustrating operations of according to an alternative embodiment of the present invention;

[0037] FIG. 8 is a flowchart illustrating operations according to a further alternative embodiment of the present invention utilizing a closeness determination;

[0038] FIG. 9 is a flowchart illustrating operations for initialization of a system according to one embodiment of the present invention utilizing a closeness determination;

[0039] FIG. 10 is a flowchart illustrating operations for evaluating the closeness of encrypted biometric templates system according to one embodiment of the present invention utilizing a closeness determination;

[0040] FIG. 11 is a flowchart illustrating operations for initialization of a system according to one embodiment of the present invention utilizing error correction coding;

[0041] FIG. 12 is a flowchart illustrating operations according to one embodiment of the present invention utilizing error correction coding;

[0042] FIG. 13 is a flowchart illustrating operations for initialization of a system according to one embodiment of the present invention for recovering a secret value;

[0043] FIG. 14 is a flowchart illustrating operations carried out by a user according to one embodiment of the present invention for recovering a secret value;

[0044] FIG. 15 is a flowchart illustrating operations according to one embodiment of the present invention for recovering a secret value; and

[0045] FIG. 16 is a flowchart illustrating operations according to an embodiment of the present invention for utilizing multiple biometric templates associated with a user.

[0046] The present invention now will be described more fully hereinafter with reference to the accompanying drawings, in which preferred embodiments of the invention are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Like numbers refer to like elements throughout.

[0047] The present invention can be embodied as systems, methods, or computer program products for multi-party authentication, verification or value generation utilizing biometric information. As is well known to those having skill in the art, biometric information is one or more behavioral and/or physiological characteristics of an individual. Biometric identification and/or verification uses a data processing system to enable automatic identification and/or verification of identity by computer assessment of a biometric characteristic. In biometric verification, biometric information is verified for a known individual. In biometric identification, biometric information for an individual is compared to known biometric information for man y individual s in order to identify the individual.

[0048] Biometric identification/verification systems, methods and computer program products can measure one or more of the following behavioral and/or physiological characteristics of an individual: fingerprint, hand geometry, iris pattern, facial features, voice characteristics, handwriting dynamics, earlobe characteristics and keystroke dynamics. Other biometric characteristics may be used. Applications using biometric technologies include biometric check cashing machines, payment systems that substitute biometric data for personal identification numbers, access control systems that use biometric data, biometric employee time and attendance recording and biometric passenger control for transportation. Many other applications may utilize biometric information for identification and/or verification. See the publications entitled “Biometrics, Is it a Viable Proposition for Identity Authentication and Access Control”, to Kim, Computers & Security, Vol. 14, 1995, pp. 205-214; “A Robust Speaker Verification Biometric”, to George et al., Proceedings, the IEEE 29^thInternational Carnahan Conference on Security Technology, October 1995, pp. 41-46; “On Enabling Secure Applications Through Off-line Biometric Identification”, to Davida et al., Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy, 1998, pp. 148-157; and “Biometric Encryption: Information Privacy in a Networked World”, to Brown et al., EDI Forum: The Journal of Electronic Commerce, v. 10, No. 3, 1997, pp. 37-43.

[0049] While the present invention is described herein as utilizing a single biometric type for authentication, as will be appreciated by those of skill in the art, multiple types of biometric data may be utilized for authentication. Thus, for example, fingerprint and iris scan may be used in combination to generate a biometric template for a user. Furthermore, these different types of biometric data may be treated individually to provide multiple biometric vectors of templates or combined to provide a single vector or template.

[0050] The present invention can take the form of an entirely hardware embodiment, an entirely software (including firmware, resident software, micro-code, etc.) embodiment, or an embodiment containing both software and hardware aspects. Furthermore, the present invention can take the form of a computer program product on a computer-usable or computer-readable storage medium having computer-usable or computer-readable program code means embodied in the medium for use by or in connection with an instruction execution system. In the context of this document, a computer-usable or computer-readable medium can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

[0051] The computer-usable or computer-readable medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared or semiconductor system, apparatus, device, or propagation medium. More specific examples (a nonexhaustive list) of the computer-readable medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CD-ROM). Note that the computer-usable or computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner if necessary, and then stored in a computer memory.

