MACHINE LEARNED BIOMETRIC TOKEN

Embodiments of the invention(s) described herein enable a system that may rely on a biometric identifier entry validation system. The validation system “learns” the use pattern of a user. The validation system uses biometric methods such as facial recognition, palm veins, and thumb prints as an entry or passage token. When enough data has been collected, the validation system sends the user's biometric identifier to the use location within a bounded time frame when it expects a regular user to arrive at that location and within that time frame. In this manner the biometric identifier becomes a biometric token that replaces the need to use a form of fare media. Thus, the validation system becomes more efficient and recognizes a user faster after collecting data of a user for a short time. The validations system can record and interpret historic data. With this data, the validation system knows, on average, when to expect that passenger to arrive and where.

BACKGROUND OF THE INVENTION

Presenting fare media at a ticket gate causes a user backlog and also causes users to pass through the ticket gate at a less than maximal rate. This invention is related to bypassing the standard fare media presentation at the ticket gate using biometric identifiers associated with the fare media.

BRIEF SUMMARY OF THE INVENTION

One embodiment of the present invention is a computer processor implemented method of biometric identifier validation at an entry system. The method in this embodiment comprises: reading, on a first day, a fare media of a user at a first geographic location; recording a read time corresponding to the time the fare media was read; associating the read time with a time period, wherein the time period is a predetermined time interval during any 24 hour period that includes the read time; reading a first biometric identifier, wherein the biometric identifier corresponds to the user, associating the fare media, time period, and first biometric identifier with a record; sending, over a network, the record to a second geographic location; storing the record at the second geographic location in a data store; sending, over the network, the record to the first geographic location for use during the time period on a subsequent day; reading a second biometric identifier, corresponding to the user, on a subsequent day; comparing the second biometric identifier with the first biometric identifier to determine the second biometric identifier is tolerably similar to the first biometric identifier; and allowing the user to pass without producing the fare media. In a variation of this embodiment the entry system is for a transit system, entertainment venue, sporting venue, multi-family residence, or a personal services venue. In yet another variation of this embodiment the biometric identifier is one of a fingerprint, palm veins, facial characteristics, DNA, a palm print, band geometry, an iris, or a retina. In a further variation of this embodiment the first geographic location and the second geographic location are co-located. And in yet another variation of this of this method the first geographic location and the second geographic location are not co-located. Another variation of this embodiment comprises deleting the record at the first geographic location after the end of the first time period on the subsequent day. In yet another variation of this embodiment comprises adding the second biometric identifier to the record.

A second embodiment of the invention is a non-transitory computer readable medium having sets of instructions stored thereon for biometric identifier validation for an entry system which, when executed by computer, cause the computer to: read, on a first day, a fare media of a user at a first geographic location; record a read time corresponding to the time the fare media was read; associate the read time with a time period, wherein the time period is a predetermined time interval during any 24 hour period that includes the read time; read a first biometric identifier, wherein the biometric identifier corresponds to the user, associate the fare media, time period, and first biometric identifier with a record; send, over a network, the record to a second geographic location; store the record at the second geographic location in a data store; send, over the network, the record to the first geographic location for use during the time period on a subsequent day; read a second biometric identifier, corresponding to the user, on a subsequent day; compare the second biometric identifier with the first biometric identifier to determine the second biometric identifier is tolerably similar to the first biometric identifier; and allow the user to pass without producing the fare media. In a variation of this embodiment the entry system is for a transit system, entertainment venue, sporting venue, multi-family residence, or a personal services venue. In yet another variation of this embodiment the biometric identifier is one of a fingerprint, palm veins, facial characteristics, DNA, a palm print, band geometry, an iris, or a retina. In a further variation of this embodiment the first geographic location and the second geographic location are co-located. And in yet another embodiment of this method the first geographic location and the second geographic location are not co-located. Another variation of this embodiment comprises deleting the record at the first geographic location after the end of the first time period on the subsequent day. In yet another variation of this embodiment comprises adding the second biometric identifier to the record.

A third embodiment of the invention is a system for biometric validation for an entry system. The system comprise a fare gate processor configured to: read, on a first day, a fare media of a user at a first geographic location; record a read time corresponding to the time the fare media was read; associate the read time with a time period, wherein the time period is a predetermined time interval during any 24 hour period that includes the read time; read a first biometric identifier, wherein the biometric identifier corresponds to the user, associate the fare media, time period, and first biometric identifier with a record; and send, over a network, the record to a second geographic location. The system further comprises a central processor configured to store the record in a central data store and send, over the network, the record to the first geographic location for use during the time period on a subsequent day. And the system further comprises the fare gate processor further configured to: read a second biometric identifier, corresponding to the user, on a subsequent day; compare the second biometric identifier with the first biometric identifier to determine the second biometric identifier is tolerably similar to the first biometric identifier; and allow the user to pass without producing the fare media. In a variation of this embodiment the entry system is for a transit system, entertainment venue, sporting venue, multi-family residence, or a personal services venue. In yet another variation of this embodiment the biometric identifier is one of a fingerprint, palm veins, facial characteristics, DNA, a palm print, band geometry, an iris, or a retina. In a further variation of this embodiment the first geographic location and the second geographic location are co-located. And in yet another embodiment of this method the first geographic location and the second geographic location are not co-located. Another variation of this embodiment comprises deleting the record at the first geographic location after the end of the first time period on the subsequent day. In yet another variation of this embodiment comprises adding the second biometric identifier to the record.

