System and method for user authentication

A method and system for authenticating the identity of a user by an authority makes use of presenting biometric data for the user in a predetermined shared secret sequence. The method and system can be augmented by requesting an additional shared secret, such as a PIN or additional credentials, to establish multiple layers of authentication. Varying the layers of authentication results in greater or lesser security, and the accuracy for any given layer can be relaxed without compromising the integrity of the entire method.

FIELD OF THE INVENTION

The present invention relates to the field of user authentication systems and more particularly to a method and system of authenticating or verifying the identity of a user using biometric data about the user.

BACKGROUND OF THE INVENTION

The task of authenticating or verifying the identity of a user requires a certain level of security in addition to the method by which the user is identified. A typical authentication system involves, for example, a user who has a smart card or perhaps simply a credit card. When the user presents himself or herself to the system, such as at an automatic teller machine (ATM), the user presents his or her credit card, which identifies the particular user by name and account number. The user then presents his or her personal identification number (PIN), or similar information known only to the user, and the presented information is sent to a host computer. The host computer, which is based on a database, can then identify the user by the user's name and, for example, by the particular PIN that the user is supposed to use.

In the case when biometrics are used for authentication, the identification of the user can be done by presenting a biometric such as a fingerprint, the user's face, or the user's voice, to the system. In addition to that, when the user identifies himself or herself by presenting a biometric, such as a fingerprint, the system goes through the process of looking at a stored template of the user's fingerprint which was created in advance. The system compares the user's presented fingerprint to the stored template and verifies that this is the same person, making its decision based on certain predefined parameters, such as threshold of match scores between the presented and stored biometric samples.

SUMMARY OF THE INVENTION

It is a feature and advantage of the present invention to provide a method and system of authenticate a user with biometric data which allows the use of a high biometric recognition threshold to filter out as many impostors as possible, while at the same time minimizing the rate of false rejections.

It is another feature and advantage of the present invention to provide a method and system of authenticate the user with biometric data which enables a lower rate of false rejections without increasing the rate of false acceptances.

To achieve the stated and other features, advantages and objects, an embodiment of the present invention provides a method and system for authenticating the identity of a user by an authority that makes use of biometric data, which is what the user is, and additional information, which is what the user knows, for example, by presenting the biometric in a predefined manner, such as a predefined sequence. The predefined manner in which the biometric is presented, such as presenting the user's fingerprints in a predefined sequence, functions as the user's PIN. An embodiment of the present invention uses biometric data together with the predetermined sequence of presenting the biometric data to enable the user to gain access to a device, physical location, or network.

The authentication method and system for an embodiment of the present invention can be augmented by requesting an additional shared secret, such as a PIN, or additional credentials, thus establishing multiple layers of authentication. Varying the layers of authentication results in greater or lesser security, and the accuracy for any given layer can be relaxed without compromising the integrity of the entire method. In order to minimize the risk of replay attack, the predetermined sequence may be different for consecutive accesses.

In an embodiment of the present invention, the user presents one or more user credentials for enrollment by an authority, such as a bank. The user credentials include, for example, one or more biometric templates for the user's fingerprint(s), face, voice and/or iris and/or one or more digital documents, such as a digital certificate and/or a digital signature for the user and/or one or more paper documents, such as a passport for the user. The user credential(s), which represent user authentication information, are stored for the user, for example, on a host computer, a local terminal, and/or a user token, such as a smart card, and the stored user credential(s) can be signed with the user's private key.

In addition, one or more shared secrets is established between the user and the authority relating to a predefined shared secret manner for presenting each of one or more current user credentials to the authority, such as a predefined shared secret sequence of presenting the current user credential(s). Information about the predefined shared secret, which functions in a manner analogous to a PIN for the user, is stored for the user in a database. The information about the shared secret(s) can be stored in the same database as the database storing the user credential(s), and both can be stored encrypted and digitally signed.

One or more additional shared secrets for an embodiment of the present invention can include, for example, a predefined shared secret PIN for the user, one or more additional predefined shared secret manner(s) of presenting the current user credential(s) to the authority, a predefined shared secret manner of presenting one or more additional current user credential(s) to the authority for the user, and/or a predefined shared secret manner of presenting each of several additional current user credentials to the authority for the user. In addition, the predefined shared secret manner of presenting each of several additional current user credentials can include one or more variation(s) corresponding to a variation in a degree of security and/or for use on consecutive occasions.