[0052] Referring now to FIG. 1, an exemplary embodiment of a computer system 30 in accordance with the present invention typically includes input devices 32, such as a keyboard or keypad 31, a microphone 42 and/or preferably, a biometric information input device 35. The computer system 30 also preferably includes a display 34 and a memory 36 that communicate with a processor 38. The computer system 30 may further include a speaker 44 and an I/O data port(s) 46 that also communicate with the processor 38. The I/O data ports 46 can be used to transfer information between the computer system 30 and another computer system or a network (e.g., the Internet). FIG. 1 also illustrates that computer system 30 may include a storage device 40 which communicates with memory 36 and processor 38. Such a storage device may be any type of data storage device as described above. These components are included in many conventional computer systems (e.g., desktop, laptop, or handheld computers) and their functionality is generally known to those skilled in the art.

[0053] Furthermore, while the present invention is described with respect to the computer system 30, as will be appreciated by those of skill in the art, the present invention may be incorporated into many other devices where multiple party authentication/verification may be desired and, thus, may comprise an embedded function in many other devices. Thus, the present invention should not be construed as limited to use in computer systems such as illustrated in FIG. 1 but may be incorporated in any device having sufficient processing capabilities to carry out the operations described below. Furthermore, as will be appreciated by those of skill in the art, the present invention may be utilized in a distributed system where multiple users' workstations or other processing systems are operably connected with a central authority processing system. Such systems may include dedicated devices connected to a central processing system, remote processors connected through a network or through direct connection, or other mechanisms for distributing the operations of the present invention across multiple processing systems. While the present invention is described with respect to the processing system in FIG. 1, the present invention should not be construed as limited to operations carried out by a single processing system but should include systems where operations are carried out by multiple processing systems. The processing system of FIG. 1 is, therefore, merely provided as an example of a suitable processing system for use with the present invention and may be utilized as a user's processing system, a central authority processing system or as a single processing system to which multiple users have access.

[0054] FIG. 2 is a more detailed block diagram of the computer system 30 that illustrates one application of the teachings of the present invention. The processor 38 communicates with the memory 36 via an address/data bus 48. The processor 38 can be any commercially available or custom microprocessor or other processing system capable of carrying out the operations of the present invention. The memory 36 is representative of the overall hierarchy of memory devices containing the software and data used to implement the functionality of the computer system 30. The memory 36 can include, but is not limited to, the following types of devices: cache, ROM, PROM, EPROM, EEPROM, flash, SRAM, and DRAM. As shown in FIG. 2, the memory 36 may hold four major categories of software and data used in the computer system 30: the operating system 52; the application programs 54; the input/output (I/O) device drivers 58; and the data 56. The I/O device drivers 58 typically include software routines accessed through the operating system 52 by the application programs 54 to communicate with devices such as the input devices 32, the display 34, the speaker 44, the microphone 42, the I/O data port(s) 46, and certain memory 36 components. The application programs 54 comprise the programs that implement the various features of the computer system 30 and preferably include at least one application module or object for multi-party authentication/verification 60 which carries out the operations of the present invention as described below. As will be appreciated by those of skill in the art, the module or object 60 may perform different operations as described below depending on the use of the computer system 30 as a user's workstation, a central authority processing system or a shared processing system.

[0055] Finally, the data 56 represents the static and dynamic data used by the application programs 54, operating system 52, I/O device drivers 58, and any other software program that may reside in the memory 36. As illustrated in FIG. 2, the data 56 preferably includes a user identification 70 and biometric data 72 associated with the user. Additional intermediate data (not shown) may also be stored in memory. Furthermore, while the present invention is described as an application executing on computer system 30, as will be appreciated by those of skill in the art, the present invention may be implemented in any number of manners, including incorporation in operating system 52 or in an I/O device driver 58.

[0056] The present invention will now be described with respect to FIGS. 3 through 16 which are flowchart illustrations of embodiments of the present invention. It will be understood that each block of the flowchart illustrations, and combinations of blocks in the flowchart illustrations, can be implemented by computer program instructions. These program instructions may be provided to a processor to produce a machine, such that the instructions which execute on the processor create means for implementing the functions specified in the flowchart block or blocks. The computer program instructions may be executed by a processor to cause a series of operational steps to be performed by the processor to produce a computer implemented process such that the instructions which execute on the processor provide steps for implementing the functions specified in the flowchart block or blocks.

[0057] Accordingly, blocks of the flowchart illustrations support combinations of means for performing the specified functions, combinations of steps for performing the specified functions and program instruction means for performing the specified functions. It will also be understood that each block of the flowchart illustrations, and combinations of blocks in the flowchart illustrations, can be implemented by special purpose hardware-based systems which perform the specified functions or steps, or combinations of special purpose hardware and computer instructions.

