System, method and program product for associating a biometric reference template with a radio frequency identification tag

A system, method and program product for associating a biometric reference template with a RFID tag embedded in or attached to a physical object. The method includes coupling a RFID tag having a unique tag identifier to a physical object to be associated with an individual, providing a reference template having a unique reference template identifier that uniquely identifies biometric data pertaining to the individual and forming an association between the reference template and the tag, where the association provides a relationship, including a relationship type, between the object and the individual. In an embodiment, the forming step includes creating a biometric attribute in the tag for identifying the template identifier for the reference template or creating a tag attribute in the reference template, where the biometric attribute created in the tag and the tag attribute in the biometric application form an association between the object and the reference template.

FIELD OF THE INVENTION

The present invention relates to computer systems and software, and more specifically to a technique for associating a biometric reference template corresponding to an individual with a Radio Frequency Identification (RFID) tag embedded in or attached to a physical object.

BACKGROUND OF THE INVENTION

Biometric reference templates can be uniquely identified and associated with the identity of a person or individual. The biometric data component of a template is a constant that identifies an individual. Exposure of a reference template over time, when aggregated with other information, provides a footprint of activities that the individual participated in (such as, making a purchase in a store, clocking in and out of work, paying a highway toll) and the locations of that individual at various points in time (such as, when they were at a particular banking machine, toll booth, or store's check-out register). Similarly, data transmitted using a portable Radio Frequency Identification (RFID) tag may be used to uniquely identify a physical object, its location, or its characteristics, for instance, its color, shape, size, etc. An object containing an RFID tag can be used to identify or locate an individual associated with the object. Currently, there is no standardized means for providing relationships between a RFID tag and biometric data pertaining to an individual. As such, there is a need for providing relationships between a RFID tag and biometric data pertaining to an individual, without threatening the privacy of the individual.

SUMMARY OF THE INVENTION

The present invention resides in a system, method and program product for associating a biometric reference template corresponding to an individual with a Radio Frequency Identification (RFID) tag embedded in or attached to a physical object, in accordance with an embodiment of the invention. The method for associating a biometric reference template with a physical object includes coupling an identification tag having a unique tag identifier to a physical object to be associated with an individual, the identification tag includes stored data and information pertaining to the physical object, providing a biometric reference template having a unique biometric reference template identifier that uniquely identifies biometric data pertaining to the individual and forming an association between the biometric reference template and the identification tag, where the association provides a relationship between the physical object and the individual and indicates the type of relationship and where said association includes a type of relationship. In an embodiment, the forming step further includes creating a biometric attribute in the identification tag for identifying the unique biometric reference template identifier for the biometric reference template belonging to the individual, where the biometric attribute created in the identification tag supplies an association between the physical object and the biometric reference template of the individual. In an embodiment, the forming step includes creating a tag attribute in the biometric reference template for identifying the unique tag identifier for the physical object, where the tag attribute created in the biometric reference template supplies an association between the physical object and the biometric reference template of the individual. The method further includes cryptographically binding the biometric attribute to the identification tag, where the biometric attribute is cryptographically bound to the identification tag using at least one of: a hash, a digital signature, Message Authentication Code (MAC) and encryption. The method further includes cryptographically binding the tag attribute to the biometric reference template, where the tag attribute is cryptographically bound to the identification tag using at least one of: a hash, a digital signature, Message Authentication Code (MAC) and encryption. The method further includes cryptographically binding the tag attribute to the biometric reference template, where the tag attribute is cryptographically bound to the identification tag using at least one of: a hash, a digital signature, Message Authentication Code (MAC) and encryption and cryptographically binding the biometric attribute to the identification tag, where the biometric attribute is cryptographically bound to the identification tag using at least one of: a hash, a digital signature, Message Authentication Code (MAC) and encryption. In an embodiment, the identification tag includes a Radio Frequency IDentification (RFID) tag and where the biometric data includes at least one of physiological traits and behavioral traits.

In another aspect, the invention provides a computer system for associating a biometric reference template with an identification tag for a physical object. The computer system includes a network communications channel, an identification tag system having a central processing unit and coupled to the network communications channel, the identification tag system coupling at least one identification tag to a physical object, the identification tag having a unique tag identifier for identifying the physical object, a biometric system having a central processing unit and coupled to the network communications channel, the biometric system creating a biometric reference template having a unique biometric reference template identifier that uniquely identifies biometric data pertaining to an individual, an attribute tool for creating one or more attributes for the biometric reference template and for the identification tag and an association tool for forming an association between the biometric reference template and the identification tag, where the association provides a relationship between the physical object and the individual. The computer system further includes an authentication tool for signing the one or more attributes created for the biometric reference template and the identification tag. In an embodiment, the unique biometric reference template identifier for the biometric reference template belonging to the individual is identified in a biometric attribute created in the identification tag and where the biometric attribute created in the identification tag supplies an association between the physical object and the biometric reference template of the individual, and where said association includes a type of relationship. In an embodiment, the unique tag identifier for the physical object is identified in a tag attribute created in the biometric reference template and where the tag attribute created in the biometric reference template supplies an association between the physical object and the biometric reference template of the individual. In an embodiment, the tag attribute is cryptographically bound to the biometric reference template using at least one of: a hash, a digital signature, Message Authentication Code (MAC) and encryption and where the biometric attribute is cryptographically bound to the identification tag using at least one of: a hash, a digital signature, Message Authentication Code (MAC) and encryption. In an embodiment, the identification tag includes a Radio Frequency IDentification (RFID) tag and where the biometric data includes at least one of physiological traits and behavioral traits. In an embodiment, an instance of the identification tag is associated with one or more instances of the biometric reference template and where an instance of the biometric reference template is associated with one or more instances of the identification tag.