In an embodiment of the present invention, in order to authenticate the identity of the user, the user presents one or more current user credential(s), such as one or more current biometric samples for the user's fingerprint(s), face, voice, and/or iris, to the authority in the predefined shared secret sequence(s). For example, the authority can direct the user to present a biometric sample for one or more user fingerprint(s) in a particular predefined shared secret sequence, or a combination of biometric samples for two or more of the user's fingerprint(s), face, voice, and/or iris in a predefined shared secret sequence. In another aspect, the shared secret manner of presenting the current user credential(s) involves, for example, presenting at least two user credentials by the authority in a predefined shared secret sequence, or in a manner directed by the authority, or in one of several predefined secret sequences randomly selected by the authority.

The authority for an embodiment of the present invention authenticates the identity of the user based on a correspondence between the enrolled and current user credentials and a correspondence between the shared secret manner for presenting the current user credential(s) and the manner in which the current user credential(s) are presented to the authority. The authentication is performed, for example, by the host computer or the local device for activation of a device, such as a gate controller, a door opener, a telephone, or appliance, or for access, such as device access, physical location access, or network access. Other aspects of an embodiment of the present invention involve, for example, authenticating the identity of the user to a smart card or to activate a silent alarm for the user.

Additional objects, advantages and novel features of the present invention will be set forth in part in the description which follows, and in part will become more apparent to those skilled in the art upon examination of the following or may be learned by practice of the invention.

DETAILED DESCRIPTION

Referring now in detail to an embodiment of the present invention, an example of which is illustrated in the accompanying attachments,FIG. 1is a schematic diagram which shows an example of key components and the flow of information between the key components for the authentication method and system for an embodiment of the present invention. An aspect of the present invention provides a method and system of authenticating a user10to the system14, such as an ATM system, which makes use of biometric data, which is what the user10is, and additional information, which is what the user10knows, for example, by presenting the biometric in a predefined manner, such as a predetermined sequence.

FIG. 2is a table which illustrates examples of credentials, which represent what the user is or has, and shared secrets, which represent what the user knows, for the authentication method and system of an embodiment of the present invention. The predefined manner in which the biometric26is presented, such as presenting the user's fingerprints28in a predetermined sequence46, functions as the user's PIN44. Thus, the user's fingerprints28are what the user10has, and the sequence46in which they are presented is what the user10knows. The method and system for user authentication identification for an embodiment of the present invention uses biometric data26and the predetermined sequence46of presenting the biometric data26in order to gain access to a device, physical location, or network.

This authentication method may be augmented by requesting an additional shared secret, such as a PIN44, or additional credentials, such as documentation36, thus establishing multiple layers of authentication. Varying the layers of authentication results in greater or lesser security. Additionally, with multiple layers of authentication, the accuracy for any given layer can be relaxed without compromising the integrity of the entire method. In order to minimize the risk of replay attack, the predetermined sequence46may be different for consecutive accesses. The authentication process can be executed between the user10and a smart card or a trusted network. In a situation where the user10is in danger, a separate sequence46may be presented to alert the authentication system14that the user10is in danger.

In addition to presentation and comparison of a biometric26, such as a fingerprint28, an aspect of an embodiment of the present invention involves the use, for example, of presentation and comparison of additional biometrics26, such as the user's voice30or face32, a document36, or perhaps a PIN44, in effect, combining biometrics26and PIN44or other information in a single process. When the user10comes to the system14and presents a biometric26, such as the user's fingerprint28, the way in which the user10presents the fingerprint28is unique to the particular user10. Further, only the particular user10knows the way he or she presents the fingerprint28.

For example, in an embodiment of the present invention, the user's fingerprint28can be presented in particular time sequences46, such as having the user present the same finger once and then remove it and present it again and then remove it again. The system14knows the specific sequence46which, like a PIN44, identifies the particular user's knowledge. Alternatively, the user10may present perhaps two or three fingerprints28, such as first finger, then third finger, and then second finger, which is analogous to entering the numerals for a PIN44. Another alternative aspect involves, for example, in addition to use of a fingerprint sequence46, the system14can be preprogrammed to ask for some other additional information to help in the authentication process, such as a PIN44.