[0058] The present invention provides for utilizing biometric data in multi-party situations. In the multiparty biometric-based authentication/verification systems described herein, each user has at least one biometric characteristic measured by the system. These biometric characteristic types (fingerprint, hand geometry, iris pattern, etc.) can be identical or different for each user. Biometric data samples are obtained, such as with biometric input 35, in advance from each user and biometric templates are then calculated from these data for each user. There are n users (where n>0), denoted by their user identifications:U₁, U₂, . . . U_n. The users' pre-computed reference “biometric templates” are denoted by T₁, T₂, . . . T_n. The users' “biometric samples” taken in real-time are denoted by B₁, B₂, . . . B_n. To create a valid verification it is necessary that at least k of the users (where 0<k<n ) present valid biometric samples to the system.

[0059] FIG. 3 illustrates one embodiment of the present invention. As is illustrated in FIG. 3, an authentication message is obtained from a user (block 100) by, for example, receiving the information at the I/O data ports 46 of computer system 30. The biometric information about the user is extracted from the authentication message (block 102). It is then determined if the biometric information is valid for the user (block 104) and, if so, a valid count is incremented to indicate that the user provided valid biometric information (block 108). It is then determined if the count of valid users exceeds the threshold for allowing authentication (i.e. have k users provided valid biometric information) (block 110). If the threshold has been reached, then an indication of authenticity is provided (block 112).

[0060] If the biometric information provided by the user is not valid (block 104) or if the authentication threshold has not been reached (block 110), then it is determined if more messages are available to process (block 106). If more messages are available to process then the next message is obtained and the validation process repeated. If however, no more messages are available to process, then there are insufficient users providing valid biometric information and the authentication of the users is rejected (block 114).

[0061] As will be appreciated by those of skill in the art, the present invention may be utilized in many different applications. Accordingly, the present invention has been described with respect to the authentication operations rather than the operations for receiving messages, rejecting duplicate messages, establishing timeout procedures or establishing time durations in which received messages are considered for authentication. Such specifics of particular uses of the present invention may vary from application to application and may be readily determined by one of skill in the art in light of the discussion herein. Accordingly, in the interest of clarity, such application specific details are omitted from the description of the present invention provided herein as such details would be readily apparent to those of skill in the art in light of the particular application to which the teachings of the present invention are applied.

[0062] FIG. 4 illustrates a particular embodiment of the present invention illustrated in FIG. 3. In the system illustrated in FIG. 4, the user identifications (i.e., U₁, U₂, . . . U_n) and their associated biometric templates (i.e., T₁, T₂, . . . T_n) are stored in the system in a central database (e.g., at a server) as tuples of the form (U_i, T_i). In this case, the system protects the integrity of the stored (U_i, T_i) values. Each user, i, presents user identification (i.e., U_i) and the biometric sample (i.e., B_i) to the system. The system checks each user-supplied tuple (U_i, B_i) against the associated system tuple (U_i, T_i). If k or more valid user-supplied tuples are presented to the system, then a valid verification is created.

[0063] Thus, as seen in FIG. 4, an authentication message is obtained (block 100) and biometric data for a user and a user identification (i.e. the tuple (U_i, B_i)) is extracted from the authentication message (block 200). The stored biometric data is then retrieved utilizing the user identification in the extracted tuple (block 202). A comparison is then made utilizing the stored biometric data T_iand the extracted biometric data B_i(block 204). If the biometric information matches (block 104) then a valid count is incremented to indicate that the user provided valid biometric information (block 108). It is then determined if the count of valid users exceeds the threshold for allowing authentication (i.e. have k users provided valid biometric information) (block 110). If the threshold has been reached, then an indication of authenticity is provided (block 112).

[0064] If the biometric information provided by the user is not valid (block 204) or if the authentication threshold has not been reached (block 110), then it is determined if more messages are available to process (block 106). If more messages are available to process then the next message is obtained and the validation process repeated. If however, no more messages are available to process, then there are insufficient users providing valid biometric information and the authentication of the users is rejected (block 114).

[0065] In an alternative embodiment of the system of FIG. 4, a canonical biometric template is utilized as the stored and extracted biometric information. The generation of a canonical biometric template may be performed as illustrated in FIG. 5. As stated in Davida et al., if several measurements of a biometric are subjected to majority decoding at the time of template creation, then that template can be considered the “canonical” biometric template. Majority decoding may not be applicable to all types of biometric templates, but may be suitable for use with, for example, iris biometrics. In the event that biometrics are utilized which are not suitable for majority decoding, then alternative methods of developing a canonical biometric template may be required. As will be appreciated by those of skill in the art, these methods may depend on the type of biometric. Furthermore, for some forms of biometrics a canonical biometric template need not be determined if, for example, there is no variation in biometric samples. Thus, while the present invention is described with regard to majority decoding to develop a canonical template, the present invention should not be construed as requiring use of majority decoding or a canonical template for all types of biometrics.

