Method and terminal for entering instructions

[0001] This application is a continuation of PCT application N° PCT/CH00/00269 filed May 16, 2000, the content of which is hereby incorporated.

[0002] The present invention concerns a method and a terminal for entering instructions, in particular for eye-controlled entering of instructions in a data processing system.

[0003] Systems are already known that allow an apparatus to be controlled by the eye. Such systems are used among others whenever a hand control proves impossible or impracticable, or as an additional and fast input channel in order to control devices.

[0004] Document GB2281838 describes a device reacting to the user's blinking. A system for controlling the surroundings with the aid of the human eye is also described in the German utility model DE-U1-29610766. EP-A2-816984 describes a system that identifies the viewing direction on a screen in order to determine the image portions in which the viewer is interested.

[0005] U.S. Pat. No. 5,844,544 describes an eye-controlled device in which the user must follow a special protocol in order to select signs with the eyes. The device is calibrated to be adapted to each user. The protocol is the same for every user.

[0006] Eye movements are sometimes difficult to control; the eye also makes involuntary movements, among others saccades that under the circumstances could be interpreted as an instruction for the controlled device. These methods are therefore hardly suitable for entering security-critical instructions.

[0007] In many cases, the non-repudiation of the instruction is an important security criterion. It is important in particular during transaction operations that the transaction cannot subsequently be contested.

[0008] Furthermore, systems are known in which eye parameters are used as biometric keys to allow access to systems or services. It has among others been suggested to use the iris or retina motif to authenticate the viewer or even to identify him.

[0009] It is an aim of the invention to propose a new and improved method with which instructions can be entered with the eyes.

[0010] It is another aim of the invention to propose a new and improved system with which instructions are entered so that the intention of the person entering the instructions cannot be contested (non-repudiation).

[0011] It is another aim of the invention to propose a new and improved system with which instructions can be entered only by the authorized user.

[0012] According to the present invention, these aims are achieved in particular through the characteristics of the independent claims. Further advantageous embodiments are moreover described in the dependent claims and in the description.

[0013] In particular, these aims are achieved in that instructions are entered with voluntary movements of eye parts, the sequence required for entering a certain instruction being individual for each user.

[0014] This has the advantage that instructions are entered not only with a simple eye movement that could be made involuntarily, but with a sequence of several movements of eye parts that can only be made voluntarily. Thus, the non-repudiation of the instruction is ensured. Since the sequence for entering an instruction is individual for each user, it can also be used to authenticate the user.

[0015] In this manner, it is also possible to enter security-critical instructions (for example instructions for electronic transactions) that cannot be contested and for which a reliable authentication of the user is important.

[0016] Apart from the inventive transaction method, the present invention relates in particular to a terminal and a server for performing the method.

[0023] In FIG. 1, the reference number 1 refers to the user of a terminal 2, with which instructions for a remote server 4 can be entered and sent over a communication network 3. The terminal 2 is preferably portable and can in a preferred embodiment consist of a mobile radio telephone, a palmtop, a laptop, a PDA (Personal Digital Assistant), a mobile assistant or of a combination of different interconnected components, the connection being achieved over a interface with contacts, for example according to PC-Card, or preferably over a contactless interface, for example according to IrDA or Bluetooth. In a preferred embodiment, the terminal contains a chip-card (not represented), for example a SIM (Subscriber Identification Module) card, in which user-specific data are stored.

[0024] The terminal comprises a module 20 for determining the movements of eye parts. The module 20 consists for example of an eye tracker that can determine the current viewing direction based on the position of the pupil and/or head of the user 1. Such eye-tracking modules have among others been described in patent application WO94/09472. In a variant embodiment, the module 20 can determine also other types of voluntary movements of eye parts, for example blinking, as described in the aforementioned patent application GB2281838, or focusing, etc. According to the embodiment, the movements of only one eye or of both eyes can be determined; in the latter case, it is also possible to determine squinting eye movements.

[0025] If a simple eye-tracking module is used that does not determine the head's position, the absolute viewing direction is not determined. In this case, differential eye movements are preferably recorded—for example upper left—upper right—middle—upper right.

[0026] In order for the terminal to react only to the movements of live creatures and not for example to be deceived by the presentation of animated images, body reactions are preferably determined by the module 20. In a preferred embodiment, a parameter dependent on the body temperature is measured, for example the reaction of the retina to a warming caused through the terminal 2. In another variant embodiment, the reaction of the iris to light variations caused through the terminal 2 are determined. In this manner it is possible to check whether the determined image of the eye really belongs to a human.