In yet another aspect, the invention provides a computer program product for associating a biometric reference template with an identification tag for a physical object. The computer program product includes a computer readable storage medium, first program instructions to couple an identification tag having a unique tag identifier to a physical object to be associated with an individual, the identification tag including stored data and information pertaining to the physical object, second program instructions to provide a biometric reference template having a unique biometric reference template identifier that uniquely identifies biometric data pertaining to the individual and third program instructions to create an association between the biometric reference template and the identification tag, where the association provides a relationship between the physical object and the individual, the association including a type of relationship, and where the first, second and third program instructions are recorded on the computer readable storage medium. In an embodiment, the third program instructions further include instructions to create a biometric attribute in the identification tag for identifying the unique biometric reference template identifier for the biometric reference template belonging to the individual, where the biometric attribute created in the identification tag provides the relationship between the physical object and the individual. In an embodiment, the third program instructions further include instructions to create a tag attribute in the biometric reference template for identifying the unique tag identifier for the identification tag coupled to the object, where the tag attribute created in the biometric reference template provides the relationship between the physical object and the individual. In an embodiment, the third program instructions further include instructions to create a biometric attribute in the identification tag for identifying the unique biometric reference template identifier for the biometric reference template belonging to the individual and to create a tag attribute in the biometric reference template for identifying the unique tag identifier for the identification tag coupled to the object, where the biometric attribute created in the identification tag provides the relationship between the physical object and the individual and where the tag attribute created in the biometric reference template provides the relationship between the physical object and the individual. In an embodiment, the third program instructions include instructions to cryptographically bind the biometric attribute to the identification tag, where the biometric attribute is cryptographically bound to the identification tag using at least one of: a hash, a digital signature, Message Authentication Code (MAC) and encryption. In an embodiment, the third program instructions include instructions to cryptographically bind the tag attribute to the biometric reference template, where the tag attribute is cryptographically bound to the biometric reference template using at least one of: a hash, a digital signature, Message Authentication Code (MAC) and encryption.

Further, in yet another aspect, the invention provides a process for deploying computing infrastructure includes integrating computer-readable code into a computing system, where the code in combination with the computing system is capable of performing a process for associating a biometric reference template with an identification tag for a physical object communicating data and information, the process includes coupling an identification tag having a unique tag identifier to a physical object to be associated with an individual, the identification tag includes stored data and information pertaining to the physical object, providing a biometric reference template having a unique biometric reference template identifier that uniquely identifies biometric data pertaining to the individual, forming an association between the biometric reference template and the identification tag and storing the association in a storage, where the association provides a relationship between the physical object and the individual, and where said association includes a type of relationship. In an embodiment, the forming step further includes creating a biometric attribute in the identification tag for identifying the unique biometric reference template identifier for the biometric reference template belonging to the individual, where the biometric attribute created in the identification tag supplies an association between the physical object and the biometric reference template of the individual. In an embodiment, the forming step further includes creating a tag attribute in the biometric reference template for identifying the unique tag identifier for the physical object, where the tag attribute created in the biometric reference template supplies an association between the physical object and the biometric reference template of the individual. The process further includes cryptographically binding the tag attribute to the biometric reference template, where the tag attribute is cryptographically bound to the identification tag using at least one of: a hash, a digital signature, Message Authentication Code (MAC) and encryption. The process further includes cryptographically binding the biometric attribute to the identification tag, where the biometric attribute is cryptographically bound to the identification tag using at least one of: a hash, a digital signature, Message Authentication Code (MACs) and encryption.

DETAILED DESCRIPTION OF THE INVENTION

Moreover, the described features, structures, or characteristics of the invention may be combined in any suitable manner in one or more embodiments. It will be apparent to those skilled in the art that various modifications and variations can be made to the present invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents. Reference will now be made in detail to the preferred embodiments of the invention.