[0066] Majority decoding can best be illustrated with an example. If one has an odd number of biometric samples, say B_i=10110101, B₂=10010111, and B₃=11100111, then the biometric vector obtained via majority decoding would be B=10110111. That is, in the three biometric samples (B₁, B₂, and B₃) the majority of bits in the first bit position are ones, the majority of bits in the second bit position are zeroes, the majority of bits in the third bit position are ones, and so forth. Thus, as seen in FIG. 5, an odd number of biometric measurements are obtained for a user (block 300). The majority values for bits from the samples are then determined (block 302) and a canonical template established using the majority bit values as the bits in the template (block 304).

[0067] The canonical biometric templates of users would then be utilized in the system of FIG. 4 by storing the canonical biometric template for each user. Users would generate a new template by taking multiple biometric samples and then majority decoding the samples to provide a new canonical template. The new canonical template would be provided with the authentication message and compared to the stored canonical template to determine the validity of the authentication message. Otherwise, operations would proceed as described with respect to FIG. 4.

[0068] FIGS. 6 and 7 illustrate a further alternative embodiment of the present invention. In the alternative embodiment illustrated in FIGS. 6 and 7, each user, i, presents a “signed tuple” {(U_i, T_i), Sig(U_i, T_i)} and its biometric sample (i.e., B_i) as part of an authentication message. The signed tuple, for example, can be stored on a card which is then read by a card reader at the time the user presents its biometric sample for authentication. The signature of the tuple is verified and B_iis checked against T_i. If k or more valid user-supplied signed tuples are presented for authentication then a valid verification is created.

[0069] As seen in FIG. 6, the operations of a user of the signed authentication system are illustrated. As reflected at block 310, a biometric sample or samples are obtained from the user. The biometric template is then generated from the obtained sample or samples (block 312). The user identification and the biometric template along with the signed tuple { (U_i, T_i), Sig(U_i, T_i)} are then submitted for authentication (block 314).

[0070] FIG. 7 illustrates operations for processing an authentication message, such as that generated in FIG. 6. As is seen in FIG. 7, the authentication message is obtained (block 100) and the biometric data and user identification extracted from the message (block 400). The signature of the signed tuple in the message is then verified (block 402). If the signature is valid (block 404) then the signed biometric data in the tuple is compared to the extracted biometric data of the message (block 406). If the extracted and signed biometric data matches, then the message is validated and the valid count is incremented (block 108). It is then determined if the count of valid users exceeds the threshold for allowing authentication (i.e. have k users provided valid biometric information) (block 110). If the threshold has been reached, then an indication of authenticity is provided (block 112).

[0071] If the signature is not valid (block 404) or the signed and extracted biometric data do not match (block 406), then the message is rejected and it is determined if more messages are available for processing (block 106). If more messages are available to process then the next message is obtained and the validation process repeated. If however, no more messages are available to process, then there are insufficient users providing valid biometric information and the authentication of the users is rejected (block 114).

[0072] As will be appreciated by those of skill in the art in light of the above discussion, the biometric data utilized in the system of FIGS. 6 and 7 may take the form of a canonical biometric template such as generated by the operations of FIG. 5. Thus, the embodiment of FIGS. 6 and 7 should not be construed as limited to a single biometric sample.

[0073] The alternative embodiment of FIGS. 6 and 7 utilizes a secret symmetric or public key infrastructure in place to provide the signature over (U_i, T_i). However, unlike the alternative embodiment illustrated in FIG. 4, a database of U_i′s and T_i′s does not need to be maintained (e.g., at a server).

[0074] FIG. 8 describes another alternative embodiment of the present invention where biometric data is compared based on a “closeness” of the data rather than an absolute equality. As is illustrated in FIG. 8, the authentication message is obtained (block 100) and the biometric data extracted from the message (block 500). The closeness of reference biometric data and the extracted biometric data is then determined (block 502). The closeness may be determined in many different ways. In particular preferred embodiments, the closeness is determined based on the difference in value between the reference biometric data and the extracted biometric data. Alternatively, the closeness is measured as the Hamming distance between the reference biometric data and the extracted biometric data. The Hamming distance between two binary values is the number of bits in which the two values differ.

[0075] After the closeness is determined, it is then determined if the closeness of the reference biometric data and the extracted biometric data is within a closeness threshold (block 504). If the closeness is within the threshold, then the message is a valid message and the valid count is incremented (block 108). It is then determined if the count of valid users exceeds the threshold for allowing authentication (i.e. have k users provided valid biometric information) (block 110). If the threshold has been reached, then an indication of authenticity is provided (block 112).