[0027] The terminal 2 further comprises image reproduction means 21 that can reproduce visible images for the user 1. In a first variant embodiment, the image reproducing means 21 consist of a conventional display, for example of a CRT liquid crystal display or plasma display. In a preferred embodiment, they consist of a so-called micro-display with an appropriate lens system, preferably of a VRD (Virtual Retinal Display) that projects the represented image directly onto the retina of one or both eyes of the user 1.

[0028] Virtual Retinal Displays have been described for example in patent applications WO94/09472, WO97/37339 and WO98/13720 and therefore no longer need to be described. The VRD device is controlled by a video controller 22 in order to project image signals corresponding to a two-dimensional or three-dimensional image onto the fovea of the user's eye.

[0029] The terminal 2 is controlled by data processing means 23, for example in the form of a processor 23 with a memory area (not represented). The processor 23 controls in particular the video controller 22 and processes the data from the module 20 for determining the movements of eye parts. A software and/or hardware module 230 in the processor 23 or connected with this processor is responsible for securing the data transmission with external devices 4, for example by establishing a secure communication channel, as will be explained later.

[0030] The one skilled in the art will understand that the data processing means 23 and the security module 230 can be made from a single chip or from a plurality of logically interconnected components. In a preferred embodiment, in which the terminal 2 consists of a mobile telephone, the data processing means 23 preferably comprise components in the mobile telephone as well as components in the removable chip-card (SIM card) that is connected with this mobile telephone. In a preferred embodiment, in particular the security-critical components used by the security module 230 are located in the chip-card.

[0031] The terminal further comprises a communication part 24 with which it can connect with a communication network 3. The communication part 24 preferably consists of a GSM or UMTS communication part, of a modem or of a contactless interface at close range, for example according to IrDA, Bluetooth, HomeRF or DECT.

[0032] The communication network 3 is for example a mobile radio network, for example according to GSM or UMTS, but could also be the internet or consist of several networks. The terminal can connect with a remote server 4 over the communication network 3, for example with a http or WAP server, that is administered by the operator of the communication network 3 and/or by a service provider. The data transmission between the terminal 2 and the remote server 4 is preferably secured end-to-end, for example with the protocol SSL (Secure Sockets Layer), TLS (Transport Layer Security) and/or WTLS (Wireless Transport Layer Security). Data sent from the terminal 2 to the server 4 are preferably signed electronically by the security module 230, preferably with an electronic private key stored in an electronic certificate in the SIM card or in the security module 230.

[0033] The terminal 2 preferably comprises additional data input means (not represented), for example a keyboard, a mouse, a scroll element, a microphone etc., with which the applications in the processor 23 can be controlled.

[0034] The user 1 can establish a session with the server 4 by entering the corresponding URL address or telephone number in his terminal 2. A session can for example be established in order to perform a transaction between the user 1 and the service provider that administers the server, for example in order to order and/or pay for a product or a service of the service provider 4.

[0035] During a session, image data of the server 4 (for example HTML pages or WAP cards with an image content) are generally transmitted to the terminal 2 and reproduced to the user 1. At least certain image data preferably contain GUI (Graphical User Interface) objects, for example hyperlinks, control boxes, radio buttons etc. that can be selected or activated by the user for entering a certain instruction, for example to load another page or confirm a transaction.

[0036] At least certain GUI objects can be selected or activated with the eyes for entering an instruction (for example by directing at least one eye during at least a predefined time in this direction). Preferably, a visual and/or acoustic feedback is given as soon as the object has been selected.

[0037] The service provider's remote server 4 comprises a user profile database 40, in which profile data are registered for each user. The stored profile data comprise for each user among others the user-specific sequences of eye movements.

[0038] FIG. 2 shows diagrammatically a user 1 with a variant embodiment of the terminal according to the invention, here integrated in a pair of glasses. The glasses contain a mobile radio part 24, a VRD display device 21 that can project images onto the retina of the user 1, and an eye-tracking system. The reference sign 5 shows the projected image. In the represented example, this image comprises a plurality of GUI objects 50 that here correspond to a virtual digital keyboard. A key “C” enables the correcting of entered data whilst the key “ok” enables the confirming.

[0039] According to the invention, at least certain instructions are entered with sequences of voluntary movements of eye parts, the sequences that are required for entering a certain instruction being individual for each user. In the represented example, certain instructions are entered through eye-controlled selection of a user-specific sequence of keys 50.