Additionally, the system14for an embodiment of the present invention can be preprogrammed to randomly ask the user10to present additional credentials out of previously enrolled credentials to prevent a replay attack that might be attempted to defeat the authentication process. In order to avoid such a replay attack, some part of the secret is generated by the system44and another part is the shared secret42between the user10and the system44or authority. Thus, the authentication process is different each time, and if a third party records the sequence46and replays it, it will not work. A replay attack involves, for example, capturing the shared secret sequence46, such as a fingerprint sequence46, by a recording device and attempting to defeat the authentication process by replaying the sequence46.

Authenticating the user10, for example, to open the user's door at home requires a relatively low level of security, and it may be adequate for the user10who wants a biometric authentication system to install a system which is based on the traditional approach, such as presenting one of the user's fingers for comparison of the fingerprint28with a system-stored template. For additional security, an embodiment of the present invention involves presentation and comparison, for example, of the fingerprint28of one finger and then another finger, to make it a little more secure.

For much greater security, an embodiment of the present invention involves, for example, one or more of presentation and comparison of the user's face32with a system-stored template, a visual comparison of the user10with a photograph by a security person, and/or presentation of fingerprints28in a certain sequence46. As an alternative for greater security, an embodiment of the present invention involves, for example, presenting different biometrics26, such as the user's face32, then fingerprint28, then iris34for comparison with system-stored templates in a particular sequence46.

An embodiment of the present invention also makes use of biometric authentication in combination, for example, with real or digital documents36, such as certificates, passports, digital signatures, and anything else in addition to what a user usually presents. By presenting these additional things, the probability of acceptance of the user10is increased, and each of these particular presentations may not be required to be as highly secure as it would normally be required. Assume, for example, that the user10presents his face32to the system14and says ‘I am this person.’ It is necessary to create a very high quality recognition system to understand that the picture is actually the person whose face32is presented to be able to compare it and to verify it properly.

Likewise, if the user10presents a fingerprint28to the system14and says, ‘I am this person,’ it is necessary to have a template of the user's fingerprint28created in the best environment available. In addition, the user's finger should be presented under the best possible conditions. For example, the presented finger should have no cuts, it should not be wet, and/or it should be at the proper temperature. If all of this occurs properly, then the system14may be able to accept the user's fingerprint28with the desired level of security. However, if the user10presents the user's fingerprint28, and a digital certificate40, and the user's face32, and perhaps something else in addition to the fingerprint28, and if they are presented in a proper sequence46, then it is not necessary for each of these parameters to be created in the best possible way, as would be necessary if only the user's fingerprint28were presented.

In an embodiment of the present invention, those parameters can be stored in a particular device. However, is it not necessary that they be stored in a particular device.FIG. 3is a schematic diagram which illustrates an example of key components and the flow of information of a system storing authentication parameters in a local system for an embodiment of the present invention. An aspect of an embodiment of the present invention makes use of a centralized system14as shown inFIG. 2, but the application for an embodiment of the present invention can equally well be stored in a local device48as shown inFIG. 3. In any event, the parameters, thresholds or scores, or the way the templates are organized, are in one way or another stored in a central system14or a local device48.

Another aspect of an embodiment of the present invention involves storing the parameters in the place where the particular verification actually occurs. In a system, for example, which verifies everything on a smart card, the user authenticates himself or herself to the smart card. However, in most cases, after the user authenticates himself or herself via the smart card, the user must still authenticate the smart card to something else.

Assume, for example, that the user needs to do authentication to a merchant or to a bank.FIG. 4is a schematic diagram which illustrates an example of key components and the flow of information between the key components of a bank's system storing authentication parameters for an embodiment of the present invention. If the user's bank50has all the parameter information stored in the bank's database54, the user10can present his or her face32, fingerprint28, and/or certificate, and all of this information can be authenticated through the bank50where the user10actually wants to authenticate himself or herself. Of course, a bank or a merchant can attempt to authenticate the user10in another place, with the user saying, in effect, ‘I have this information about me in another place,’ such as bank50. If the merchant believes this is true and/or, for example, has a relationship with the bank50, it can go through the authentication also.