In one embodiment, the invention provides a biometric infrastructure100that includes a biometric computer system102for creating a biometric reference template from a biometric sample collected for an individual, which is to be associated with a Radio Frequency Identification (RFID) tag (also referred to herein as “RFID tag” or “RFID” or simply as “tag”) attached or embedded in a physical object, such that, the association provides a unique relationship between the individual and the object, in accordance with an embodiment of the invention. In an embodiment, as depicted inFIG. 1, computer system or server102is intended to represent any type of computer system that is maintained in a secure environment, that is, for which access control is enforced (as represented by the dotted lines indicated by reference numeral101). Referring toFIG. 1, the computer system or server102is shown to include a CPU (Central CPU)106, a memory112, a bus110, and input/output (I/O) interfaces108. Further, the computer system or server102is shown in communication with external I/O devices/resources126and database120. In general, CPU106executes computer program code stored in memory112, such as the biometric application114for processing biometric data contained in a biometric sample132. In an embodiment, the biometric application114deployed on the computer system102is loaded into memory112of the computer system102from a computer readable storage medium or media (reference numeral125), such as, a magnetic tape or disk, optical media, DVD, memory stick, semiconductor memory, etc. or downloaded from the server via a network adapter card (reference numerals104) installed on the computer system or server102. Further, the memory112stores an attribute tool116for creating or defining one or more attributes to be included in the biometric reference template (also referred to herein as simply “biometric reference template” or “reference template” or “base template” or “base reference template”) that is created using an individual's biometric sample, as discussed further herein below. In addition, the memory112has deployed thereon an association tool117for creating associations between a biometric reference template and a physical object, as explained further herein below. Further, the memory112stores an authentication tool118for signing biometric reference templates and/or attributes associated with the biometric reference templates. In an embodiment, the biometric reference template144that is created using a biometric sample132collected from an individual is stored in the database120(shown as reference numeral124) within biometric system or server102. In an embodiment, one or more unique identifier(s)122, for instance, unique biometric reference template identifiers that uniquely identify respective biometric reference templates124are stored in database120. Further, in an embodiment, any biometric data128and/or information processed by the biometric sensor or reader device134are transmitted over the network130to the computer system or server102for storage in database120. Furthermore, in an embodiment, any associations127formed using the association tool117are stored in database120. In an embodiment, an association127specifies the type of association between the biometric reference template and any other information object, such as, a unique tag identifier for a identification tag, as explained further herein below. Moreover, a digital signature129used to sign a biometric reference template is stored with other digital signatures in database120. In particular, as shown inFIG. 1, a user or individual provides a biometric sample132using a biometric sensor or a biometric reader or scanning device134coupled to the biometric system102. In an embodiment, the biometric sensor or reader or scanner134converts the scanned user biometric sample132to a digital form using an instance136of the biometric application114deployed on computer system102. In an embodiment, an instance136of the biometric application114deployed on the computer system102is loaded into the sensor or reader device134within the biometric infrastructure100from a computer readable storage medium or media (reference numeral140), such as, a magnetic tape or disk, optical media, DVD, memory stick, semiconductor memory, etc. or downloaded from the server via a network adapter card (reference numerals104) installed on the computer system or server102. Similarly, an instance137of the attribute tool116and an instance138of the authentication tool118are loaded into the sensor or reader device134within the biometric infrastructure100from a computer readable storage medium or media (reference numeral140), such as, a magnetic tape or disk, optical media, DVD, memory stick, semiconductor memory, etc. or downloaded from the server using a network adapter card (reference numerals104) installed on the computer system or server102coupled to network130. In particular, the instance136of the biometric application114loaded into the biometric sensor or reader device134is used to process the biometric sample132collected from a person or an individual or user into biometric data139, which, in an embodiment, is stored within the biometric sensor or reader device134. Further, the biometric data139processed by the sensor or reader device134is used to create a biometric reference template144. In an embodiment, the sensor or reader device134uses the attribute tool or program137for creating one or more attributes to be associated with or attached to the biometric reference template144. Further, the sensor or reader device134uses the authentication tool or program138for signing the biometric reference templates that are created in the system. Further, the authentication tool138is used to sign any attributes that are associated with and/or included in a biometric reference template144. In an embodiment, the biometric reference template144created is assigned a unique biometric reference template identifier146(also referred to herein as “template identifier”) for uniquely identifying the biometric reference template144created using a person's biometric data139. In an embodiment, the biometric data139processed from the person's biometric sample132is stored within the biometric reference template144as reference numeral148. As shown inFIG. 1, in an embodiment, the biometric reference template144is signed with a digital signature160and the digital signature160for the biometric reference template144is detached from the biometric reference template144. In an embodiment, the unique base template identifier146is created in the form of an information object identifier (OID) as defined in ISO/IEC 8824-1 and ISO/IEC 9834-8, a universally unique identifier (UUID) as defined in ISO/IEC 9834-8, or a uniform resource identifier (URI) as defined in RFC 2396. In an embodiment, the biometric data148stored within the biometric reference template144is encrypted or protected in some manner, such as signing the entire biometric reference template144, as discussed further herein below. In an embodiment, the biometric reference template144includes one or more attributes (attribute1, reference numeral150, through attribute N, reference numeral152) created for the reference template. Other components, such as, a “biometric type indicator” (reference numeral149) that contains an indication of the type of biometric data (for example, fingerprint, iris or retinal scan, etc.) used to create the biometric reference template, is also included in the biometric reference template. In an embodiment, the biometric reference template144that is created using a biometric sample132provided by a user is stored in a biometric database120of the biometric system102along with other biometric reference templates124created for other users or individuals within the biometric system. In an embodiment, each of the biometric reference templates124stored within database120within the biometric system102is encrypted to protect the identities of the individuals that the biometric reference templates124belong to. Further, in an embodiment, each of the biometric reference templates is signed with a digital signature before being stored in the database120, as discussed further herein below. In an embodiment, the digital signature(s)129are stored within database120of the computer system or server102. It should be understood, however, that although not shown, other hardware and software components (e.g., additional computer systems, routers, firewalls, etc.) could be included in infrastructure100.