[0076] If the closeness is not within the threshold (block 504) and the message is rejected or there have been fewer than k valid messages (block 110), then it is determined if more messages are available for processing (block 106). If more messages are available to process then the next message is obtained and the validation process repeated. If however, no more messages are available to process, then there are insufficient users providing valid biometric information and the authentication of the users is rejected (block 114).

[0077] The use of closeness in the multi-party biometric authentication as illustrated in FIG. 8 may be particularly well suited to comparing encrypted reference biometric data with encrypted extracted biometric data. Such a system for comparing encrypted biometric data is illustrated in FIG. 9 and FIG. 10. A biometric template T_imay be encrypted to protect users' privacy or to help protect a proprietary procedure for computing template values. It is also possible that the system responsible for authenticating a candidate user cannot decrypt T_iand, therefore, can not directly compare B_iand T_i. This problem could be easily overcome if the biometric verification/identification consisted of merely checking whether B_i=T_i. In that case, the system could instead encrypt B_iand verify that its encrypted value is equal to the encrypted value of T_iwhere encryption is performed with the same key.

[0078] However, two samples of biometric data obtained from a user may not be exactly the same. That is, the biometric data are not precise, and so the biometric data sampled from a user are different from the calculated biometric template. Therefore, biometric verification/identification may involve only a test to determine if B_iis close to T_iin some sense. The closeness of B_iand T_idoes not, however, imply that their encrypted values are close in any way. However, utilization of the operations described in FIGS. 9 and 10 may overcome this problem.

[0079] As is seen in FIG. 9, an initialization procedure involves generating an array of closeness values based on the closeness threshold and the method of closeness utilized (block 510). Furthermore, the encrypted biometric template is also stored (block 512).

[0080] The encryption and generation of the array of closeness values may be generated in several different manners. For example, the i^thuser's biometric information may be a vector (B_i,jfor j=1,2, . . . m), for some m and this vector needs to be close to a template vector (T_i,j). However, the present invention will be described with reference to a generic user U and a case of m=1, i.e., when the user's biometric data can be described by one number B. The closeness of B to T can be expressed as either:

[0081] (a) |B-T|<d, for some reasonably small value of d, or

[0082] (b) as having the binary representations of B and T differ in only a very small number of bits.

[0083] In the first case (a), if f is the number of bits in T, a publicly known prime number p is established where p is larger than 2^fand large enough that the discrete logarithm problem in the multiplicative group of GF(p) could be considered unsolvable for the purposes of a given application. Let g be a non-secret integer between 2 and p−2. The authentication system will store z=g^T(mod p). This will guarantee that the value of T remains secret. The system will also store an array A of values g^v(mod p) for all integers v between 0 and d−1 for all users.

[0084] A biometric sample that is measured as B is encrypted by computing y=g^B(mod p) which is obtained by the authentication system (block 520). A z value for a potential matching stored z value is then obtained (i.e. a candidate encrypted template) (block 522). The closeness (x) of y and the candidate z is then determined by determining x=y/z=g^B-T(mod p) (block 524). It is then determined if either x(mod p) or x⁻¹(mod p) is in the closeness array A (block 526). If either x(mod p) or x⁻¹(mod p) is in the closeness array A, then the user's biometric information can be accepted (block 528). If neither x(mod p) or x⁻¹(mod p) is in the closeness array A then it is determined if there are more candidates (block 530) and if so the procedure is repeated until either a match is found or all candidates have been processed. If all candidates have been processed and there remains no match, then the provided encrypted biometric sample is rejected (block 532). Optionally, the system may report a forgery attempt.

[0085] The closeness array A, for all users, can be published and, in any event, it does not need to be kept secret. The knowledge of its values, even combined with the knowledge of z does not help an attacker since it is still necessary to provide the biometric information B sufficiently close to T to be authenticated.

[0086] If several biometric parameters B_i,1, B_i,2, . . . B_i,mare measured for user i, and it is necessary that |B_i,j−T_i,j|<d_jfor j=1,2, . . . , m, then the system need only store the same array A of values with d=max(d₁, d₂, . . . , d_m). Therefore, allowing for multiple biometric parameters does not increase the storage overhead in the authenticating system. Similarly, no additional data in the array needs to be stored to accommodate multiple users. The same array A can be used to authenticate every user U₁, U₂, . . . , U_n.

