Systems, Computer Medium and Computer-Implemented Methods for Authenticating Users Using Voice Streams

Provided are embodiments of systems, computer medium and computer-implemented methods for authenticating users using voice biometrics. Methods including receiving a request to access a resource via a user device, receiving a credentials set from a user (the credentials set including candidate credentials and candidate voice stream), determining whether the candidate credentials are valid based on a comparison of the candidate credentials to existing user credentials, in response to determining that the candidate credentials are valid, determining whether the candidate voice stream is valid based on a comparison of the candidate voice stream to a voice biometric associated with the candidate credentials and, in response to determining that the candidate voice stream is valid, generating an authentication signal configured to enable access to the resource via the user device.

While the invention is susceptible to various modifications and alternative forms, specific embodiments of the invention are shown by way of example in the drawings and will be described in detail herein. It should be understood, however, that the drawings and detailed description thereof are not intended to limit the invention to the particular form disclosed, but to the contrary, are intended to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the present invention as defined by the appended claims.

DETAILED DESCRIPTION

In some embodiments, provided is an authentication system that employs user credentials and biometric characteristics to authenticate users, that grants or denies access to various network resources based on authentication of users, and that employs readily available hardware, such as a microphone, to acquire biometric characteristics used to authenticate users. Such an authentication system may provide enhanced network security in an efficient and cost effective manner.

In certain embodiments, a user is authenticated based at least in part on user credentials and/or a voice biometric provided by the user. For example, upon requesting access to a resource, such as requesting to open a file, the user may be prompted to enter their credentials, such as their user name, and to say a given word or phrase, such as their password (i.e., a “vocal password”). The spoken password may be recorded as a voice stream. The credentials and the voice stream may be compared to existing credentials and exiting voice biometrics, respectively, to authenticate the user. For example, the user name may be compared against user names for existing user profiles to verify/validate the user name (e.g., to determine whether the user name matches an existing user name associated with a user profile/account), and the voice stream may be compared to an existing voice biometric for the user profile, such as a pre-recorded audio file of the user speaking the password or a voice print generated therefrom, to verify/validate the voice stream (e.g., to determine whether a voiceprint the voice stream is consistent with the voiceprint). If both of the credentials and the voice stream are verified/validated, the user may be authenticated and, thus, may be provided access to the resource. For example, where the user request access to an electronic document via a workstation, and the user is authenticated (e.g., the submitted credentials and voice stream are verified/validated), the workstation may retrieve the document from a server and display it to the user. In contrast, where the user is not authenticated (e.g., the submitted credentials or voice stream are invalid), the workstation may not retrieve the document from the server and/or may not display it to the user. That is, an authenticated user may be provided access to a requested resource, and an unauthenticated user may not be provided access to the requested resource.

In some embodiments, a secure data network includes user devices, an authentication system and a resource system. User devices may include, for example, a computer workstation, a mobile device (e.g., a smart phone), or the like. An authentication system may include, for example, servers that verify user credentials and/or voice streams to authenticate users. In some embodiments, an authentication system includes a credential verification server that performs verification/validation of user credentials and a voice verification server that performs verification/validation of voice streams. Although certain embodiments describe these as independent servers for the purpose of illustration, embodiments may include these operations being provided by any number and variety of devices. For example, a single server may perform verification/validation of credentials and voice streams. Resource systems may include data servers or the like, that serve, or otherwise provide access to, electronic resources.

In certain embodiments, a secure data network obtains user credentials and a voice stream from a user, performs verification/validation of the credentials and the voice stream to authenticate the user and, after authenticating the user, provides the user with access to a resource. For example, the user Mike Smith may access a network drive on his computer workstation and request to open an electronic document entitled “report.doc”. In response to the request and a determination that access to the document requires user authentication, the user device may display a prompt requesting Mike Smith to enter his user name and “speak” his password into a microphone of the computer workstation. Mike Smith may enter his user name “msmith” into a user name field displayed on the workstation, and speak his password “chocolate” into a microphone of the workstation. The secure data network may process the user name and the spoken password to authenticate Mike Smith as the user and, only after authenticating Mike Smith as the user will the workstation provide Mike Smith with access to “report.doc”.

In some embodiments, authentication includes a distributed process that is performed by multiple entities of a secure data network. For example, a user device may be employed to acquire a candidate credentials dataset (e.g., including candidate credentials and a candidate voice stream submitted by the user), a credential verification server may be used to verify/validate the candidate credentials, and a voice verification server may be used to verify/validate the candidate voice stream. Such a distributed system may enhance performance by allowing verification/validation processes to be offloaded to different entities. In some embodiments, the process flow of authentication may reduce processing loads by performing voice verification/validation only after the user's credentials are verified/validated. Moreover, the modular nature of the system embodiments may enable distribution of tasks to systems that are specially adapted for performing the specific functions. For example, a voice verification server that is particularly well suited for performing voice verifications can be integrated into an existing authentication system using the techniques described herein to add voice verification to an authentication process.

In some embodiments, the user device forwards the candidate credentials to a credential verification server for verification/validation, and forwards the candidate voice stream to a voice verification server for verification/validation. For example, the workstation may forward the string “msmith” to a credential verification server for verification/validation, and forward audio data including the recording of “chocolate” (as spoken by Mike Smith) to a voice verification server for verification/validation. The credential verification server may verify/validate the candidate credentials by comparing them to existing credentials. For example, the credential verification server may compare the user name “msmith” against user names for existing/active user profiles/accounts stored in a credentials database to determine whether the user name “msmith” is valid (e.g., matches an existing user name associated with a user profile). If the candidate credentials are verified/validate, the voice verification server may, then, verify/validate the candidate voice stream by comparing the candidate voice stream to an existing voice stream associated with the credentials. For example, if it is determined that the user name “msmith” is valid, the credential verification server may transmit a signal to the voice verification server indicating that the user name “msmith” is valid (e.g., a credential valid signal), and the voice verification server may, then, compare the candidate voice stream (e.g., the audio data including the recording of “chocolate” as spoken by Mike Smith) to a voice biometric associated with the user profile for “msmith” to determine whether or not the voice stream is valid. The existing voice biometric may include a voiceprint generated based on a recording of words and/or phrases spoken by the user associated the user account. For example, the existing voice biometric may include a voice print generated based on a prior recording of Mike Smith speaking his password “chocolate”. This may have been done, for example, when Mike Smith previously enrolled in his user profile/account, or the last time he reset his vocal password.