Reference is now made toFIG. 2, which depicts an embodiment of a computer infrastructure200for creating a Radio Frequency Identification (RFID) tag (also referred to herein as “RFID tag” or “RFID” or simply as “tag”) for a physical object and associating the RFID tag with a biometric reference template created using a biometric sample collected from an individual, in accordance with an embodiment of the present invention. In an embodiment, the RFID tag or device254attached to or embedded in a physical object252is an active RFID tag or identification tag254that comprises a microchip combined with an antenna in a compact unit that is equipped with a battery that provides a source of power for the RFID tag's circuitry and antenna. In another embodiment, the RFID tag254attached to or embedded in a physical object252is a chipless RFID tag (also known as RF fibers) that does not include any integrated circuit technology and instead comprises fibers that reflect a portion of the receptor or reader's radio-frequency signal back. Although the invention is described in terms of a Radio Frequency Identification (RFID) tag, it will be understood that an identification tag may include a bar code, a smart card, a chip card or an integrated circuit (ICC) having integrated circuits that can process data. As shown inFIG. 2, the RFID system infrastructure200includes a computer system202that is connected to a network230. In an embodiment, as depicted inFIG. 2, computer system or server202is intended to represent any type of computer system that is maintained in a secure environment, that is, for which access control is enforced (as represented by the dotted lines indicated by reference numeral201). In an embodiment, the computer system202is an information processing server that includes a RFID application214for programming RFID tags embedded in or attached to physical objects. Further, the computer system or server202is configured to work with RFID receptors that interrogate or query RFID tags associated with the RFID system202. In an embodiment, the RFID application214deployed on the computer system or server202includes an attribute tool or program216for creating one or more attributes that are to be associated with the RFID tag, as discussed herein below. Further, in an embodiment, the computer system202includes an authentication tool218for signing attributes, as discussed further herein below. As shown inFIG. 2, the computer infrastructure200includes a receptor or reader or scanner240for receiving a tag identifier and other information from an identification tag254embedded in or affixed to a physical object252. In an embodiment, the receptor240comprises a RFID receptor that has an antenna242that receives radio waves for reading or radiates radio waves for receiving a tag identifier and other information from a RFID tag254. In an embodiment, the RFID tag254also comprises an antenna (not shown in any of the drawings). The RFID tag's antenna picks up the signals radiated from the RFID receptor or scanner or reader device240and the RFID tag254responds to the signal by sending data and/or information262stored within the RFID tag254. Further, the receptor240transmits, via network230, the data and/or information262read from the RFID tag254to the computer system202for storage. In an embodiment, the data and/or information received is stored within a database220associated with computer system or server202, as shown by reference numeral228in database220. In an embodiment, the RFID tag254embedded in or attached to the object252further includes a unique tag identifier or object identifier256that uniquely identifies the object252associated with the RFID tag254. The RFID receptor240reads data and/or information262related to the unique tag identifier256within the identification tag254. Further, the RFID tag254for the object252includes one or more attributes (attribute1through attribute N, reference numeral258through260). For instance, an attribute may include a privacy policy identifier that uniquely identifies a privacy policy that is to be associated with the identification tag254for indicating a level of protection required for the data and/or information262contained in the RFID tag254and its proper and intended use by a recipient. Referring toFIG. 2, the computer system or server202is shown to include a CPU (Central CPU)206, a memory212, a bus210, and input/output (I/O) interfaces208. Further, the server202is shown in communication with external I/O devices/resources226and database220. In general, CPU206executes computer program code stored in memory212, such as the RFID application214, the attribute tool216for creating or defining one or more attributes to be included in the RFID tag254, an association tool217for creating one or more associations between an identification tag and a biometric reference template, and an authentication tool218for signing attributes that are created for an identification tag254. In an embodiment, the one or more unique identifier(s)222that are associated with a RFID tag254are stored in database220. Further, in an embodiment, any associations224formed using the association tool217are stored in database220. Further, in an embodiment, any data and/or information262transmitted by the RFID tag254over the network230are stored in database220, referenced by reference numeral228. In general, CPU206executes computer program code stored in memory212, such as the RFID application214and/or the attribute tool216for creating attributes for an identification tag254, where the attribute may contain, for example, a privacy policy identifier for identifying a privacy policy that is associated with the RFID tag254. While executing the RFID application or program214on the computer system or server202, the CPU206can read and/or write data, to/from memory212, database220, and/or I/O interfaces208, such as, the data and/or information228stored in database220. Alternatively, the RFID application214may store the data and/or information in memory212. Bus210provides a communication link between each of the components in computer system202, such that information can be communicated within the infrastructure200. External devices226can comprise any devices (e.g., keyboard, pointing device, display, etc.) that enable a user to interact with computer system202and/or any devices (e.g., network card, modem, etc.) that enable the system202to communicate with one or more other computing devices, such as, the receptor240and/or the identification tag254. The attribute tool216and/or the authentication tool218can be loaded into memory212of the computer system202from a computer readable storage medium or media (reference numeral225), such as, a magnetic tape or disk, optical media, DVD, memory stick, semiconductor memory, etc. or downloaded from the server via a network adapter card (reference numerals204) installed on the computer system or server202. Similarly, the attributes created by the computer system202for a RFID or identification tag254can be loaded onto the tag254using a storage medium or media (reference numeral270). It should be understood, however, that although not shown, other hardware and software components (e.g., additional computer systems, routers, firewalls, etc.) could be included in infrastructure200. Further, although the computer infrastructure100is shown as being separate from the computer infrastructure200, it will be understood by one skilled in the art that the biometric system and the RFID system can be deployed on the same computer system or server.