[0087] If the closeness determination is made based on Hamming distance (i.e. case (b) above) then the closeness of B and T means that only a small number h of bits in the binary representations of B and T differ. Preferably, h is no greater than 2. If h=1, then, as reflected in block 510 of FIG. 9, an array C of values {1,g,g²,g², . . . g²} may be stored. Similarly, the encrypted biometric template (z) is determined as described above and stored (block 512). As with the previous example, an encrypted biometric sample (y) is obtained (block 520) and candidate biometric templates (z) are also obtained (block 522). The closeness is then again determined as x=y/z=g^B-T(mod p) (block 524). If either x(mod p) or x⁻¹(mod p) is in the stored array C, then the user's biometric information can be accepted (block 528). If neither x(mod p) or x⁻¹(mod p) is in the closeness array C then it is determined if there are more candidates (block 530) and if so the procedure is repeated until either a match is found or all candidates have been processed. If all candidates have are processed and there remains no match, then the provided encrypted biometric sample is rejected (block 532). Optionally, the system may report a forgery attempt.

[0088] If h=2, then the same array C may be stored. In such a case, the system checks if for any c in C one of the four values xc(mod p), x⁻¹c(mod p), xc⁻¹(mod p), or x⁻¹c⁻¹(mod p) is in C, where c is a value in the array C. Furthermore, as with the array A, the same array C may serve multiple users and different biometric parameters.

[0089] Thus, the closeness arrays A and C provide an exhaustive list of potential valid closeness values if the biometric values which are encrypted are the same. Accordingly, the present invention could be extended to other measures of closeness or increased Hamming distances if an exhaustive list of potential valid closeness values of the biometric values which are encrypted may be generated.

[0090] As will be appreciated by those of skill in the art, the encryption closeness determinations described above with respect to FIGS. 9 and 10 may be readily incorporated into the system of FIG. 8. Thus, the operations of FIG. 10 may correspond to the operations of block 100, 500, 502 and 504 of FIG. 8. Accordingly, the embodiment illustrated in FIGS. 8, 9 and 10 provides for multi-party authentication without requiring decryption of a user's biometric data and further may take into account variation in biometric data supplied by a valid user.

[0091] FIGS. 11 and 12 describe a further embodiment of the present invention where error correction is utilized in multi-party authentication/validation. The error correction embodiment of FIGS. 11 and 12 utilizes error correction codes described by Davida et al. identified above. The use of error correction codes may compensate for the fact that the biometrics acquired for an individual are not measured perfectly. Each such measurement can be represented as a binary vector of 0 and 1 bits, where any one measurement is at some Hamming distance from other measurements. For example, the codewords c₁=10110101 and c₂=10010111 are different in their 3^rdand 7^thbits, and so c₁and c₂have a hamming distance of 2. Empirical work in measuring biometrics, such as the iris, has shown that the expected hamming distance is about 10 percent. That is, in any two biometric samples, about 10 percent of the bits are different. Moreover, the errors in the measured biometric samples appear to be independent. Hence, error correction codes can be used advantageously to transform the “noisy” biometric samples into a constant or fixed value, which can be used as a biometric template.

[0092] As is seen in FIG. 11, an odd number (j) of biometric samples are obtained from each user (block 600) and the j biometric samples are majority decoded as described above (block 602) to provide a canonical biometric template T for each user. As described above, the generation of a canonical biometric template by majority decoding may be limited to only certain biometric types such as iris biometrics. However, if suitable substitutes for the canonical biometric template are available, then alternative biometrics may be utilized. Once the canonical biometric template T is obtained, error correction check digits, denoted by C, are computed on T (block 604). Davida, et al. describe a suitable algebraic decoding method, called an (N,M,D) code. With an (N,M,D) code, an information vector of M bits (in our case, a canonical biometric template T), can be encoded into a codeword or code vector T^Cconsisting of the M-bit information vector concatenated with a (N-M) bit vector of error correction check digits (C). Once the check bits are determined, the check bits and the canonical template are stored for each user (block 606).

[0093] The verification process is illustrated in FIG. 12. During the verification process, j biometric measurements are independently generated on the user. These j biometric measurements, or vectors, are put through a majority decoder to obtain the user's M-bit biometric template T′. This biometric template T′ is the provided as part of an authentication message (block 100) and the biometric template T′ extracted from the message (block 610). Error correction is then performed on T′ using the previously computed check digits, C, (block 612) to obtain the corrected biometric template T″. The computed value of T″ is then compared for equality against the canonical biometric template T (or reference value) (block 614). If T″=T, then the user is accepted and the valid count incremented (block 108) as described above. It is then determined if the count of valid users exceeds the threshold for allowing authentication (i.e. have k users provided valid biometric information) (block 110). If the threshold has been reached, then an indication of authenticity is provided (block 112).