In some instances, the biometric data that is used to verify/validate the candidate voice stream is provided by the credential verification server. For example, upon determining that the user name “msmith” is valid, the credential verification server may retrieve the existing voice biometric for the user account associated with “msmith” from a biometric database, and transmit the existing voice biometric to the voice verification server (e.g., in addition to or in place of the credential valid signal). In some instances, the biometric data that is used to verify/validate the candidate voice stream is retrieved by the voice verification server. For example, upon receiving the credential valid signal indicating that “msmith” is a valid user name, the voice verification server may retrieve the existing voice biometric for the user account associated with “msmith” from the biometric database.

The comparison of the candidate voice stream to the existing voice biometric may include comparing the content of the voice stream (e.g., what was said) and/or the biometric characteristics of the voice stream (e.g., how it was said) corresponding content or characteristics of the existing voice biometric. In some instances, the candidate voice stream may be verified when the content and/or the biometric characteristics of the candidate voice stream are verified/validated against the existing voice biometrics. For example, the candidate voice stream may be verified if the existing voice biometric and the candidate voice stream both include a recording of, or otherwise include characteristics of, Mike Smith saying the word “chocolate” in a similar manner. In contrast, the candidate voice stream may not be verified if the existing voice biometric includes a recording of (or a voice print corresponding to) Mike Smith saying the word “chocolate” and the candidate voice stream includes a recording of Mike Smith saying the word “chocolate” in a different manner (e.g., in a different tone of voice), Mike Smith saying a word other than “chocolate” (e.g., Mike Smith saying “strawberry”), or a recording of another user's voice (e.g., Jane White saying the word “chocolate”).

In some embodiments, the comparison of the candidate voice stream to the existing voice stream is provided by a voice biometric engine. A voice biometric engine may include a collection of software functions that processes audio samples, extracts relevant vocal information (or features), and creates a unique and representative model of the original speech. During an enrollment process, a voice biometric engine may extract vocal features from one or more speech samples (e.g., existing voice streams) to create a voiceprint. During a verification process, the voice biometric engine may extract vocal features from a sample (e.g., a candidate voice stream), compare the features to a stored voiceprint, and then generate a score or match probability. If the score or match probability satisfies (e.g., meets or exceeds) a predetermined threshold, the identity of the speaker and/or the content of the candidate voice stream may be verified. If the score or match probability does not satisfy (e.g., is below) a predetermined threshold, the identity of the speaker and/or the content of the candidate voice stream may not be verified.

In some embodiments, during an enrollment process a user may be prompted to provide an enrollment credential and/or speak a vocal password. For example, Mike Smith may be prompted by his workstation to provide his user name and password. The enrollment credential may be received and the vocal password may be acquired via the workstation. In some embodiments, the enrollment credential is stored in a credentials database as a credential for a user account associate with the user. In some embodiments, a voice biometric for the user is generated based on an audio recording (e.g., the voice stream) of the user speaking the vocal password. The voice biometric and/or the voice stream may be stored in a biometric database as a voice biometric for the user account associated with the user. For example, where Mike Smith enters his user name “msmith” and says his password “chocolate”, the user name “msmith” may be associated and a voiceprint (or similar voice biometric) of Mike Smith saying his password “chocolate” may be associated with Mike Smith's user account.

If it is determined that the candidate voice stream is not valid (e.g., the submitted voice stream does correspond to the existing voice biometric), access to the resource may be denied. For example, if the submitted voice stream is determined to be invalid, Mike Smith may be denied access to “report.doc”. In such an instance, the voice verification server may transmit a signal to the workstation indicating that the voice stream is invalid (e.g., a voice stream invalid signal and/or an authentication status signal indicating the user is not authenticated). In response to the signal indicating the voice stream is invalid and, thus, indicating that the user is not authenticated, the workstation may continue to deny access to the resource. For example, the workstation may continue to deny access to “report.doc”, and may display a notification that access was denied along with a prompt for the user to re-enter a valid user name and speak a valid password into a microphone of the computer workstation.

If it is determined that the candidate voice stream is valid (e.g., the submitted voice stream does correspond to the existing voice biometric), access to the resource may be granted. In such an instance, the voice verification server may transmit a signal to the workstation indicating that the voice stream is valid (e.g., a voice stream valid signal and/or an authentication status signal indicating the user is authenticated). In response to the signal indicating the voice stream is valid and/or the user being authenticated, the workstation may provide access to “report.doc”. For example, the workstation may retrieve “report.doc” from a document server and display the document for review/editing by the user.

Although certain embodiments are described with regard to accessing an electronic document resource from a computer workstation for the purpose of illustration, the techniques described herein can be applied to any variety of embodiments, including various types of resources and various types of user devices. In some embodiments, a requested resource may include access to a network, a computer system, a user device, or the like. For example, upon attempting to log-on to a network, computer system, user device, or the like, the user may be prompted to enter credentials (e.g., their user name, PIN, secret code, or a similar identifier) and to speak an identifying sound (e.g., words, phrases, their password, or the like) to verify their identity, and, if the credentials and the spoken sounds are verified/validated, the user may authenticated and may be granted access to the network, computer system, user device, or the like. In some embodiments, a requested resource may include access to particular programs, operations, or the like. For example, upon attempting to electronically sign (“e-sign”) a document, the user may be prompted to enter credentials (e.g., their user name, PIN, secret code, or a similar identifier) and to speak an identifying sound (e.g., words, phrases, their password, or the like) to verify their identity, and, if the credentials and the spoken sounds are verified/validated, the user may authenticated and may be granted the ability to e-sign documents using an e-signature corresponding to the authenticated user. In some embodiments, a requested resource may include access to physical location secured by a physical locking device. For example, upon attempting to open a digital door lock that inhibits access to a room or other space, the user may be prompted to enter credentials (e.g., their user name, PIN, secret code, or similar identifier) and to speak an identifying sound (e.g., words, phrases, their password, or the like) to verify their identity, and, if the credentials and the spoken sounds are verified/validated, the user may authenticated and the lock may be opened such that the user can enter the room or other space.