DETAILED DESCRIPTION OF THE INVENTION

Biometric data is generally considered to be metrics that are related to human characteristics. Biometrics authentication is a method used in conjunction with characteristic recognition and computer processing as a form of identification and access control. Such a biometric identifier becomes a travel token that can be used in place of forms of fare media. Biometric identifiers can be distinctive, measurable characteristics used to identify, label, and describe an individual. Biometric identifiers are often categorized as physiological versus behavioral characteristics. These biometric physiological characteristics can be typically related to the shape of the body. Some examples include, but are not limited to fingerprint, palm veins, face recognition, DNA, palm print, hand geometry, iris recognition, retina recognition, as well as an individual's odor and scent. Some biometric behavioral characteristics can be related to an individual's behavior patterns, including but not limited to typing rhythm, gait, and voice. Proper biometric use is very application dependent. Certain biometrics will be better than others based on the required levels of convenience and security. No single biometric will meet all the requirements of every possible application. This specification may refer to one of these, facial recognition, but one of skill in the art will realize that any biometric characteristic suitable for this application could be used in place of facial recognition.

Biometric authorization replaces the more traditional means of access control that typically can include token-based identification systems, such as an issued ticket, a driver's license, passport, or other form of government issued identification, and knowledge-based identification systems, that can include such things as passwords or personal identification numbers. Since biometric identifiers are unique to individuals, they can be considered in most cases more reliable in verifying identity than token and knowledge-based methods.

Embodiments of the invention(s) described herein enable a system that may rely on a biometric identifier entry validation system. The validation system “learns” the use pattern of a user. The validation system uses biometric methods such as facial recognition, palm veins, and thumb prints as an entry or passage token. When enough data has been collected, the validation system sends the user's biometric identifier to the use location within a bounded time frame when it expects a regular user to arrive at that location and within that time frame. In this manner the biometric identifier becomes a biometric token that replaces the need to use a form of fare media. Thus, the validation system becomes more efficient and recognizes a user faster after collecting data of a user for a short time. The validations system can record and interpret historic data. With this data, the validation system knows, on average, when to expect that passenger to arrive and where.

The advantages of the using the biometric authentication in the present invention can include, for example: a more secure travel token compared to all other current fare media, media that can be stolen or forged; no requirement for users to carry extra ticketing or rely on their user device ticket; allowing scalability of biometric identification database sizes; allowing for a quicker biometric identification using machine learning; and allows the validation system to download biometric information to station databases only at the times when it is needed.

Generally biometric authentication is a two-step process comprising a verification step and an identification step. In the first step, the validation system associates an individual or fare media (FM) with a biometric characteristic of the individual or user of the FM. In the identification step the validation system performs a one-to-many comparison against a biometric database in an attempt to establish the identity of an unknown individual. The system will succeed in identifying the individual if the comparison of the biometric sample to a biometric identifier in the database falls within a previously set threshold. This step is process and memory intensive. Since testing against every known biometric identifier in the validation system could take minutes—the present invention adds a third step—that of predicting when the individual will need validation at a particular physical location. In this manner—the validation system can download that individual's biometric identifier to a local station during a particular time period. Thus—the database at the local station need only store those biometric identifiers that are predicted to need validation during a particular time period, reducing the number of biometric identifiers at each local biometric identifier store to match against.

FIG. 1illustrates a block diagram of an embodiment of a transit system100, in communication with other systems. The transit system100can be used with any desired form of transit including, for example, subway, bus, ferry commuter rail, rail, para-transit, airplane, etc., or any combination thereof, and can be used to coordinate and/or control the operation of the other systems in providing services, including, transportation services.

The transit system100can include a central control system110. The central control system110can include one or more servers and/or other computing systems having processors, memories, and network interfaces for processing and communicating information.

In the specific embodiment shown inFIG. 1, the central control system110can include a central certificate system112. The central certificate system112can comprise one or more servers and/or other computing systems having processors, memories, and network interfaces for processing and communicating information. In some embodiments, the central certificate system112can be configured to provide information, receive information, and/or to track information relating to ticketing. In some embodiments, the central certificate system112can store information within a central data store114. This information can include biometric identifiers. It will be recognized that such a transit system100can be enabled for use in applications beyond transit, such as transportation systems (e.g., airline systems, car rental systems, etc.), building entry, and event entry.

In another embodiment shown inFIG. 1, the central control system10can include a central biometric validation system116. One of skill in the art can recognize that central biometric validation system116could be included in certificate system112. The central biometric validation system116can be connected to wide area network140. Through wide area network140the central biometric validation system116can communicate with station systems130. The central biometric validation system116can also be connected to central data store114so that it can share data with the certificate system112. The central biometric validation system116can also be connected to a central biometric identifier store118. One of skill in the art can recognize that the central biometric identifier store118could be included in the central data store114. The central biometric identifier store118may store system-wide biometric identifiers that are sent to the station systems130in time periods that correspond to the learned time periods that the account holder or fare card associated with the biometric identifier is predicted to pass through the station system130.

The central biometric validation system116may predict when to send a biometric identifier to station system130in various ways. First—an account holder may enter predicted times when the holder will be at a station when creating or updating their account either at a TV machine212shown inFIG. 2, with a user device180, or a non-user device or other methods. The account holder can also input the holder's biometric identifier using many methods including scanning thumbprints, taking a facial picture, taking a thumbprint picture, taking a palm print picture, or any other number of ways of inputting biometric characteristics. Thus, the central biometric validation system116knows what biometric identifier to retrieve from the central biometric identifier store118associated with the account holder to send to station system130and when to send it.