[0094] As is seen in block 616, if T″ and T do not match, then the procedure would be repeated using the T^Cvalues for additional users, until either a T″=T or until all T^Cvalues have been exhausted and no match is found, in which case the user is not identified and it is determined if more messages are to be processed (block 106). If more messages are available to process then the next message is obtained (block 100) and the validation process repeated. If however, no more messages are available to process, then there are insufficient users providing valid biometric information and the authentication of the users is rejected (block 114).

[0095] In another embodiment of the present invention, a secret value, such as a secret key SK, may be determined from shares of the secret value distributed to multiple users. Such an embodiment of the present invention is illustrated in FIGS. 13, 14 and.15. The operations of FIGS. 13, 14 and 15 allow the secret key SK to be recovered from any k canonical biometric template values T₁, T₂, . . . , T_nand corresponding offset values O₁, O₂, . . . , O_n. The canonical biometric template values T₁, T₂, . . . , T_nneed not be stored within the system, but instead they may be recomputed (on-the-fly) using the error correction codes described above.

[0096] In the example utilized in describing the operations of FIGS. 13, 14 and 15, there are n users denoted U₁, U₂, . . . , U_n. There also exists a system-defined public and private key pair, denoted PK and SK, used with a public key algorithm (e.g., the RSA cryptographic algorithm) for generating and verifying signatures. The private key, SK, is divided into n pieces or shares, denoted S₁, S₂, . . . , S_n(block 700). The precomputed shares S₁, S₂, . . . , S_nare used with an (n,k) threshold scheme, such that any k of the shares can be used to reconstruct the secret key SK. Pre-computed reference canonical biometric templates are determined for each user (block 702) and denoted by T₁, T₂, . . . , T_n. The canonical biometric templates are computed from j (j is an odd number) biometric measurements generated for each user and put through a majority decoder as described above. The precomputed shares S₁, S₂, . . . , S_nare assigned to users (block 704) and the canonical biometric templates T₁, T₂, . . . , T_nare used to compute offset values, denoted by O₁, O₂, . . . , O_n, where O_i=S_i⊕T_ifor i=1,2, . . . , n and “⊕” denotes the Exclusive-OR operation (block 706). An (N,M,D) code defined by the system is used to compute check digits, denoted C₁, C₂, . . . , C_n, for each canonical biometric template (block 708).

[0097] Each user U_istores an offset value O_iand check digits C_i(block 710). In the preferred embodiment of the invention, the values (U_i, O_i, C_i) are contained in a defined structure, such as a special biometric certificate, which is signed by a trusted authority and capable of being verified by the system using a trusted public key. For example, the system could make use of a public key infrastructure (PKI) in which biometric certificates are signed by a certification authority (CA). The biometric certificates are validated at the time the system needs to use the information contained within them to recompute the private signing key SK. Preferably, the users store the signed triple (U_i, O_i, C_i) for use when generating the secret key.

[0098] In the event that the private signing key is to be recovered, k users are selected and notified. Each user U_ithen carries out the operations illustrated in FIG. 14. As seen in FIG. 14, each notified user obtains its previously stored signed triple (U_i, O_i, C_i) (block 720). An odd number (j) of biometric measurements are independently generated on user U_i(block 722) Preferably, the measurements are performed at system-controlled devices and the integrity of the measurements can be protected by the system. The j biometric measurements, or vectors, are put through a majority decoder to obtain the user U_i′s M-bit canonical biometric template T_i′ as described above (block 724). Preferably, the integrity of the biometric template T_i′ once computed is protected by the system for the duration of its use. The biometric template T_i′ and the signed triple (U_i, O_i, C_i) are then sent to a central location under the control of the system where SK is to be recovered (block 726), e.g., a server controlled by the system.

[0099] The operations of FIG. 15 are performed at the central location when the users' data is received to recover SK at the central location. A user's template and signed triple are obtained (block 730) and the signed triple (U_i, O_i, C_i) is validated using the public key of the trusted authority (e.g., a CA) (block 732). If the signed triple is not valid then it is determined if more user data is available (block 734). If more user data is available, then the next user data is obtained the process begins again. If no more user data is available, then k valid user data was not received and the secret value SK cannot be recovered so the operation ends.

[0100] If the signed triple is valid, then error correction is performed on T_i′ using check digits C_ito obtain the corrected biometric template T_i″ (block 736). The values T_i″ and O_iare then used to compute the candidate value S_i″ as follows: S_i″=O_i⊕T_i″ (block 738). If fewer than k shares have been recovered (block 740), then it is determined if more user data is available (block 734) and if so the process repeated. If not, then the process ends.