FIG. 1is a diagram that illustrates a secure data network system (“data network”)100in accordance with one more embodiments of the present invention. Data network100includes network servers102and user devices104communicatively coupled via a communications network (“network”)106. Network servers102may include one or more authentication servers108and one or more resource servers110(e.g., servers100aand110b). Authentication servers108may include a credential verification server112and a voice verification server114. Credential verification server112may have access to a credentials database116. Credential verification server112and/or voice verification server may have access to a biometric database118. Resource servers110may have access to one or more resource databases120(e.g., databases120aand120b).

Network106may include an element or system that facilitates communication between entities of data network100. For example, network106may include an electronic communications network, such as the Internet, a local area network (“LAN”), a wide area (“WAN”), a wireless local area network (“WLAN”), a cellular communications network, and/or the like. In some embodiments, network106includes a single network or combination of networks.

User devices104may include any variety of mobile electronic devices. For example, devices104may include desktop computers, laptop computers, tablet computers, cellular phones, personal digital assistants (PDAs), or the like. In the illustrated embodiment, user devices104include a desktop computer (e.g., an employee workstation)104a, a mobile electronic device (e.g., a network enabled smart phone)104b, an interactive voice response/voice over Internet Protocol (IVR/VOIP) device104c, and a location access device (e.g., an electronic door lock)104d.

User devices104may include various input/output (I/O) interfaces, such as a graphical user interface (e.g., a display screen), an image acquisition device (e.g., a camera), an audible output user interface (e.g., a speaker), an audible input user interface (e.g., a microphone), a keyboard/keypad, a pointer/selection device (e.g., a mouse, a trackball, a touchpad, a touchscreen, a stylus, etc.), a printer, or the like. In some embodiments, user devices104include general computing components and/or embedded systems optimized with specific components for performing specific tasks. User devices104may include applications/modules having program instructions that are executable by a computer system to perform some or all of the functionality described herein with regard to the respective devices104.

FIG. 2is a block diagram that illustrates components of a user device104in accordance with one or more embodiments of the present invention. In some embodiments, user device104includes a controller200for controlling the operational aspects of user device104. In some embodiments, controller200includes a memory202, a processor204and an input/output (I/O) interface206. Memory202may include non-volatile memory (e.g., flash memory, ROM, PROM, EPROM, EEPROM memory), volatile memory (e.g., random access memory (RAM), static random access memory (SRAM), synchronous dynamic RAM (SDRAM)), bulk storage memory (e.g., CD-ROM and/or DVD-ROM, hard-drives), or the like. Memory202may include a non-transitory computer readable storage medium having program instructions208stored thereon that are executable by a computer processor (e.g., processor204) to cause the functional operations (e.g., methods/routines/processes) described herein with regard to user device104. Program instructions208may include modules including program instructions that are executable by processor204to provide some or all of the functionality described herein with regard to user device104. Program instructions208may include an access request module210afor performing some or all of the operational aspects of method800(described in more detail below wither regard toFIG. 8A) and/or a resource request module210bfor performing some or all of the operational aspects of method850(described in more detail below wither regard toFIG. 8B).

Processor204may be any suitable processor capable of executing/performing program instructions. Processor204may include a central processing unit (CPU) that carries out program instructions (e.g., program instructions of modules210aand/or210b) to perform arithmetical, logical, and input/output operations of user device104, including those described herein. I/O interface206may provide an interface for communication with of one or more I/O devices of user device104and/or external devices220. I/O devices may include a keyboard212, a graphical user interface (GUI)214, a microphone216, a speaker218, and/or the like. External devices220may include network servers102. I/O devices and external devices may be connected to I/O interface206via a wired or wireless connection (e.g., via network106).

FIG. 3is a block diagram that illustrates components of a credential verification server112in accordance with one or more embodiments of the present invention. In some embodiments, credential verification server112includes a controller300for controlling the operational aspects of credential verification server112. In some embodiments, controller300includes a memory302, a processor304and an input/output (I/O) interface306. Memory302may include non-volatile memory (e.g., flash memory, ROM, PROM, EPROM, EEPROM memory), volatile memory (e.g., random access memory (RAM), static random access memory (SRAM), synchronous dynamic RAM (SDRAM)), bulk storage memory (e.g., CD-ROM and/or DVD-ROM, hard-drives), or the like. Memory302may include a non-transitory computer readable storage medium having program instructions308stored thereon that are executable by a computer processor (e.g., processor304) to cause the functional operations (e.g., methods/routines/processes) described herein with regard to credential verification server112. Program instructions308may include modules including program instructions that are executable by processor304to provide some or all of the functionality described herein with regard to credential verification server112. Program instructions308may include a credential verification module310for performing some or all of the operational aspects of method900(described in more detail below wither regard toFIG. 9).

Processor304may be any suitable processor capable of executing/performing program instructions. Processor304may include a central processing unit (CPU) that carries out program instructions (e.g., program instructions of module310) to perform arithmetical, logical, and input/output operations of credential verification server112, including those described herein. I/O interface206may provide an interface for communication with of one or more I/O devices and/or external devices312. I/O devices may include a keyboard, a graphical user interface, a microphone, a speaker, and/or the like. External devices312may include other network servers102, user devices104, credentials database116, biometric database118, databases120, and/or the like. I/O devices and external devices may be connected to I/O interface206via a wired or wireless connection (e.g., via network106).