In another embodiment the central biometric validation system116may learn when to send the biometric identifier associated with an account holder. The central biometric validation system116may receive a biometric identifier associated with an account holder when the account holder presents FM250(FIG. 2) to pass through a fare gate (FG)260at station system130. Once the central biometric validation system116determines that the same FM250holder is presenting the FM250associated with the same biometric identifier at the same station system130at the same time for a predetermined number of occurrences—the central biometric validation system116alerts station system130that it has “learned” this information so that the FM250holder is notified that the holder no longer needs to present FM250to pass through an FG260for the length of time left on FM250—or alternatively use a different ingress point allocated for biometric identification. One of skill in the art can appreciate that there are many variations of this idea including FM250that are value based such that as long as there is vale left on the FM250the holder can pass using only biometric identification in some circumstances.

In yet another embodiment the central biometric validation system116can also learn to send the biometric identifier associated with a FM250such as a purchased monthly pass. The central biometric validation system116may receive a biometric identifier associated with the FM250when the account holder presents the FM250to pass through an FG260at station system130. Once the central biometric validation system116determines that the same account holder is presenting the FM250associated with the account holder at the same station system130at the same time for a predetermined number of occurrences—the central biometric validation system116alerts station system130that it has “learned” this information so that the account holder is notified that the holder no longer needs to present FM250to pass through an FG—or alternative use a different ingress point allocated for biometric identification

The transit system100can include one or several station systems130. In some embodiments, the station system130can comprise one or several systems and/or devices located within the station and/or within a mobile environment, which systems and/or devices can be used for ticketing and/or access control. Station systems130can gather information regarding transactions and communicate the information to the central certificate system112using a wide area network140. The wide area network140can include one or more networks, such as the internet, which one or more networks may be public, private, or a combination of both. The wide area network140can be packet-switched or circuit-switched connections using telephone lines, coaxial cable, optical fiber, wireless communication, satellite links, and/or other mechanisms for communication. Communication between the station systems130and the central control system110may be in real time or periodic. Thus, the usage of FM250throughout the transit system100can be tracked and associated with the corresponding biometric identifier of the FM250holder.

In one embodiment biometric identifiers can be communicated from the central certificate system112to the station system130via the wide area network140. In other embodiments, changes in schedules, ticket prices, and delay notifications can be communicated from the central certificate system112to the station systems130via the wide area network140.

In some embodiments, the transit system100can include a user services190that can be maintained and/or provided by the transit service provider of the transit system100. In some embodiments, the user services190can comprise a call center and/or any other source of user support and/or service.

The user can be identifiable and/or identified by the transit system100. In some embodiments, the user can have, for example, a user account. The user account can comprise information regarding a certain user of the transit system100, such as a name, address, phone number, email address, user identification (such as a unique identifier of the user or other user ID), passcode (such as a password and/or personal identification number (PIN)), an identification code associated with a FM250used to identify a user and/or a transit user account (such as a primary account number (PAN)), information regarding user preferences and user opt-in or opt-out selections for various services, product(s) associated with the transit user account, a value and/or credit associated with the product(s), information regarding a value source for the transit user account, and more. The user's biometric identifier can be pre-populated in the user account in one embodiment. In yet another embodiment the user's biometric identifier is associated with the user account once the validation system associates the user with the associated biometric identifier.

The user may request a user account and provide the information listed above by phone (such as a call to the user services190maintained and/or provided by the transit service provider of the transit system100), on the Internet, at ticket booth, at a ticket vending machine, or by other means. The central certificate system112can use the information provided by the user to create the user account that can be stored and/or maintained on a database, such as the central data store114of the central control system110.

In some embodiments, the transit system100can complete a transaction with the value source165via an institution160. In some embodiments, this transaction can occur via institute network150, and in some specific embodiments, the central certificate system112can communicate with an institute network150to complete a transaction with the value source165

In some embodiments, transit system100can communicate with one or several users operating a user device180. The user device180may be communicatively coupled with the central control system110. Such a user device180may be a smart phone or other mobile phone (including a near-field-communication enabled mobile phone), a tablet personal computer (PC), a personal digital assistant (PDA), an e-book reader, wearable device or other device. In transit system100, a communicative link from user device180to central certificate system112can be provided by a user network170in communication with wide area network140. User device180can thereby communicate with the central certificate system112to access and/or manage information of a user account. Furthermore, the central certificate system112can send messages to the user device180, providing transit, account, and/or other information to a user of the transit system100in possession of the user device180. Such messages may be based on, among other things, opt-in or opt-out selections and/or other user preferences as stored in a user account. In some embodiments, the user network170can comprise any type of communications including Bluetooth, local area network, intranet, wired internet, wireless internet, mobile communication network including, for example, cellular network, radio network, and/or the like.

A user can use the user device180to download a transit application from a transit application source120. The transit application source120may be an application store or website provided by a mobile carrier, the hardware and/or software provider of the user device180, and/or the transit service provider. The transit application can be uploaded or otherwise provided to transit application source120by the transit service provider. According to some embodiments, the transit application can provide additional functionality to the user device180, including enabling a near field communication (NFC)-enabled user device to be used as FM250and access control points of the transit system100. The transit application can also allow the user to input one or more biometric identifiers including a facial picture, thumb print, palm print or any other biometric identifier. A user can access and/or use the transit system100in a variety of ways. In some embodiments, for example, the user can access the transit system100via the user device180and/or via one or several of the station systems130.

FIG. 2shows a block diagram of an embodiment of a station system130. In some embodiments, the station system130can control ticketing operations and/or other operations relating to and/or involving the transit system100. In some embodiments, the station system130can be associated with a specific geographic location such as, for example, a train station, an airport, a subway station, a bus station, a dock, a harbor, a retail location and/or any other location, and in some embodiments, the station system130can be associated with a mode of transit such as, for example, a bus, train, taxi, a boat, ferry, an airplane, a lift, and/or any other mode of transit.