Reference is now made toFIG. 3, reference numeral300, which depicts elements or components of a signed biometric reference template that is to be associated with a RFID tag, in accordance with respective embodiments of the present invention. Turning toFIG. 3, reference numeral300shows an embodiment of a signed biometric reference template that is to be associated with a RFID tag embedded in or attached to a physical object. In particular, as shown by the dotted lines350inFIG. 3, the biometric reference template310, is signed using a digital signature provided by the authentication tool118(shown inFIG. 1), as explained herein below. In an embodiment, the biometric reference template310includes a unique biometric reference template identifier312(also referred to herein as “biometric reference template identifier” or “biometric identifier” or “template identifier”) that uniquely identifies the biometric reference template310belonging to an individual. Further, in an embodiment, the biometric reference template310includes biometric data314, that is, data processed from a biometric sample collected from an individual using a biometric application. Furthermore, the biometric reference template310includes a “biometric type indicator” component (reference numeral320) that contains an indication of the type of biometric data (for example, fingerprint, iris or retinal scan, etc.) used to create the biometric reference template. Further, one or more attributes (attribute1, reference numeral322, through attribute N, reference numeral324) are created for the biometric reference template, using the attribute tool116inFIG. 1. In an embodiment, to form a digital signature on an information object, such as, a biometric reference template, a cryptographic hash (also referred to herein as “encrypted hash” or “hash value” or simply “hash”) is computed over the entire object or biometric reference template and then the hash is signed. For instance, where a RSA digital signature scheme is used to sign a biometric reference template, a key is used to encrypt the hash to form the digital signature. Furthermore, in an embodiment, the signed biometric reference template350is stored with other biometric reference templates124in database120(FIG. 1). Additionally, the digital signature used to sign the biometric reference template310is stored with other signature(s)129in a database, for instance, database120, as shown inFIG. 1. In an embodiment, as shown inFIG. 3, the digital signature (reference numeral350) is appended to a biometric reference template310(as shown inFIG. 3) and the biometric reference template along with the digital signature may be stored in a database within a biometric system. In an alternate embodiment, the digital signature may be detached from the biometric reference template, as shown by reference numeral160inFIG. 1. Similarly, any of the attributes created for the biometric reference template may be detached from the biometric reference template and not included within the biometric reference template310, as shown. The use of digital signatures to sign objects to be authenticated is well known in the art and, as such, will not be discussed further herein. For instance, if a RSA algorithm is used to sign the hash, a private key is used to encrypt the hash to form the digital signature, which is then decrypted by a relying party using their associated public key. However, the template identifier312within the biometric reference template310that uniquely identifies the biometric reference template can be cryptographically bound to an attribute using other methods, such as a Message Authentication Code (MAC) or encryption. Moreover, the biometric reference template310containing the attribute322-324need not be signed when used in a context in which a trust relationship has been established. However, when trust by a third party is needed, the hash of the biometric reference template containing the privacy policy attribute is signed (using an authentication tool118as shown inFIG. 1) and is included in the biometric reference template as a component of the signed biometric reference template. When the signature is validated and trust in the signed information is established, the relying party is assured that the information contained in the attribute is for a given biometric reference template, since the signature350covers the hash of the biometric reference template310which includes any attributes and the relying party can compare this signed hash to ensure that the hash is identical to a hash the relying party computes over the biometric reference template that contains one or more attributes.