FIG. 4is a block diagram that illustrates components of a voice verification server114in accordance with one or more embodiments of the present invention. In some embodiments, voice verification server114includes a controller400for controlling the operational aspects of voice verification server114. In some embodiments, controller400includes a memory402, a processor404and an input/output (I/O) interface406. Memory402may include non-volatile memory (e.g., flash memory, ROM, PROM, EPROM, EEPROM memory), volatile memory (e.g., random access memory (RAM), static random access memory (SRAM), synchronous dynamic RAM (SDRAM)), bulk storage memory (e.g., CD-ROM and/or DVD-ROM, hard-drives), or the like. Memory402may include a non-transitory computer readable storage medium having program instructions408stored thereon that are executable by a computer processor (e.g., processor404) to cause the functional operations (e.g., methods/routines/processes) described herein with regard to voice verification server114. Program instructions408may include modules including program instructions that are executable by processor404to provide some or all of the functionality described herein with regard to voice verification server114. Program instructions408may include a voice verification module410for performing some or all of the operational aspects of method1000(described in more detail below wither regard toFIG. 10).

Processor404may be any suitable processor capable of executing/performing program instructions. Processor404may include a central processing unit (CPU) that carries out program instructions (e.g., program instructions of module410) to perform arithmetical, logical, and input/output operations of voice verification server114, including those described herein. I/O interface406may provide an interface for communication with of one or more I/O devices and/or external devices412. I/O devices may include a keyboard, a graphical user interface, a microphone, a speaker, and/or the like. External devices412may include other network servers102, user devices104, credentials database116, biometric database118, databases120, and/or the like. I/O devices and external devices may be connected to I/O interface406via a wired or wireless connection (e.g., via network106).

FIG. 5is a block diagram that illustrates components of a resource server110in accordance with one or more embodiments of the present invention. In some embodiments, resource server110includes a controller500for controlling the operational aspects of resource server110. In some embodiments, controller500includes a memory502, a processor504and an input/output (I/O) interface506. Memory502may include non-volatile memory (e.g., flash memory, ROM, PROM, EPROM, EEPROM memory), volatile memory (e.g., random access memory (RAM), static random access memory (SRAM), synchronous dynamic RAM (SDRAM)), bulk storage memory (e.g., CD-ROM and/or DVD-ROM, hard-drives), or the like. Memory502may include a non-transitory computer readable storage medium having program instructions508stored thereon that are executable by a computer processor (e.g., processor504) to cause the functional operations (e.g., methods/routines/processes) described herein with regard to resource server110. Program instructions508may include a resource module510including program instructions that are executable by processor504to provide/perform some or all of the functionality described herein with regard to resource server110.

Processor504may be any suitable processor capable of executing/performing program instructions. Processor504may include a central processing unit (CPU) that carries out program instructions (e.g., program instructions of module510) to perform arithmetical, logical, and input/output operations of resource server110, including those described herein. I/O interface506may provide an interface for communication with of one or more I/O devices and/or external devices512. I/O devices may include a keyboard, a graphical user interface, a microphone, a speaker, and/or the like. External devices512may include other network servers102, user devices104, credentials database116, biometric database118, databases120, and/or the like. I/O devices and external devices may be connected to I/O interface506via a wired or wireless connection (e.g., via network106).

FIG. 6is a block diagram that illustrates operations of an authentication system in accordance with one more embodiments of the present invention.FIG. 7is a flow diagram that illustrates operations of an authentication system in accordance with one more embodiments of the present invention. In some embodiments, a user device104(e.g., user device104a,104b,104c, or104d) acquires a candidate credentials dataset600, including candidate user credentials (“candidate credentials”)602and a candidate user voice stream (“candidate voice stream”)604. Candidate credentials602may include, for example, a user name, PIN, secret code or similar identifier. Candidate credentials for the user Mike Smith, for example, may include his user name “msmith”. In some embodiments, Candidate credentials may be provided by a user physical entering the data (e.g., typing the data in using a keyboard, touch screen, keypad or the like), speaking the data into a voice recognition device (e.g., speaking the data into an interactive voice response/voice over Internet Protocol (IVR/VOIP) device or the like), presenting a physical access token (e.g., swiping a magnetic strip of an ID/access card though a card reader or the like), and/or the like. A candidate voice stream604may include, for example, audible data corresponding to word(s), phrase(s), or other sounds spoken by a user. A candidate voice stream604for the user Mike Smith may include audio data corresponding to his speaking his vocal password “chocolate”. A candidate voice stream may include audio data that can be used to verify the identity of the user that provided the voice stream. For example, as described herein the audio data of a candidate voice stream (e.g., a candidate voiceprint) may be compared to biometric data for the user (e.g., a known/existing voiceprint for the user's vocal password) to verify that the candidate voice stream was in fact spoken by the user and/or includes a required word/phrase/sound. In some embodiments, candidate credentials602and voice stream604are provided by a user via an I/O interface of user device104. For example, user120may enter candidate credentials602using a keyboard, keypad, touchscreen, voice recognitions devices, or the like of user device104. Voice stream604may be provided by the user speaking into an audio recording device, such as a microphone, of user device104.

In some embodiments, a user is requested to provide candidate credentials602and a candidate voice stream604. For example, in response to a user requesting access to a resource, user device104may prompt the user to provide their credentials and a voice stream. In response to receiving Mike Smith's request to open an electronic document entitled “report.doc”, for example, user device104may display a prompt requesting Mike Smith to enter a user name and “speak” his vocal password into a microphone of user device104.

In some embodiments, user device104forwards candidate credentials602and/or candidate voice stream604to one or more entities of system100for use in authenticating the user. For example, user device104may forward candidate credentials602to credential verification server112and/or forward candidate voice stream604to voice verification server114. User device104may, for example, forward the string “msmith” to credential verification server112for verification/validation, and/or forward candidate voice stream604including the recording of “chocolate” (as spoken by Mike Smith) to voice verification server114for verification/validation.