For example, referring toFIG. 4, assume that the user10goes to a place, such as the merchant with a terminal12, and says to the merchant, ‘I want to buy something from you.’ The merchant says ‘Okay, can you prove that you are the person who you say you are? The user10responds, ‘I cannot prove it to you, but I can prove it to my bank.’ If the user10has a relationship with the bank50, and if the merchant also has a relationship with the bank50, then the user10and the merchant can go together to the bank50. The bank50acts as a sort of arbitrator which says, ‘Okay, you people are really the people who you say you are.’ That means that the merchant can go to the bank50and verify that this particular user10who wants to buy something from the merchant actually belongs to the bank50and is capable of paying. This merchant-user-single bank entity relationship is referred to as a three-corner model.

An aspect of an embodiment of the present invention also involves expanding the relationship from a merchant-user-single bank entity relationship to a network of trust, for example, where all of the participants in the authentication process belong to the same association or the same network of trust.FIG. 5is a schematic diagram which illustrates an example of key components and the flow of information between the key components of an authentication system with a four-corner network of trust for an embodiment of the present invention. Thus, the user10can have a relationship with the bank50which shares the same network of trust58with another bank56with which the merchant has a relationship. In other words, the user10and the merchant have relationships with different banks56,50, but the different banks share a trusted network58, and the same authentication process can be used.

For example, referring toFIG. 5, we have the user's bank50, the merchant's bank56, the user10, and the merchant, and the two banks56,50are different. With the network of trust58established between the two banks56,50, the same authentication process can be used even though the user10has a relationship with a different bank from the merchant. Further, the network of trust58can include any number of banks. If the user10related to one bank50wishes to authenticate to the merchant related to another bank56, in order to accomplish the four corner model, the user10goes to the merchant's terminal12and passes his or her credentials24through the merchant's terminal12in a predefined sequence46. If it is within a trusted area58, the merchant passes that sequence46to the merchant's bank56, and the merchant's bank56passes that sequence46to the user's bank50. The user's bank50identifies the user10, and the authentication is passed back to the merchant. In such case, the merchant's bank56acts as a sort of proxy in the authentication process.

Referring again toFIG. 4, an embodiment of the present invention makes use, for example, of a terminal12to which the user10presents his or her information24, such as biometrics26, at certain times in a certain sequence46. Assume that the user10comes to a merchant and wants to buy something, and that the merchant has a terminal12which the user10knows that he or she can trust. Obviously, it is very important that the user10will not provide his or her information24to a terminal that he or she should not trust. The user10sees that there is a terminal12that he or she can trust, and the user10can present his or her information24. It is important that this information24is not identified at the particular terminal12but is passed to something that the merchant and the user10both together trust, such as the bank50. The bank50makes the decision that this particular user10is exactly who he or she says and has enough money in his or her account that the merchant can accept the user's promise to pay.

One way of accomplishing this is simply by the user presenting his or her credit card in the presence of the merchant, as is presently done today. However, in an embodiment of the present invention, another way of accomplishing this is that if the user10is trying to buy something from the merchant but, for example, is sitting at home at a terminal12, such as the user's personal computer (PC), the user10needs to communicate to the merchant in a way in which he or she feels comfortable.FIG. 6is a schematic diagram which illustrates and example of key components and the flow of information between the key components of a three corner authentication system for an embodiment of the present invention with the user at a terminal such as the user's PC. The merchant60does not verify the user's fingerprint28but passes the fingerprint28to the bank50to which both the user10and the merchant60belong. The bank50verifies that the user10is who he or she says and confirms the particular transaction.

On the user's side, the user10is at his or her PC62at home and has, for example, a device64attached to the PC62, which can accept the user's fingerprint28. The user10applies, for example, one finger, and then applies another finger, and sends all this information24to the merchant60, and the merchant60passes this information24to the bank50. Based, for example, on the user's name and fingerprint or fingerprints28presented, the bank50verifies that the user10is who he or she says and also verifies the sequence46in which the user10presented his or her fingerprint or fingerprints28. This is the user's PIN44, which should be good enough for the bank50to make a decision that the user10is who he or she claims to be, safely and securely, and to authorize the transaction.