[0101] If k shares have been recovered, then each of the recovered candidate values of S_i″, for each of the k users, is used with the prescribed (n,k) threshold scheme to recover the signing key SK (block 742). Those skilled in the art will recognize that S_i″=S_ifor each of the k users only if the users are valid, since only then are the users able to provide the correct j biometric measurements that will enable the recovery steps and the (n,k) threshold scheme itself to succeed.

[0102] The recovery system of FIGS. 13, 14 and 15, the precomputed shares S₁, S₂, . . . , S_nare preferably kept secret. This implies that offset values O₁, O₂, . . . , O_nshould also be kept secret, since the biometric data will (for practical purposes) be treated by the system as non-secret data. Therefore, it is preferred that each user protect the secrecy of their assigned offset value, and that the offset values are encrypted during periods in which they are transmitted to the central authority where they are used to recovery the key SK. Those skilled in the art will also recognize that there are many different protocols for establishing an encryption key between a user and a central authority (e.g., a server) and for accomplishing the required encryption operation. Accordingly, the present invention is not limited to any particular encryption methodology utilized between the user and the central authority.

[0103] As will be appreciated by those of skill in the art, the recovery system of FIGS. 13, 14 and 15 may also be utilized for multiparty authentication by testing the recovered secret value against a previously stored version of the secret value to determine if the two values correspond. If the recovered and stored secret values correspond, then the multiple parties are authenticated.

[0104] As each of the above described embodiments of the present invention allow for the use of multiple types of biometric information, it is preferred that the biometric information and types of biometric information associated with a user be maintained in a manner which allows for revising and/or changing the utilization of the biometric information for a given user. For example, the same exact biometric method may not withstand the test of time, due to different physical traits in individuals, due to injury relating to a body part associated with the particular biometric method, or due to any number of other factors, including social acceptance of certain techniques. Therefore, it is preferred that the embodiments of the present invention be capable of allowing different biometric validation techniques to be used concurrently or substituted over time.

[0105] To that end, it is preferred that a validation table which may be referred to as a “Biometric Substitution Table” be utilized in tracking biometric information associated with a user. This table is addressed with the user's user identification and contains the user identification (User ID), a primary biometric authentication value associated with the User ID, biometric templates associated with the User ID and, preferably, and identification of the type of biometric associated with each of the biometric template values. An example of such a table is illustrated in Table 1.

[0106] The above table may be utilized with the various embodiments of the present invention to store either encrypted or un-encrypted biometric templates, check bits or other biometric information associated with a user. Furthermore, while various embodiments of the present invention have been described as performing an exhaustive search to compare biometric information, as will be appreciated by those of skill in the art, if a user identification is provided by the users, then a comparison of only biometric information stored in the table associated with the user identification may be performed.

[0107] The above table structure allows for adding new biometric information associated with a user as well as changing the biometric information utilized to match with user provided biometric information by changing the primary biometric authentication type for a user. A procedure for changing the primary biometric authentication type of a user is illustrated in FIG. 16.

[0108] Changing the primary biometric authentication type for a user requires x distinct biometric validations. The number x is defined by a security policy. The ability to change the primary validation mechanism allows new and improved biometric techniques to be integrated over time and allows flexibility in implementation.

[0109] As an example, suppose that User 1, whose primary biometric authentication type is voice, would like to change its primary biometric authentication type to facial scan. Suppose, also, that two distinct biometric validations are required in order for the change to be authorized (i.e., x=2 for User 1). In that case, biometric validations based on any two biometric types (right thumb, facial scan, voice or left iris) would permit User 1's primary biometric authentication type to be changed from voice to facial scan. Thus, as seen in FIG. 16, User 1 would request to change the primary biometric authentication type and provide at least two different types of biometric information with the message (block 800). It would then be determined if the biometric information provided is sufficient to allow the primary biometric authentication type to be changed (block 802). If two different types of valid biometric information are not provided, then the message is rejected (block 804). Otherwise, the primary biometric authentication type is changed to the requested type and the table is updated to reflect the change (block 806).

[0110] The present invention has been described with reference to “messages” and “authentication messages” however, as will be appreciated by those of skill in the art, the messages according to the present invention may be initiated by a user or user's processor or may be received in response to a request for authentication information from a central authority. Furthermore, the present invention should not be limited to any particular format for messages but the term message is used in a generic sense to describe the conveying of information to the object, process, program or processor which utilizes the information for authentication, validation or value generation.

[0111] In the drawings and specification, there have been disclosed typical preferred embodiments of the invention and, although specific terms are employed, they are used in a generic and descriptive sense only and not for purposes of limitation, the scope of the invention being set forth in the following claims.