Credential verification server112may compare candidate credentials602to existing credentials606. For example, where credentials database116includes a listing of all existing/active user credentials, credential verification server112may query credentials database116for a listing of all existing user credentials606, and may determine whether candidate credentials602matches any existing user credentials606. Credential verification server112may, for example, retrieve a list of user names associated with current/active user accounts from credentials database116, and determine whether the candidate user name “msmith” matches an existing user name associated with current/active user account. The candidate credentials may be verified/validated if the candidate credentials matches an existing credential. For example, the candidate user name “msmith” may be verified/validated if the user name “msmith” is associated with a current/active user account (e.g., Mike Smith's user account). Candidate credentials602may not be verified/validated if the candidate credentials does not match an existing credential. For example, the candidate user name “msmith” may not be verified/validated if the user name “msmith” is not associated with a current/active user account (e.g., a user account for Mike Smith's does not exists or is de-activated).

If candidate credentials602are not validated/verified, credential verification server112may provide an indication that candidate credentials602are invalid. In some embodiments, in response credential verification server112determining that candidate credentials602are invalid, credential verification server112transmits a credential invalid signal608to user device104. For example, in response to credential verification server112determining that the user name “msmith” is invalid, credential verification server112may transmit a corresponding credentials invalid signal608to user device104. Credentials invalid signal608may indicate that candidate credentials602are not verified/valid and, thus, the user is not authenticated.

In response to receiving credentials invalid signal608, user device104may continue to deny access to the resource and provide a corresponding notification to user120. For example, in response to receiving credential invalid signal608, user device104may continue to deny access to “report.doc”, and may display a notification that access was denied along with a prompt for the user to re-enter a valid user name and speak a valid password into a microphone of user device104.

If candidate credentials602are validated/verified, credential verification server112may provide a corresponding indication that candidate credentials602are verified/valid. In some embodiments, in response credential verification server112determining that candidate credentials602are verified/valid, credential verification server112transmits a credential valid signal610to voice verification server114. For example, in response to credential verification server112determining that the user name “msmith” is verified/valid, credential verification server112may transmit a corresponding credentials valid signal610to voice verification server114. Credentials valid signal610may indicate that candidate credentials602are verified/valid.

In some embodiments, voice verification server114proceeds to verifying/validating candidate voice stream604in response to receiving credentials valid signal610. Accordingly, in some embodiments, the authentication process may proceed to verifying/validating candidate voice stream604only after verifying/validating candidate credentials602.

In some embodiments, verifying/validating candidate voice stream604includes comparing candidate voice stream604to an existing voice biometric612associated with the verified/validated candidate credentials602. For example, voice verification server114may receive/retrieve a voice biometric612corresponding to the verified/validated candidate credentials602, and compare one or more characteristics of candidate voice stream604to voice biometric612. In response to receiving a credentials valid signal610indicating that the user name “msmith” is valid, voice verification server114may receive/retrieve a voice biometric612associated with Mike Smith's user account (e.g., a voiceprint for Mike Smith), and compare one or more characteristics of candidate voice stream604(e.g., the audio data including the recording of “chocolate” as spoken by Mike Smith) to voice biometric612.

In some embodiments, a voice biometric612that is used to verify/validate candidate voice stream604is provided by credential verification server112. For example, upon determining that the user name “msmith” is valid, credential verification server112may retrieve a voice biometric612associated with Mike Smith's user account (e.g., a voiceprint for Mike Smith) from biometric database118, and transmit the voice biometric612to voice verification server114(e.g., in addition to or in place of credential valid signal610). Where only voice biometric612is transmitted to voice verification server114, the voice biometric may act as the credential valid signal610. That is, voice verification server114may proceed with verifying/validating candidate voice stream604in response to receiving voice biometric612from credential verification server112.

In some embodiments, a voice biometric612that is used to verify/validate candidate voice stream604is retrieved by voice verification server114. For example, in response to receiving credential valid signal610indicating that the user name “msmith” is valid, voice verification server114may retrieve the voice biometric612associated with Mike Smith's user account (e.g., the voiceprint for Mike Smith) from biometric database118.

The verifying/validating process for candidate voice stream604may include comparing the content of the voice stream (e.g., what was said) and/or the biometric characteristics of the voice stream (e.g., how it was said). In some embodiments, candidate voice stream604is verified/validated when the content and/or the biometric characteristics of candidate voice stream604are verified/validated. For example, candidate voice stream604may be verified/validated if existing voice biometric612and candidate voice stream604both include a recording of Mike Smith saying the word “chocolate” in a similar manner. In contrast, candidate voice stream604may not be verified/validated if existing voice biometric612includes, or is based on, a recording of Mike Smith saying the word “chocolate” and candidate voice stream604includes a recording of Mike Smith saying the word “chocolate” in a different manner (e.g., in a different tone of voice), a recording of Mike Smith saying a word other than “chocolate” (e.g., Mike Smith saying “strawberry”), or a recording of another user's voice (e.g., Jane White saying the word “chocolate”). Thus, in some embodiments, the user's voice stream may be identified when the comparison reveals that the voice stream is spoken by the user associated with the user account and/or it includes the correct word/phrase/sound.

In some embodiments, the comparison of a candidate voice stream to an existing voice biometric is provided using a voice biometric engine. A voice biometric engine may be employed by voice verification server114. For example, voice verification module410may include a voice biometric engine.

A voice biometric engine may include a collection of software functions that processes audio samples, extracts relevant vocal information (or features), and creates a unique and representative model of the original speech. During an enrollment process, a voice biometric engine may extract vocal features from one or more speech samples (e.g., existing voice streams) to create a voiceprint. During a verification process, the voice biometric engine may extract vocal features from a sample (e.g., the candidate voice stream), compare the features to a stored voiceprint, and then generate a score or match probability. If the score or match probability satisfies (e.g., meets or exceeds) a predetermined threshold, the identity of the speaker may be verified. If the score or match probability does not satisfy (e.g., is below) a predetermined threshold, the identity of the speaker may not be verified. For example, if the comparison of a candidate voice stream604to a voice biometric612associated with Mike Smith results in a score above a threshold of 80% (e.g., a score of 95%), the voice biometric engine may confirm that the speaker is in fact Mike Smith and, thus, the candidate voice stream604may be verified/validated.