Because different forms of transit may require different functionality, various station systems130may have some or all of the components shown in the block diagram. The components of the station system130can be communicatively linked to each other so as to allow the sending and receiving of information between the components of the station transit system130. In some embodiments, this link can comprise a wired and/or wireless network. In the embodiment shown inFIG. 2, the components of the station system130can be linked by a local area network240. The local area network24010couple the various systems together and can include point-to-point connections, packet switched connections, wireless connections, and/or other networking techniques.

The station transit system130can include a local server224that can be coupled to the wide area network140to allow communication with the central certificate system112. Processing of local information can be performed on the local server224. For example, fare information, schedule information, delay update information, and other transit related information can be processed at the local server224and communicated to the various other machines in the transit system100.

A ticket booth (TB) computer220, and ticket vending machines (TV machines)212can communicate with the central certificate system112through the station computer server224or directly with the central certificate system112through local area network240or wide area network140(e.g., the Internet).

The TV machines212, and one or more TB computers220, can communicate with the local server224via the local area network204. This communication can be transmitted via a physical connection or wireless connection via one or more antennas228. Transactions at access control points208, TV machines212, and one or more TB computers220can be communicated to the local server224, stored at local data store216, and/or transmitted to central ticketing system, which can update information in a transit user account accordingly.

Fare Gate (FG)260also communicates with local area network240to the transit system100and can also communicate over the wide area network140. The FG260uses either network to communicate with certificate system112. FG260also communicates with Fare Media (FM)250. FG260can transmit FM250information over the local area network to local biometric validation system266to associate FM250with any biometric identifier collected at the FG260. The local biometric validation system266communicates over the local area network240with local biometric identifier store264to retrieve biometric identifiers downloaded to the local biometric identifier store264over the local area network240from the central biometric validation system118. One of skill in the art can recognize that local biometric validation system266can be included in the local server224. Biometric identifiers in the local biometric identifier store264may correspond to the predicted biometric identifiers associated with FM250and account holders at the station system130for a given time period. One of skill in the art can recognize that local biometric identifier store264can be included in local data store216. External camera262communicates over local area network240and can transmit digital images corresponding with biometric identifiers to the local biometric validation system266and/or the central validation system116.

Various portable and/or handheld media with a unique identifier can be used as FM250, whether or not the media is issued by a transit services provider. Such media can include identification cards, payment cards, personal electronic devices, bar codes and items having bar codes, contactless devices, and more. Contactless devices can include media having a unique identification code readable by access control points though near field communication signals (e.g., radio frequency signals). By way of example, but not by limitation, such contactless devices can include devices comprising radio frequency identification tags and/or radio frequency identification-tagged items, contactless payment cards (including but not limited to credit cards, prepaid cards, debit cards, or other bank cards or contactless smart cards.), contactless identification cards and/or fobs, and near field communication-enabled user devices.

FM250can have multiple sources of information, which may be read automatically by certain systems and devices in the transit system100, depending on desired functionality. For contactless devices, such sources can include an integrated circuit, memory, and/or contactless interface of the device. Additionally or alternatively, contactless devices and other forms of FM250can include a magnetic stripe, a bar code, and/or data imprinted and/or embossed on the device, which can serve as additional sources of information. Contactless and other sources of information can serve as repositories of account information related to, for example, a financial or user account associated with the FM250(which may not be associated with the transit system100).

TV machines212may interact directly with a FM250through, for example, a contactless connection232. Although communication of the contactless connection232may be two way, FM250may simply communicate an identification code to TV machine212. This can be done, for example, to authenticate a contactless device for use as FM250in the transit system100. A contactless device does not have to be issued by a transit service provider in order to be authenticated and used as FM250in the transit system, as long as the information communicated by the FM250to the TV machine212(and subsequently to access control points208for passage in the transit system100) serves to uniquely identify the FM250. Such an authentication process is provided in greater detail below.

All or part of the information communicated by the FM250can be used as an identification code to identify the transit FM250. This identification code can comprise one or more fields of data including or based on information such as a name, a birth date, an identification number (such as a PAN), a social security number, a driver's license number, a media access control (MAC) address, an electronic serial number (ESN), an international mobile equipment identifier (IMEI), and more. Because the identification code is unique, it can be associated with a transit user account, and utilized by a user at a TV machine212to access and/or update information associated with the transit user account.

In some instances, an identification code may be assigned by a transit service provider and written to the FM250, such as an near field communication-enabled user device280. For example, a transit application running on a near field communication-enabled phone can generate or otherwise provide an identification code to be transmitted from the phone at access control points of the transit system100. In other instances, if TV machine212is utilized to enable a user to create a transit user account, the TV machine212may also write an identification code to an unused portion of a memory of the FM250, such as integrated circuit chip file space on a smart card or a near field communication component on the near field communication-enabled user device280.

InFIG. 3a perspective view of an embodiment of a TV machine212are shown. One of ordinary skill in the art will recognize the TV machines can vary in appearance and functionality. TV machines can be much smaller and comprise fewer functional components that are pictured here and can also comprise more functional components. The TV machine212can facilitate the vending of tickets and the completion and performance of a transaction between the user and the station system130. The TV machine212can comprise a variety of shapes and sizes and can include any desired combination multiple components. Further explanation of the function of a TV machine212are discussed in detail in U.S. patent application Ser. No. 13/942,366 filed on Jul. 15, 2013 entitled “ON-BOARD ONWARDS TRAVEL ENABLEMENT KIOSK,” which is fully incorporated by reference herein. The TV machine212may contain a biometric identifier reader366. The biometric identifier reader366may be a form of biometric identification reader including fingerprints, thumbprints, retina scans, palm prints, palm veins, or facial characteristic reader. The biometric identifier reader can be a digital imagery device, a scanning device, or any other form of biometric identifier reader. A FM250purchaser or account holder can pre-populate their biometric identifier using the biometric identifier reader366. When this happens—the process of biometric identifier validation can be faster since the biometric identifier is already known.