Reference is now made toFIGS. 4A-4C, which depict different embodiments for associating an attribute created for a RFID tag embedded in or attached to a physical object with an attribute created for a biometric reference template corresponding to an individual, in accordance with embodiments of the present invention. As such, components that are the same in each ofFIGS. 4A,4B and4C are labeled with the same reference numerals. Turning toFIG. 4A, reference numeral400A, depicts one embodiment of associating an identification tag, such as, a RFID tag embedded in or affixed to a physical object with a biometric reference template, in accordance with an embodiment. As shown inFIG. 4A, an identification tag, such as, a RFID tag, reference numeral404is embedded in or attached to a physical object402. Further, the identification tag404contains a unique tag identifier406that uniquely identifies the object that the tag is embedded in or attached to. In an embodiment, the identification tag404contains one or more attributes (attribute1, reference numeral408through attribute N, reference numeral409) that are defined to contain information or data. For instance, an attribute can be defined as a privacy policy attribute, where the attribute contains a privacy policy identifier that identifies a privacy policy that sets forth the proper use and handling of information transmitted by the RFID tag. Further, as shown inFIG. 4A, the identification tag404is associated with a biometric reference template410. In an embodiment, the biometric reference template410contains a unique biometric reference template identifier412that identifies a biometric reference template belonging to an individual. Further, the biometric reference template410includes biometric data414that is data processed from a biometric sample provided by the individual corresponding to the biometric reference template410. Furthermore, the biometric reference template410includes one or more attributes (attribute1, reference numeral416through attribute N, reference numeral420). In an embodiment, attribute1, reference numeral416in the biometric reference template410contains a unique tag identifier418, which is the same unique tag identifier406that is contained in the identification tag404embedded in or attached to the physical object402. Further, the attribute1(reference numeral416) in the biometric reference template410contains an association type component, reference numeral419, which specifies the type of association between the unique tag identifier418and the biometric reference template410. In an embodiment, the association type component is created using the association tool117shown inFIG. 1. For instance, if the physical object402is a vehicle and the biometric reference template410belongs to the vehicle's owner, this type of association may be specified in the association type component419. Additionally, as shown inFIG. 4A, the biometric reference template410is signed (indicated by the dotted lines422) with a digital signature as described herein above. Accordingly, the placing of the unique tag identifier406for the physical object within an attribute416of the biometric reference template410(that is, the unique tag identifier reference numeral418) creates an association between the physical object402and the individual corresponding to the biometric reference template410.

Turning toFIG. 4B, reference numeral400B, depicts another embodiment of associating an identification tag, such as, a RFID tag embedded in or affixed to a physical object with a biometric reference template, in accordance with an embodiment. As shown inFIG. 4B, an identification tag, such as, a RFID tag, reference numeral404is embedded in or attached to a physical object402. Further, the identification tag404contains a unique tag identifier406that uniquely identifies the physical object that the tag is embedded in or attached to. In an embodiment, the identification tag404contains one or more attributes (attribute1, reference numeral408through attribute N, reference numeral409) that are defined to contain information or data. As shown inFIG. 4B, the attribute1(reference numeral408contains a unique biometric reference template identifier430that identifies a biometric reference template410corresponding to an individual whose biometric sample was collected and processed. Further, the attribute1(reference numeral408) in the identification tag or RFID tag404contains an association type component, reference numeral432, which specifies the type of association between the unique biometric reference template identifier430and the physical object402. In an embodiment, the association type component is created using the association tool217shown inFIG. 2. For instance, if the physical object402is a vehicle and the biometric reference template410belongs to the vehicle's owner, this type of association may be specified in the association type component432. Furthermore, the identification tag404may contain additional attributes, such as, a privacy policy attribute, where the attribute contains a privacy policy identifier that identifies a privacy policy that sets forth the proper use and handling of information transmitted by the RFID tag. Further, as shown inFIG. 4B, the unique biometric reference template identifier430placed within the identification tag or RFID404is the same unique biometric reference template identifier412that is placed in the biometric reference template410. In an embodiment, the unique biometric reference template identifier412identifies the biometric reference template410belonging to an individual. Further, the biometric reference template410includes biometric data414, which is data processed from a biometric sample provided by the individual corresponding to the biometric reference template410. Furthermore, the biometric reference template410includes one or more attributes (attribute1, reference numeral416through attribute N, reference numeral420). For instance, attribute1, reference numeral416in the biometric reference template410may contain a unique privacy policy identifier, which identifies a privacy policy that is associated with the biometric reference template410, setting forth the proper use and handling of the information contained in the biometric reference template410. Additionally, as shown inFIG. 4B, the biometric reference template410is signed (indicated by the dotted lines422) with a digital signature as described herein above. Accordingly, the placing of the unique biometric reference template identifier430within an attribute (reference numeral408) of the identification tag404embedded in or attached to the physical object, which is the same unique biometric reference template identifier412contained within the biometric reference template410, creates an association between the physical object402and the individual corresponding to the biometric reference template410.