If candidate voice stream604is not validated/verified, voice verification server114may provide a corresponding indication that candidate voice stream604is invalid (and/or that the user is not authenticated). In some embodiments, in response to voice verification server114determining that candidate voice stream604is invalid, voice verification server114transmits a voice stream invalid signal614a(and/or an authentication status signal616indicating the user is not authenticated) to user device104. For example, in response to voice verification server114determining that voice stream604includes the word “strawberry” (as opposed to “chocolate”) and/or is spoken by a person other than Mike Smith, voice verification server114may transmit a corresponding voice stream invalid signal614a(and/or an authentication status signal616indicating the user is not authenticated) to user device104. Voice stream invalid signal614amay indicate that voice stream604is not verified/valid and, thus, the user is not authenticated.

In response to receiving voice stream invalid signal614a(and/or an authentication status signal616indicating the user is not authenticated) user device104may continue to deny access to the resource and provide a corresponding notification to user120. For example, in response to receiving voice stream invalid signal614a(and/or an authentication status signal616indicating the user is not authenticated), user device104may continue to deny access to “report.doc”, and may display a notification that access was denied along with a prompt for the user to re-enter a valid user name and speak a valid password into a microphone of user device104.

If candidate voice stream604is validated/verified, voice verification server114may provide a corresponding indication that candidate voice stream604is valid (and/or that the user is authenticated). In some embodiments, in response to voice verification server114determining that candidate voice stream604is valid, voice verification server114transmits a voice stream valid signal614b(and/or an authentication status signal616indicating the user is not authenticated) to user device104. For example, in response to voice verification server114determining that voice stream604includes the word “chocolate” (i.e., the password previously provided by Mike Smith during an enrollment process) and that it was spoken by Mike Smith, voice verification server114may transmit a corresponding voice stream valid signal614b(and/or an authentication status signal616indicating the user is authenticated) to user device104.

In response to receiving voice stream valid signal614b(and/or an authentication status signal616indicating the user is authenticated) user device104may proceed with providing access to the resource. For example, in response to receiving voice stream valid signal614b(and/or an authentication status signal616indicating the user is authenticated), user device104may retrieve “report.doc” from a document server110and display the document on user device104for review/editing. In some embodiments, providing access to a resource may include transmitting a resource request618to a resource server110, and the resource server serving the requested resource620.

FIGS. 8A-12are flowcharts that illustrate various processes that may be involved in authenticating a user using voice biometrics and providing access to a resource.FIGS. 8A and 8Bare flowchart that illustrates methods800and850of processing a resource request in accordance with one or more embodiments of the present invention. In some embodiments, some of all of the operational aspects of methods800and850are performed by a user device104. For example, some or all of the operational aspects of methods800and850may be performed by access request module210aand resource request module210b, respectively.

FIG. 9is a flowchart that illustrates a method of credential verification/validation900in accordance with one or more embodiments of the present invention. In some embodiments, some of all of the operational aspects of method900are performed by credential verification server112. For example, some or all of the operational aspects of method900may be performed by credential verification module310.

FIG. 10is a flowchart that illustrates a method of voice stream verification/validation1000in accordance with one or more embodiments of the present invention. In some embodiments, some of all of the operational aspects of method1000are performed by voice verification server114. For example, some or all of the operational aspects of method900may be performed by voice verification module410.

Turing now toFIG. 8A, method800may include requesting and receiving candidate credentials and a candidate voice stream (e.g., a candidate credentials dataset) from a user (blocks802and804). In some embodiments, requesting user credentials includes requesting that a user provide candidate credentials602and a candidate voice stream604. For example, in response to receiving Mike Smith's request to open an electronic document entitled “report.doc”, device104may display a prompt requesting Mike Smith to enter a user name (e.g., a candidate user credential) and “speak” his vocal password into a microphone216of user device104(e.g., to provide a candidate voice stream).

Candidate credentials602may include, for example, a user name, PIN, secret code or a similar identifier. In some embodiments, candidate credentials may be provide by a user physical entering the data (e.g., typing the data in using a keyboard, touch screen, keypad or the like), speaking the data into a voice recognition device (e.g., speaking the data into an interactive voice response/voice over Internet Protocol (IVR/VOIP) device), presenting a physical access token (e.g., swiping a magnetic strip of an ID/access card though a card reader or the like), and/or the like. Candidate credentials for the user Mike Smith may include his user name “msmith”. A candidate voice stream604may include, for example, audible data corresponding to word(s), phrase(s), or other sounds spoken by a user. A candidate voice stream604for the user Mike Smith may include audio data corresponding to him speaking his password “chocolate”. A candidate voice stream may include audio data that can be used to verify the identity of the user that provided the vice stream. For example, as described herein the audio data of a candidate voice stream (e.g., a candidate voiceprint) may be compared to biometric data for the user (e.g., a known/existing voiceprint for the user) to verify that the candidate voice stream was in fact spoken by the user and/or includes required content.

In some embodiments, user credentials602and voice stream604(e.g., a candidate credentials dataset600) are received via an I/O interface user device104. For example, user120may submit candidate credentials602using a keyboard, keypad, touchscreen, voice recognition devices, or the like of user device104. Voice stream604may be provided by a user speaking into an audio recording device, such as microphone216, of user device104.

Method800may include transmitting the candidate credentials and the candidate voice stream (block806). In some embodiments, transmitting the candidate credentials and the candidate voice stream includes user device104forwarding candidate credentials602and/or candidate voice stream604to one or more entities of system100for use in authenticating the user. For example, user device104may forward candidate credentials602to credential verification server112and/or forward candidate voice stream604to voice verification server114. User device104may, for example, forward the string “msmith” to credential verification server112for verification/validation, and/or forward candidate voice stream604including the recording of “chocolate” (as spoken by Mike Smith) to voice verification server114for verification/validation.