Referring now toFIG. 4that depicts in more detail the FG260and the external camera262in one embodiment of the present invention. One of ordinary skill in the art will recognize that FG260can vary in appearance and functionality as can external camera262. External camera262can capture and transmit a facial biometric identifier over the local area network240. FG260can have an audio system420. Audio system420can give verbal instructions on using any of the components of FG260. For instance, in one embodiment audio system420can alert the FM250holder that the biometric identifier associated with the FM250has been approved for that station system130during that time period such that the FM250holder no longer needs to use the FG260to use the transit option available there. FG260can contain a display system410. For instance, in another embodiment, display system410can display a message for the FM250holder that the biometric identifier associated with the FM250has been approved for that station system130during that time period such that the FM250holder no longer needs to use the FG260to use the transit option available there. In other embodiments the display system410can display any manner of other messages including instructions for using FG260, instructions for using the transit system100, and advertising. FG260can also comprise a FM250reader405. FG260can also have a biometric identifier reader366. In some embodiments the biometric identifier366can be a scanner or a digital imaging device. FG260may also have a turnstile or other physical barrier associated with it that prevents entry until FM250or the biometric identifier366is verified.

With reference now toFIG. 5that depicts a block diagram of components of FG260in one embodiment of the present invention in communication with LAN240. In this embodiment the FG processor500, comprising a CPU or other type of hardware processing unit including associated memory, communication, and other components as described inFIG. 12for user device180, communicates with the local area network240. The FG processor can communicate with the display system410and provides the messaging presented on the display system410. FG processor500can generate the messages to be displayed on the display system410or receive the message to be displayed from any number of sources over local area network240. The FG processor500can communicate with the audio system420. The FG processor500can generate the messages broadcast from the audio system420or receive the message to be broadcast from any number of sources over the local area network240. The FG processor500can communicate with FM reader405. The FG processor can determine if the FM250allows passage or can send the FM250information over the local area network240to make the determination. The FG processor can also communicate with the FM250in some embodiment directly or pass information and instructions from other sources connected to the local area network240. The FG processor500also communicates with biometric identifier reader366. The FG processor500passes biometric identifiers read by the biometric identifier reader366over the local area network to the local biometric validation system266.

With reference now toFIG. 6A, a flow chart600for one embodiment of the present invention depicting the biometric identifier validation learning process for user with a monthly entry system100pass. Starting at605, the FG260(shown inFIGS. 4 and 5) reads the FM250. At this point, the system100depicted inFIG. 1must determine if FM250is recognized at615. If it is, the next block620determines if there are 30 or more days left on the FM250. Those of skill in the art will recognize that in other embodiments a FM250that expires in more or less than 30 days could be used. Further—a value based FM250could also be used. Once it is determined at block620that the FM250has the requisite number of days before expiration, at block625the biometric identifier is read. The current time is determined at block630. At block635the current time is associated with a time period. One of skill in the art can recognize that this can be accomplished in many different ways. For instance, in one embodiment if the current time falls within a predetermined time period of between the hour and a half hour—then that is the time period selected. In other embodiments other time periods can be used such as 15 minute intervals. In yet other embodiments if the current time is closer to the beginning of the time period than the end, then the time period before and the current time period are associated. In this same embodiment, if the current time is closer to the end of the current time period than the beginning, both the current time period and the next time period can be associated with the current time. At block637a counter called number of passes (NOP) is set to one. In the next block640, the time period, FM250, NOP, and the biometric identifier are associated with a FM record. At the next block645, the FM record is transmitted to the central biometric validation system116and stored in the central biometric identifier store118. The process is over at the next block680until the FM250is used again. In this case the user of FM250passes normally through FG260.

Referring now back to block615, if the FM250is recognized as being associated with a FM record, the current time is compared to the time period in the FM record at block650. If the current time falls within the time period associated with the FM record, the biometric identifier of the user of the FM250is read at block655. At block660, this biometric identifier is compared to the biometric identifier stored in the FM record. If it matches within predetermined constraints then at block665it is determined if this match has occurred a predetermined number of times, X. One of skill in the art will recognize that X is variable and can be different for different transit systems100. In some cases, for example, it can be more than 10, exactly 10, and in others less than 10. In some cases only the first match is required. In other cases 30 or more may be required. In any case, if the threshold X is met then at block670the FM250user is alerted that the user will no longer be required to use the FM250to pass through to use the transit option. The FG260can alert the user with audio via the audio system420, send a message to the display system410, or use another method of alerting. At block675the FM record is approved for biometric identifier validation such that on the next valid time period the FM record will be sent to the local biometric identifier store264. At block680the process is over and the FM250holder passes through FG260. On the holder's next trip that meets the FM record criteria, the holder will not need FM250to pass through FG260or will be able to use an alternative passage for those approved for biometric identifier validation.

Any number of blocks can terminate the biometric identifier learning process. For instance, at block650if the current time period doesn't match the record then the process ends at block680. One of ordinary skill in the art can recognize that instead of ending at block680, in one embodiment the next block could be block635where the time period associated with the FM record is determined based on the current time. At block660if the biometric identifier read doesn't match the biometric identifier in the FM record then the process is over at block680. Again—one of ordinary skill in the art can recognize that at block660if the biometric identifier doesn't match the biometric identifier associated with the FM record—other blocks can be taken to replace the associated biometric identifier, delete the FM record, or any other number of actions as a measure to prevent fraud or assist in the learning process. At block665if the NOP is not at least X then at block667the NOP is incremented by one. The next block680is the end. Once reaching this block the process at FG260proceeds normally.