Turning toFIG. 4C, reference numeral400C, depicts another embodiment of associating an identification tag, such as, a RFID tag embedded in or affixed to a physical object with a biometric reference template, in accordance with an embodiment. As shown inFIG. 4C, an identification tag, such as, a RFID tag, reference numeral404is embedded in or attached to a physical object402. Further, the identification tag404contains a unique tag identifier406that uniquely identifies the physical object that the tag is embedded in or attached to. In an embodiment, the identification tag or RFID404contains one or more attributes (attribute1, reference numeral408through attribute N, reference numeral409) that are defined to contain information or data. As shown inFIG. 4C, the attribute1(reference numeral408) contains a unique biometric reference template identifier430that identifies a biometric reference template410corresponding to an individual whose biometric sample was collected and processed. Further, the attribute1(reference numeral408) in the identification tag or RFID tag404contains an association type component, reference numeral432, which specifies the type of association between the unique biometric reference template identifier430and the physical object402. In an embodiment, the association type component is created using the respective association tool (reference numeral117and217) shown inFIGS. 1 and 2. For instance, if the physical object402is a vehicle and the biometric reference template410belongs to the vehicle's owner, this type of association may be specified in the association type component432. Furthermore, the identification tag404may contain additional attributes, such as, a privacy policy attribute, where the attribute contains a privacy policy identifier that identifies a privacy policy that sets forth the proper use and handling of information transmitted by the RFID tag. Further, as shown inFIG. 4C, the unique biometric reference template identifier430placed within the identification tag or RFID404is the same unique biometric reference template identifier412that is placed in the biometric reference template410. In an embodiment, the unique biometric reference template identifier412and/or430identifies the biometric reference template410belonging to an individual. Further, the biometric reference template410includes biometric data414, which is data processed from a biometric sample provided by the individual corresponding to the biometric reference template410. Additionally, the biometric reference template410includes one or more attributes (attribute1, reference numeral416through attribute N, reference numeral420). Further, as shown inFIG. 4C, the identification tag404is associated with a biometric reference template410. In an embodiment, the biometric reference template contains a unique biometric reference template identifier412that identifies a biometric reference template belonging to an individual. Further, the biometric reference template410includes biometric data414that is data processed from a biometric sample provided by the individual corresponding to the biometric reference template410. Furthermore, the biometric reference template410includes one or more attributes (attribute1, reference numeral416through attribute N, reference numeral420). In an embodiment, attribute1, reference numeral416in the biometric reference template410contains a unique tag identifier418, which is the same unique tag identifier406that is contained in the identification tag404embedded in or attached to the physical object402. Further, the attribute1(reference numeral416) in the biometric reference template410contains an association type, reference numeral419, which specifies the type of association between the unique tag identifier418and the biometric reference template410. For instance, if the physical object402is a vehicle and the biometric reference template410belongs to the vehicle's owner, this type of association may be specified in the association type component419. Further, other attributes can be created for the biometric reference template410. For instance, attribute N, reference numeral420in the biometric reference template410may contain a unique privacy policy identifier, which identifies a privacy policy that is associated with the biometric reference template410, setting forth the proper use and handling of the information contained in the biometric reference template410. Additionally, as shown inFIG. 4C, the biometric reference template410is signed (indicated by the dotted lines422) with a digital signature as described herein above. Accordingly, the placing of the unique tag identifier406for the physical object within an attribute416of the biometric reference template410(which is the same unique biometric reference template identifier reference numeral418) and the placing of the unique biometric reference template identifier430(which is the same unique biometric reference template identifier412contained within the biometric reference template410) creates an association between the physical object402and the individual corresponding to the biometric reference template410.

In another embodiment, the invention provides a method for creating an attribute for a RFID tag embedded in or attached to a physical object, where the attribute contains a biometric reference template identifier for a biometric reference template that is to be associated with the RFID tag, in accordance with an embodiment of the invention. Reference is now made toFIG. 5, reference numeral500, which depicts a flowchart outlining the method steps for providing a Radio Frequency Identification (RFID) tag attached to or embedded in a physical object that includes an attribute that contains an association between the physical object and a biometric reference template belonging to an individual, in accordance with an embodiment of the present invention. Turning toFIG. 5, reference numeral500, the method begins with providing, in step502, an identification tag, for instance, a RFID tag that has a unique tag identifier for uniquely identifying a physical object that the identification tag is attached to or embedded in. In an embodiment, in step504, data and information for the physical object is stored on the RFID tag. Further, in step506, a biometric reference template identifier to be associated with the physical object is stored in an attribute created for the RFID tag, along with the type of association. In an embodiment, in step508, the attribute contained in the tag embedded in or attached to the physical object and containing the biometric reference template identifier is encrypted. Further, in step510, in an embodiment, the attribute contained in the tag embedded in or attached to the physical object is signed with a digital signature. In step512, the signed attribute of the tag is stored in a database. In an embodiment, a globally unique biometric reference template identifier is used to indicate a particular biometric reference template belonging to an individual. As mentioned herein above, the biometric reference template identifier could be created in the form of an information object identifier (OID) as defined in ISO/IEC 8824-1 and ISO/IEC 9834-8, a universally unique identifier (UUID) as defined in ISO/IEC 9834-8, a uniform resource identifier (URI) as defined in RFC 2396, a cryptographic hash of the biometric reference template, a digital signature over the biometric reference template, or some other means of uniquely naming the biometric reference template. When OIDs, UUIDs, or URIs are used for creating biometric reference template identifiers, these indicators could be included in the RFID tag information.

Reference is now made toFIG. 6, reference numeral600, which outlines the steps for creating an attribute for a base biometric reference template belonging to an individual, where the attribute contains a unique tag identifier or RFID identifier embedded in or attached to a physical object to be associated with the individual, in accordance with an embodiment of the invention. Referring toFIG. 6, the process begins with a biometric application within a biometric reader or scanner device collecting in step602a biometric sample from an individual to create a biometric reference template within the biometric system. In step604, a unique biometric reference template identifier is assigned to or obtained for the biometric reference template being created. Further, in step606, a unique tag identifier for an identification tag or RFID tag is stored in an attribute created for the biometric reference template. In an embodiment, the unique tag identifier identifies the identification tag or RFID tag embedded in or attached to the physical object and which is to be associated with the individual whose biometric sample is collected. In step608, the biometric reference template is created using the biometric sample collected from the individual. In step610, the biometric application cryptographically binds the attribute containing the unique identification tag identifier to other information in the biometric reference template. Further, the biometric reference template containing the attribute is stored in a database in step612, ending the process.