Turning now toFIG. 9, method900may include receiving candidate credentials (block902). In some embodiments, receiving candidate credentials includes credential verification server112receiving candidate credentials602from user device104. For example, credential verification server112may receive the string “msmith” from user device104.

Method900may include determining whether the candidate credentials are valid (i.e., verifying/validating the candidate credentials) (block904). Determining whether the candidate credentials are valid may include credential verification server112comparing candidate credentials602to existing credentials606. For example, where credentials database116includes a listing of all existing/active user credentials, credential verification server112may query credentials database116for a listing of all existing user credentials606, and may determine whether candidate credentials602matches an existing user credentials606. Credential verification server112may, for example, retrieve a list of user names associated with current/active user accounts from credentials database116, and determine whether the candidate user name “msmith” matches an existing user name associated with a current/active user account. The candidate credentials may be verified/validated if the candidate credentials matches an existing credential. For example, the candidate user name “msmith” may be verified/validated if the user name “msmith” is associated with a current/active user account (e.g., Mike Smith's user account). Candidate credentials602may not be verified/validated if the candidate credentials does not match an existing credential. For example, the candidate user name “msmith” may not be verified/validated if the user name “msmith” is not associated with a current/active user account (e.g., a user account for Mike Smith's does not exists or is de-activated).

If candidate credentials602are not validated/verified a corresponding indication that candidate credentials602are invalid may be provided (block906). In some embodiments, in response credential verification server112determining that candidate credentials602are invalid, credential verification server112transmits a credential invalid signal608to user device104. For example, in response to credential verification server112determining that the user name “msmith” is invalid, credential verification server112may transmit a corresponding credentials invalid signal608to user device104. Credentials invalid signal608may indicate that candidate credentials602are not verified/valid and, thus, the user is not authenticated.

If candidate credentials602are validated/verified, a corresponding indication that candidate credentials602are verified/valid may be provided (block908). In some embodiments, in response credential verification server112determining that candidate credentials602are verified/valid, credential verification server112transmits a credential valid signal610to voice verification server114. For example, in response to credential verification server112determining that the user name “msmith” is verified/valid, credential verification server112may transmit a corresponding credentials valid signal610to voice verification server114. Credentials valid signal610may indicate that candidate credentials602are verified/valid.

Turning now toFIG. 10, method1000may include receiving a candidate voice stream (block1002). In some embodiments, receiving a candidate voice stream includes voice verification server114receiving candidate voice stream604transmitted by user device104. For example, voice verification server114may receive the recording of “chocolate” (as spoken by Mike Smith) from user device104.

Method1000may include determining whether the candidate voice stream is valid (i.e., verifying/validating the voice stream) (block1004). In some embodiments, verifying/validating the voice stream is provided in response to candidate credentials602being verified/validated. For example, voice verification server114may proceed to verifying/validating candidate voice stream604in response to receiving credentials valid signal610. Accordingly, in some embodiments, the authentication process may proceed to verifying/validating candidate voice stream604only after verifying/validating candidate credentials602.

In some embodiments, verifying/validating candidate voice stream604includes comparing candidate voice stream604to an existing voice biometric612associated with the verified/validated candidate credentials602. For example, voice verification server114may receive/retrieve a voice biometric612corresponding to the verified/validated candidate credentials602, and compare one or more characteristics of candidate voice stream604to voice biometric612. In response to receiving a credentials valid signal610indicating that the user name “msmith” is valid, voice verification server114may receive/retrieve a voice biometric612associated with Mike Smith's user account (e.g., a voiceprint for Mike Smith), and compare one or more characteristics of candidate voice stream604(e.g., the audio data including the recording of “chocolate” as spoken by Mike Smith) to voice biometric612.

In some embodiments, a voice biometric612that is used to verify/validate candidate voice stream604is provided by credential verification server112. For example, upon determining that the user name “msmith” is valid, credential verification server112may retrieve a voice biometric612associated with Mike Smith's user account (e.g., a voiceprint for Mike Smith) from biometric database118, and transmit the voice biometric612to voice verification server114(e.g., in addition to or in place of credential valid signal610). Where only voice biometric612is transmitted to voice verification server114, the voice biometric may act as the credential valid signal610. That is, in some embodiments, voice verification server114may proceed with verifying/validating candidate voice stream604in response to receiving voice biometric612from credential verification server112.

In some embodiments, a voice biometric612that is used to verify/validate candidate voice stream604is retrieved by voice verification server114. For example, in response to receiving credential valid signal610indicating that the user name “msmith” is valid, voice verification server114may retrieve the voice biometric612associated with Mike Smith's user account (e.g., the voiceprint for Mike Smith) from biometric database118.

The verifying/validating process for candidate voice stream604may include comparing content of the voice stream (e.g., what was said) and/or the biometric characteristics of the voice stream (e.g., how it was said). In some embodiments, candidate voice stream604is verified/validated when the content and/or the biometric characteristics of candidate voice stream604are verified/validated. For example, candidate voice stream604may be verified/validated if existing voice biometric612and candidate voice stream604both correspond to a recording of Mike Smith saying the word “chocolate” in a similar manner. In contrast, candidate voice stream604may not be verified/validated if existing voice biometric612includes a recording of Mike Smith saying the word “chocolate” and candidate voice stream604includes a recording of Mike Smith saying the word “chocolate” in a different manner (e.g., in a different tone of voice), a recording of Mike Smith saying a word other than “chocolate” (e.g., Mike Smith saying “strawberry”), or a recording of another user's voice (e.g., Jane White saying the word “chocolate”).