Looking now atFIG. 6Bthat is a flow chart602of an embodiment of the invention wherein the FM250holder is an account holder. In this instance the method follows very closely to that inFIG. 6Aexcept that there is no block to determine how many days before expiration the FM250has And at block765, the account holder can be alerted in various ways related to the information associated with the account in addition to the ways described inFIG. 6A. For instance a text or email message can be sent to the account holder.

Referring now toFIG. 7, a flow chart of700of a method for machine-learned biometric identifier validation in an entry system. The entry system can be for a transit system, entertainment venue, sporting venue, multi-family residence, or a personal services venue—but is not limited to any of these. The biometric identifier can by on a fingerprint, palm veins, facial characteristics, DNA, a palm print, hand geometry, an iris, or a retina—but is not limited to these. The method starts at block705. At block710fare media of the user is read at a first geographic location on a first day. The fare media reader can be a fare gate comprising a processor. At block715the time of reading the fare media is recorded by the processor. At the next block720—a predetermined time period during any 24 hour period that the time the fare media was read is associated with the reading time. Predetermined intervals can be few minutes to a few hours and will be further explained at block740. At block725, the user's first biometric identifier is read. How it is read is depending on the type—for a picture is taken if it is facial characteristics or a fingerprint is scanned if that is it. At block730the fare media, reading time, and the first biometric identifier is associated with a record. At block735, the fare media is stored at a second geographic location. The second geographic location can be co-located with the first geographic location or not co-located. At block740the fare media record is sent to the first geographic location for use during the time period on a second day. The predetermined time periods may correspond with how much memory is available and how many records are sent to a location. If there is more memory than then the predetermined time periods can be longer or more records can be sent or a combination of both. If less memory is available—then few records can be sent or the time periods are shorter or both. At block745the user's second biometric identifier is read on a second. At block750the first biometric identifier is compared to the second biometric identifier to see if they match within a predetermined tolerance. The tolerance could be less than 1%, 1%, or more than 1%—and will be determined by any number of variables including the accuracy of the biometric identifier reading device. At block755, if the biometric identifiers are “tolerably” similar to each other—or within the predetermined tolerance—then the user is allowed to pass without presenting the fare media.

Referring now toFIG. 8that shows a flow chart800of storing the FM record in the central data store114shown inFIG. 1. Starting at block805and proceeding to block810where the FM record is received. Then at block815the time period (TP) associated with the FM record is determined. At block820the FM record is stored according to the time period. It can be understood by one of skill in the art that the central biometric identifier store118can index FM records by any parameter including biometric identifier, FM250, and time period. The FM record store process ends at block825.FIG. 9is a flow chart900that shows the process of populating the FM records at the local stations at the appropriate time periods when they will be needed. The process starts at block905and at block910the current time period is determined. At block915the FM records corresponding to the current time period are identified. At block920the identified FM records are sent to the appropriate local stations so that they can be used for biometric identifier validation. The process ends at block920.

Looking now atFIG. 10that depicts the flow chart1000for validating a biometric identifier (BI) for passage in one embodiment of the present invention at a station system130shown inFIGS. 1 and 2. After starting at1005the next block is to purge FM records from the local biometric identifier store264. Biometric identifiers typically are very large files and they take a long time to compare. Thus—the fewer predicted identifiers to match—the less memory and processing time is required. At block1015the FM records for the current time period are received and stored. Next at block1020the current biometric identifier from a traveler is received. The current biometric identifier is then compared with the biometric identifiers in the FM records at block1025. If a match is found at block1030, then at block1035the traveler is allowed passage. At block1040the FM record corresponding to that biometric identifier is deleted from the local biometric identifier store264to reduce the number of stored records and to make subsequent biometric identifier comparisons at block1025faster. However, in some embodiments the subsequent biometric identifier may be sent to the central biometric store118to be added to the fare media record of the user. In this manner the fare media record can build a history and create a confidence level in the activity of the user. At block1045the process ends and the traveler proceeds without producing the FM250. If, on the other hand, a match is not found at block1030, the traveler is denied passage at block1050. The biometric identification process is ended for that traveler at block1055. Any number of options might be available to the traveler at that point, including buying a FM250or validating the FM250at a FG260as normally would be done.

With reference now toFIG. 11, an exemplary environment with which embodiments may be implemented is shown with a user device180that can be used by a user1104. The computer system1100can include a computer1102, keyboard1122, a network router1112, a printer1108, and a monitor1106. The monitor1106, processor1102and keyboard1122can be parts of user device180, that may be a smart phone or other mobile phone (including a near-field-communication enabled mobile phone), a tablet personal computer (PC), a personal digital assistant (PDA), an e-book reader, wearable device, or other device. The monitor1106can be a CRT, flat screen, etc.

A user1104can input commands into the computer1102using various input devices, such as a mouse, keyboard1122, track ball, touch screen, voice command, etc. If the computer system1100comprises a mainframe, a designer1104can access the computer1102using, for example, a terminal or terminal interface. Additionally, the user device180may be connected to a printer1108and a server1110using a network router1112, which may connect to the Internet1118or a wide area network.

The server1110may, for example, be used to store additional software programs and data. In one embodiment, software implementing the systems and methods described herein can be stored on a storage medium in the server1110. Thus, the software can be run from the storage medium in the server1110. In another embodiment, software implementing the systems and methods described herein can be stored on a storage medium in the computer1102. Thus, the software can be run from the storage medium in the user device180. Therefore, in this embodiment, the software can be used whether or not computer1102is connected to network router1112. Printer1108may be connected directly to computer1102, in which case, the user device180can print whether or not it is connected to network router1112.