[0040] FIG. 4 shows a data flux diagram, in which the possible method steps for the recording 100 of the user-specific sequence for an instruction in the learning phase is represented. In a first step 101, the user selects the instruction that is to be entered with a sequence of eye movements. If several instructions can be encoded for a certain application, the desired instruction can be chosen for example from a list that is made available by the server 4.

[0041] In the step 102, the user enters the sequence of eye movements that are to be associated with the chosen instruction. The sequence can for example comprise the following types of movements of eye parts:

• • [0042] Predefined viewing directions, preferably in the direction of GUI objects, for example of virtual keys 50. In this manner, a digital code can be entered simply by viewing the corresponding keys.
  • [0043] Blinking movements of a certain eye or of both eyes.
  • [0044] Voluntary squinting eye movements.
  • [0045] Focussing of the eyes at a certain distance. It is thus for example possible to select different GUI objects at different distances. In FIG. 3, a three-dimensional virtual keyboard, that can be reproduced to the user, is represented by way of example; the user can select a key by adapting the viewing direction and the focussing.
  • [0046] Etc.

[0047] Every individual eye movement recognized as such is preferably confirmed during this learning phase by the processor 23. The end of the sequence is preferably determined by selecting the virtual key “ok” or by a special, predetermined eye movement. The entire sequence is preferably confirmed a second time (step 103) or as often as necessary until predefined criteria about the quality of repetition have been fulfilled.

[0048] In step 104, the confirmation is compared with the first sequence. If the two sequences are different, the user is invited to repeat the whole process (arrow 105). Depending on the security requirements, the user may be required to enter a minimal number of eye movements per sequence or at least two different types of eye movements. If, on the other hand, the sequence is accepted, it is encoded by the data processing means 23, for example simply as digital sequence, packed in a receipt that is preferably signed and encrypted through the security module 230 (step 106). In the method step 107, this receipt is transmitted through the communication network 3 and received and decrypted by the server 4 of the service provider. In the method step 108, the decrypted sequence is linked with the user 1 and with the selected instruction and stored in the user profile database 40.

[0049] In a variant embodiment, the recorded sequence can also be stored in the terminal 2 instead of in a remote server.

[0050] The signature in step 106 serves mainly the purpose of identifying the user 1 reliably. In a variant embodiment, the receipt is signed with the user's private electronic key; the server 4 has the corresponding public user key, with which the received signature can be verified. In another embodiment, the receipt is linked with biometric parameters of the user, for example with an image of the user's retina and/or iris (recorded with a retina image recording unit, not represented), that are also sent to the server 4 and with which the user's identity can be reliably verified. It is also possible to use both signature methods simultaneously.

[0051] As already mentioned, it is also possible to determine a parameter dependent on body temperature and to link it with the receipt in order to verify whether the terminal 2 is really used by a human and is not being deceived by a reproduced image sequence.

[0052] FIG. 5 shows a data flux diagram in which the possible method steps for the entering 109 of an instruction with a sequence of voluntary eye movements is represented. The sequence of the eye movements necessary for a certain instruction is entered in step 110 by the user 1 and confirmed in step 111, for example with a blink or any other special eye movement. The entered sequence is encoded in step 112, electronically signed and preferably encrypted through the security module 230, the signature possibly comprising also biometric characteristics of the user. The signed sequence is transmitted in step 113 through the communication network 3 to the remote server 4, where it is decrypted and where the signature is verified. If the signature is correct, verification is performed in the database 40 during step 114 as to whether the received sequence corresponds to a stored sequence of the user (matching).

[0053] If no instruction is found in the database that corresponds to the received sequence, the user 1 is invited in method step 115 to enter a new sequence (arrow 116). If on the other hand a match is found, the instruction defined by the user can be extracted from the database (step 117) and, according to the instruction or the embodiment, can be either executed by the server 4 or transmitted to the terminal 2.

[0054] In a variant embodiment, in which the sequence recorded during the learning phase is stored only in the terminal 2, the sequence entered in the use phase is compared with all the sequences stored in the terminal.

[0055] The one skilled in the art will understand that many different instructions can be entered according to the application. The inventive method is suitable in particular for entering secrets (for example passwords or PIN numbers). It is however also possible to enter with this method other instructions (among others transaction confirmations with “yes” or “no”, or more complex requests that can also contain text and/or numerals as variables).

[0056] In the embodiment described, the sequence entered by the user is verified in the remote server 4 of a service provider. In a variant of the invention, the sequence of eye movements is verified in the terminal 2 or in the communication network 3. In this case, the individual verification sequence could be stored in the terminal 2 or preferably in the identification card in this terminal. It is also possible to enable the verification in the terminal 2 or in a remote server 4 with the same system depending on the application.