Turning toFIG. 7, reference numeral700depicts a flowchart outlining the steps for processing a request received from an individual seeking access to a physical object, in accordance with an embodiment of the present invention. The method begins in step702with an individual requesting from a biometric service provider access to a physical object by asserting his or her identity. The individual provides a biometric sample in step704to the biometric service provider. The biometric service provider retrieves or obtains the biometric reference template corresponding to the individual whose identity is asserted and matches the collected sample to a biometric reference template in step706. In step708, the biometric service provider uses a biometric application to determine whether or not the collected sample matches the biometric reference template stored in the biometric system. If the collected sample does not match the biometric reference template stored in the biometric system, then the process ends. However, if the collected sample matches the biometric reference template in step708, then in step710, the biometric service provider obtains the unique biometric reference template identifier from the biometric reference template for the individual requesting access. Further, in step712, the biometric service provider obtains the unique biometric reference template identifier stored in an attribute of the identification tag. In step714, a determination is made by the biometric system as to whether or not the template identifier attribute stored on the identification tag is signed. If the template identifier attribute stored on the identification tag is determined to be not signed, then the process continues at step720. However, if the template identifier attribute stored on the identification tag is determined to be signed, then in step716, the biometric system verifies the signature on the attribute stored on the identification tag. In an embodiment, in step718, the signature is compared to a signature stored in a database. If the signature on the attribute stored on the identification tag does not match the signature stored in the database, then the process ends. However, if the signature on the attribute stored on the identification tag matches the signature stored in the database, then in step720, the value of the unique template identifier stored in the biometric reference template is compared to the unique template identifier stored on the identification tag. Further, a determination is made in step722as to whether or not the value of the unique template identifier stored in the biometric reference template matches the value of the unique template identifier stored on the identification tag. If the value of the unique template identifier stored in the biometric reference template matches the unique template identifier stored on the identification tag, then the individual is granted access to the object in step724, ending the process. However, if the value of the unique template identifier stored in the biometric reference template does not match the unique template identifier stored on the identification tag, then the individual is denied access to the object in step726, ending the process.

Accordingly, the invention provides a system, method and a program product for associating a biometric reference template corresponding to an individual with a Radio Frequency Identification (RFID) tag embedded in or attached to a physical object. A biometric reference template can be associated with an RFID in different ways and the association itself may be external and distinct from the template and the RFID, appended to the template or RFID, or included in the template or RFID. The unique identifier value of an RFID or the RFID information can be cryptographically bound to a reference template using a hash, digital signature, Message Authentication Code (MAC), or encryption. The RFID identifier value or the RFID information can be associated with a biometric template by placing the RFID identifier or the RFID information along with the template in a file, file record, or database, or by placing the template and RFID identifier or RFID information together in the storage area of any device, or on any form of media. One instance of the RFID identifier or RFID information can be associated with one or more biometric templates, or one instance of a biometric template can be associated with one or more instances of an RFID identifier or RFID information. A biometric template and RFID association can be implemented in software as a signed attribute as defined in the X9.73 Cryptographic Message Syntax (CMS) and X9.96 XML CMS standards, as a SAML (Security Assertion Markup Language) assertion, so that they can be used in web services tokens, as defined in ITU-T Recommendation X.1141 and the OASIS SAML standards, as an attribute in an X.509 Attribute Certificate, or as a field in a DB2 database record. Regardless of implementation format, a simple association would contain at a minimum a value that uniquely identifies a biometric template (and by proxy, an individual) and a value that uniquely identifies an RFID (and by proxy, a physical object). Additionally, an association could contain an indication of the relationship between an individual and an object, for example, owner-object, lessor-lessee, parent-child, master-pet, author-document, etc. Though there are many possible definitions, one abstract syntax representation of an association between one individual and a set of one or more objects could be:Association::=SEQUENCE{biometricTemplateID DigestedData,—Cryptographic hash of a biometric template rfidSet SET SIZE(1 . . . MAX) OF RFID}
Here a unique cryptographic hash of a biometric template identifies an individual as being associated in some manner with one or more physical objects. An alternative definition could allow a set of values of type DigestedData to represent a group of biometric templates, all belonging to a single individual (to support multimodal biometrics or a set of revocable biometrics), or with each template in the set belonging to a distinct individual. Thus, associations such as group ownership, group responsibility, or group rights to perform some action on an object could be represented. As example, consider that a group of individuals, each with a unique biometric template are allowed to edit a document identified by an embedded RFID. The group of individuals component of such an association could be represented as a “SET SIZE(1 . . . MAX) OF DigestedData”, and the document could be represented as a “SET SIZE(1) OF RFID”. For the purposes of compliance and audit, a trained practitioner can use an association, along with the security policies and practices of the organization, to determine if the organization effectively maintains the rights or requirements provided for a given relationship. As example, the rights of an owner exert control over an object.