With reference toFIG. 12, an embodiment of a special-purpose computer system1204is shown. The above methods may be implemented by computer-program products that direct a computer system to perform the actions of the above-described methods and components. Each such computer-program product may comprise sets of instructions (code) embodied on a computer-readable medium that directs the processor of a computer system to perform corresponding actions. The instructions may be configured to run in sequential order, or in parallel (such as under different processing threads), or in a combination thereof. After loading the computer-program products on the user device180, it is transformed into the special-purpose computer system1204.

Special-purpose computer system1204comprises a computer1102, a monitor1106coupled to computer1102, one or more additional user output devices1230(optional) coupled to computer1102, one or more user input devices1240(e.g., keyboard, mouse, track ball, touch screen) coupled to computer1102, an optional communications interface1250coupled to computer1102, a computer-program product1205stored in a tangible computer-readable memory in computer1102. Computer-program product1205directs system1204to perform the above-described methods. Computer1102may include one or more processors1260that communicate with a number of peripheral devices via a bus subsystem1290. These peripheral devices may include user output device(s)1230, user input device(s)1240, communications interface1250, and a storage subsystem, such as random access memory (RAM)1270and non-volatile storage drive1280(e.g., disk drive, optical drive, solid state drive), which are forms of tangible computer-readable memory.

Computer-program product1205may be stored in non-volatile storage drive1280or another computer-readable medium accessible to computer1102and loaded into memory1270. Each processor1260may comprise a microprocessor, such as a microprocessor from Intel® or Advanced Micro Devices, Inc.®, or the like. To support computer-program product1205, the computer1102runs an operating system that handles the communications of product1205with the above-noted components, as well as the communications between the above-noted components in support of the computer-program product1205. Exemplary operating systems include Windows® or the like from Microsoft® Corporation, Solaris® from Oracle®, LINUX, UNIX, and the like.

User input devices1240include all possible types of devices and mechanisms to input information to computer system1102. These may include a keyboard, a keypad, a mouse, a scanner, a digital drawing pad, a touch screen incorporated into the display, audio input devices such as voice recognition systems, microphones, and other types of input devices. In various embodiments, user input devices1240are typically embodied as a computer mouse, a trackball, a track pad, a joystick, wireless remote, a drawing tablet, a voice command system. User input devices1240typically allow a user to select objects, icons, text and the like that appear on the monitor1106via a command such as a click of a button or the like. User output devices1230include all possible types of devices and mechanisms to output information from computer1102. These may include a display (e.g., monitor1106), printers, non-visual displays such as audio output devices, etc.

Communications interface1250provides an interface to other communication networks1295and devices and may serve as an interface to receive data from and transmit data to other systems, wide area network s and/or the Internet1118. Embodiments of communications interface1250typically include an Ethernet card, a modem (telephone, satellite, cable, ISDN), a (asynchronous) digital subscriber line (DSL) unit, a FireWire® interface, a USB® interface, a wireless network adapter, and the like. For example, communications interface1250may be coupled to a computer network, to a FireWire® bus, or the like. In other embodiments, communications interface1250may be physically integrated on the motherboard of computer1102, and/or may be a software program, or the like.

RAM1270and non-volatile storage drive1280are examples of tangible computer-readable media configured to store data such as computer-program product embodiments of the present invention, including executable computer code, human-readable code, or the like. Other types of tangible computer-readable media include floppy disks, removable hard disks, optical storage media such as CD-ROMs, DVDs, bar codes, semiconductor memories such as flash memories, read-only-memories (ROMs), battery-backed volatile memories, networked storage devices, and the like. RAM1270and non-volatile storage drive1280may be configured to store the basic programming and data constructs that provide the functionality of various embodiments of the present invention, as described above.

Software instruction sets that provide the functionality of the present invention may be stored in RAM1270and non-volatile storage drive1280. These instruction sets or code may be executed by the processor(s)1260. RAM1270and non-volatile storage drive1280may also provide a repository to store data and data structures used in accordance with the present invention. RAM1270and non-volatile storage drive1280may include a number of memories including a main random access memory (RAM) to store of instructions and data during program execution and a read-only memory (ROM) in which fixed instructions are stored. RAM1270and non-volatile storage drive1280may include a file storage subsystem providing persistent (non-volatile) storage of program and/or data files. RAM1270and non-volatile storage drive1280may also include removable storage systems, such as removable flash memory.

Bus subsystem1290provides a mechanism to allow the various components and subsystems of computer1102communicate with each other as intended. Although bus subsystem1290is shown schematically as a single bus, alternative embodiments of the bus subsystem may utilize multiple busses or communication paths within the computer1102.

A number of variations and modifications of the disclosed embodiments can also be used. Specific details are given in the above description to provide a thorough understanding of the embodiments. However, it is understood that the embodiments may be practiced without these specific details. For example, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the embodiments. It is also the case that modules, software, or algorithms can be performed on one server, multiple servers or share the same server. A platform is a major piece of software, such as an operating system, an operating environment, or a relational database or data store, under with various smaller application programs can be designed to run. An operating system is the most important software program running on most computer systems. It manages a processors memory, processes, all of the software and programs loaded onto it, and all of the connected hardware. The operating system's job is to manage all of the software and hardware on the computer. Most of the time, there are many different software programs operating at once as well as multiple connected hardware devices. There are many operating systems—the most basic is the disk operating system or “DOS.” Each type of computer or device typically has its own different operating systems. Some typical operating systems are iOS, Windows, Android, and Linux.