In some embodiments, the comparison of a candidate voice stream to an existing voice biometric is provided using a voice biometric engine. A voice biometric engine may be employed by voice verification server114. For example, voice verification module410may include a voice biometric engine. During a verification process, the voice biometric engine may extract vocal features from a sample (e.g., the candidate voice stream), compare the features to a stored voiceprint, and then generate a score or match probability. If the score or match probability satisfies (e.g., meets or exceeds) a predetermined threshold, the identity of the speaker may be verified. If the score or match probability does not satisfy (e.g., is below) a predetermined threshold, the identity of the speaker may not be verified. For example, if the comparison of a candidate voice stream604to a voice biometric612associated with Mike Smith results in a score above a threshold of 80% (e.g., a score of 95%), the voice biometric engine may confirm that the speaker is in fact Mike Smith and, thus, the candidate voice stream604may be verified/validated.

If candidate voice stream604is not validated/verified, voice verification server114may provide a corresponding indication that candidate voice stream604is invalid (and/or that the user is not authenticated) (block1006). In some embodiments, in response to voice verification server114determining that candidate voice stream604is invalid, voice verification server114transmits a voice stream invalid signal614a(and/or an authentication status signal616indicating the user is not authenticated) to user device104. For example, in response to voice verification server114determining that voice stream604includes the word “strawberry” (as opposed to “chocolate”) and/or is spoken by a person other than Mike Smith, voice verification server114may transmit a corresponding voice stream invalid signal614a(and/or an authentication status signal616indicating the user is not authenticated) to user device104. Voice stream invalid signal614amay indicate that voice stream604is not verified/valid and, thus, the user is not authenticated.

If candidate voice stream604is validated/verified, voice verification server114may provide a corresponding indication that candidate voice stream604is valid (and/or that the user is authenticated) (block1008). In some embodiments, in response to voice verification server114determining that candidate voice stream604is valid, voice verification server114transmits a voice stream valid signal614b(and/or an authentication status signal616indicating the user is not authenticated) to user device104. For example, in response to voice verification server114determining that voice stream604includes the word “chocolate” (i.e., the vocal password previously provided by Mike Smith during an enrollment process) and that it was spoken by Mike Smith, voice verification server114may transmit a corresponding voice stream valid signal614b(and/or an authentication status signal616indicating the user is authenticated) to user device104.

Turning now toFIG. 8B, method850may include receiving an authentication signal (block852) and determining whether the user is authenticated (block854). In some embodiments, an authentication signal may indicate whether the candidate credentials set600(e.g., candidate credentials602and/or candidate voice stream604) have or have not been verified/validated and, thus, the user120has or has not been authenticated. In some embodiments, an authentication signal may include a credential invalid signal608, a voice stream invalid/valid signal614a/614band/or an authentication status signal616.

In response to receiving credentials invalid signal608, a voice stream invalid signal614aand/or an authentication status signal616indicating the user is not authenticated, access to the resource may be denied and a corresponding indication of the denied access may be provided (block856) For example, in response to receiving credential invalid signal608, a voice stream invalid signal614a, and/or an authentication status signal616indicating the user is not authenticated, user device104may continue to deny access to “report.doc”, and may display a notification that access was denied along with a prompt for the user to re-enter a valid user name and speak a valid password into a microphone of user device104.

In response to receiving voice stream valid signal614band/or an authentication status signal616indicating the user is authenticated, access to the resource may be provided (block858). For example, in response to receiving voice stream valid signal614band/or an authentication status signal616indicating the user is authenticated, user device104may retrieve “report.doc” from a document server110and display the document on user device104for review/editing. In some embodiments, providing access to a resource may include transmitting a resource request618to a resource server110, and resource server110retrieving the resource (e.g., a document) from a database120, resource server110serving the requested resource620to user device104, and user device104providing access to the resource (e.g., displaying a document). In some embodiments, providing access to a resource may include user device104providing access. For example, where the request includes a request to e-sign a document, providing access to the resource may include the user device allowing a user to access an application that allows the user to e-sing documents using an e-signature associated with the authenticated user. Where, for example, user device104includes an electronic lock (e.g., door lock104d), providing access to the resource may include the lock opening to provide the user with physical access to an area or the like.

Accordingly, in some embodiments of the present invention, a user may be authenticated and/or provided access to a resource based on verification/validation of user credentials and/or a voice biometric provided by the user. Such an authentication technique may provide enhanced network security in an efficient and cost effective manner.

It will be appreciated that methods800,850,900and1000are exemplary embodiments of methods that may be employed in accordance with techniques described herein. The methods800,850,900and1000may be may be modified to facilitate variations of its implementations and uses. The order of the methods800,850,900and1000and the operations provided therein may be changed, and various elements may be added, reordered, combined, omitted, modified, etc. The methods800,850,900and1000may be implemented in software, hardware, or a combination thereof. Some or all of the methods800,850,900and1000may be implemented by one or more of the modules/applications described herein.

In some embodiments, some or all of methods800,850,900and1000may be may be implemented by one or more of the modules/applications described herein and/or may be executed on one or more devices. For example, credential verification module310and voice verification module410may be employed on a single authentication server.

As used throughout this application, the word “may” is used in a permissive sense (i.e., meaning having the potential to), rather than the mandatory sense (i.e., meaning must). The words “include”, “including”, and “includes” mean including, but not limited to. As used throughout this application, the singular forms “a”, “an” and “the” include plural referents unless the content clearly indicates otherwise. Thus, for example, reference to “an element” may include a combination of two or more elements. Unless specifically stated otherwise, as apparent from the discussion, it is appreciated that throughout this specification discussions utilizing terms such as “processing”, “computing”, “calculating”, “determining” or the like refer to actions or processes of a specific apparatus, such as a special purpose computer or a similar special purpose electronic processing/computing device. In the context of this specification, a special purpose computer or a similar special purpose electronic processing/computing device is capable of manipulating or transforming signals, typically represented as physical electronic or magnetic quantities within memories, registers, or other information storage devices, transmission devices, or display devices of the special purpose computer or similar special purpose electronic processing/computing device.