The networks disclosed may be implemented in any number of topologies. A network is made of many computing devices that can include computers, servers, mainframe computers, network devices, peripherals, or other devise connected together. A network allows these devices to share data and communicate with each other. The most prominent network is the Internet—that connects billions of devices all over the world. There are many types of network devices including: computers, consoles, firewalls, hubs, routers, smartphones, switches, wearables, watches, and cameras. Networks are set up in many different ways referred to as network topologies. Some of the most common topologies include tree, hybrid, ring, mesh star, and bus. The tree topology is the generally used topology. A computer is typically an electronic device for storing and processing data according to instruction it reads. A console is a text entry and display device. A firewall is network security system, either hardware- or software-based, that controls incoming and outgoing network traffic based on a set of rules, and acts as a barrier between a trusted network and other untrusted networks—such as the Internet—or less-trusted networks—a firewall controls access to the resources of a network through a positive control model. This means that the only traffic allowed onto the network defined in the firewall policy is; all other traffic is denied. A hub is a connection point for multiple devices in a network. A hub typically has multiple ports such that if packets of data arrive at one port they are copied to the other ports. A router is a device that forwards data packets along the network. A router connects two or more networks such as an intranet to the internet. Routers use headers and forwarding tables to determine how data packets should be sent using certain paths in the network. The typical router protocol using ICMP to communicate and configure the best path. A network switch is different from a router. Switches serve as controllers that enable networked devices to communicate with each other. Switches create networks while routers connect networks together.

Networks operate on the seven layer open system interconnection (OSI) model. The OSI model defines a conceptual networking framework to implement protocols and divides the task of networking into a vertical stack of the seven layers. In the OSI model, communication control is passed through the layers from the first to the seventh layer. The first or “top” layer is the “physical” layer. Layer 1 transmits the bit stream of ones and zeros indicated by electrical impulse, light, or radio frequency signals—thus providing a method of interacting with actual hardware in a meaningful way. Examples of the physical layer include Ethernet, FDDI, B8ZS, V.35, V.24, and RJ45. The second layer is called the Data Link layer. At layer 2 data packets are encoded and decoded into a bit stream in compliance with transmission protocols that control flow control and frame synchronization. The Data Link layer 2 is actually a combination of two different layers: the Media Access Control (MAC) layer and the Logical Link Control (LLC) layer. The MAC layer controls a computer's access to the network. The LLC basically controls frame synchronization, flow control, and various types of error correction. Examples of the Data Link layer include PPP, FDDI, ATM, IEEE 802.5/802.2, IEEE 802.3/802.2, HDLC, and Frame Relay. The third OSI layer, called the “Network” layer, provides the switching and routing technology to create logical paths to transmit data from one node to another in the network. Layer. The Network layer also performs the function of routing, forwarding, addressing, internetworking, error handling, congestion control, and packet sequencing. Layer 3 examples include AppleTalk, DDP, IP, and IPX. The fourth OSI layer is the Transport layer. Layer 4 provides transparent transfer of data between devices. Layer 4 also performs error recovery and provides flow control for complete data transfer. Examples of layer 4 include SPX, TCP, and UDP. OSI layer 5 called the Session layer because it manages and terminates the connections between different applications. The Session layer coordinates communication between applications. It sets up communications and terminates the communications between applications at each end—establishing and ending a “session.” Examples include NFS, NetBios, names, RPC, and SQL. Layer 6 is called the Presentation Layer. Layer 6 is really the “transformation” layer—transforming data from the final layer to a format the network understands and vice versa. Layer 6 formats and encrypts data sent on the network and decrypts the data from the network. Examples include ASCII, EBCDIC, TIFF, GIF, PICT, JPEG, MPEG, and MIDI. Finally, the last layer 7, is called the Application Layer. Everything at this layer is specific to applications, and this layer provides the services for email, file transfers, and other network applications. Examples include WWW browsers, NFS, SNMP, FTP, Telnet, and HTTP.

Implementation of the techniques, blocks, steps and means described above may be done in various ways. For example, these techniques, blocks, steps and means may be implemented in hardware, software, or a combination thereof. For a hardware implementation, the processing units may be implemented within one or more application specific integrated circuits (ASICs), complex instruction set computers (CISCs), reduced instruction set computers (RISCs), advanced RISC machines (ARMs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, micro-controllers, microprocessors, other electronic units designed to perform the functions described above, and/or a combination thereof. A processor is implemented in logic circuitry that includes the basic functions of AND, NAND, OR, and NOR functions. The circuitry responds to the basic instructions that operate an computing device. In some computing devices the processor is actually referred to a as microprocessor. Functionally, processors are typically composed of RAM as well as address and data buses, the processing circuitry and accumulators. The busses supply the data and programming instructions from RAM, ROM, CACHE, or other memory to the processing circuitry. The speed of a processor depends both on the speed of the processing circuitry as well as the speed of the data and address busses that supply the circuitry. And the speed of the data and address buses are also gated by the speed of the RAM. It is critical that all of these components have speeds that are matched to one another to maximize processor performance. Processors use machine level instruction codes to manipulate data. Other instructions must be compiled to machine level instructions to for the processor to perform the operations. Dual core processors have dual processing circuitry and multiple address and data buses.

Moreover, as disclosed herein, the term “storage medium” may represent one or more memories for storing data, including read only memory (ROM), random access memory (RAM), magnetic RAM, core memory, magnetic disk storage mediums, optical storage mediums, flash memory devices and/or other machine readable mediums for storing data. The term “machine-readable medium” includes, but is not limited to portable or fixed storage devices, optical storage devices, and/or various other storage mediums capable of storing that contain or carry instruction(s) and/or data. Cache memory, also called the central processing unit (CPU) memory, is random access memory that the processor can access more quickly than standard RAM. Cache memory is typically integrated into the circuitry with the processing unit, but sometimes can be placed on a separate chip. The principle purpose of cache memory is to store the program instruction for the operational software such as an operating systems. Most long running software instructions reside in cache memory if they are accessed often.