An aspect of an embodiment of the present invention involves storing the authentication information, such as a biometric template, that is normally stored at the host computer52at the bank50, for example, on a smart card.FIG. 7is a schematic diagram with illustrates an example of key components and the flow of information between the key components of an authentication system for an embodiment of the present invention with credentials, such as a biometric template, stored on a smart card. When the authentication information is stored on the smart card66, the user10can identify himself or herself to the particular smart card66. In some cases, that is a secure enough process, but in many cases identify himself or herself to that smart card66, that basically verifies that the particular user10is the person who is actually using the smart card66and is okay.

Codes are used to open the smart card66. For example, the user10presents his or her fingerprint28to the smart card66and presents a PIN44to the smart card66and opens the smart card66, and the smart card66has enough information to be secure. Assume that the user10has, for example, a digital signature or digital certificate40which was signed by someone else. The user10can use that particular digital signature40safely sitting on the user's smart card66to authenticate himself or herself, but basically the user's smart card66, to the host computer18. On the other hand, in an embodiment of the present invention, the user10can present his or her biometric information26with the user's PIN44to the host computer18as shown inFIG. 1, and the smart card66is not needed. Thus, it is not necessary for the user10to have the smart card66or anything else, but simply to present himself or herself, and it becomes unnecessary to authenticate the smart card66and then solve some other problem to prove that it was signed by the proper authority and that the authority is trusted and the like.

A smart card aspect of an embodiment of the present invention can make use of an application which enables adjustment of the threshold depending on the environment. Thus, if a more secure application is wanted, the threshold is moved in a direction to prevent false acceptances, and for a less secure application, the threshold can be relaxed up to the point that virtually any time the user10presents a biometric26, he or she is accepted. In an embodiment of the present invention, the threshold can be adjusted, additional information can be presented by the user10, and the threshold can be certified and re-locked to make the smart card66work in a more secure way even if the threshold is locked.

After the smart card66is authenticated, it is not a particular benefit to the user10to authenticate to the user's own smart card66, since the user10already knows to his or own satisfaction that it is the user's own smart card66. However, the point is that no one else can use the user's smart card66. After the user10authenticates himself or herself to the smart card66, then the user10needs to authenticate the smart card66to the host computer18. In an aspect of an embodiment of the present invention, the user10can go directly to the host computer18and authenticate himself or herself without the smart card66. However, the modality that the smart card66serves in an embodiment of the present invention is that security people of organizations, such as financial institutions, typically want two authenticating items rather than a single authenticating item.

On the other hand, in an embodiment of the present invention, the user10can present his or her biometrics26, which is who the user10is, and the user10can present his or her PIN44in the form of the sequence46of the biometric presentation, which is what only the user knows, so that there are those two authenticating items. If one takes the position that the security people would like to have something physical, while the user's fingerprint28is physical, it is not an element issued by the financial institution, such as a PIN44issued by the financial institution. Yet, it may be considered something physical, in that the financial institution knows the particular sequence46of biometrics presentation, which is a form of the PIN44.

The user authentication process for an embodiment of the present invention includes, for example, user enrollment, the establishment of a shared secret42, and identification and verification of the user10.FIG. 8is a flow chart which illustrates an example of the process of user authentication for an embodiment of the present invention. At S1, the user10enrolls by presenting the user's credentials24, such as one or more biometrics26to an authority, such as a host computer18. The user10and the authority work together to make sure that all of the user's credentials24, such as the user's biometrics26and/or real or digital documents36for the user10, are securely acceptable and verifiable by the authority18. These credentials24represent what the user is or has.

At S2, a shared secret42is established between the user10and the authority18, which consists, for example, of a predefined sequence46of presenting the previously enrolled user's biometrics26and/or other predefined credentials24, such as documentation36in the form of passports, certificates, or the like, in digital form40, paper form38, or other suitable form. The sequence46of presenting the credentials24represents what the user10and the authority18know. At S3, identification and verification of the user10involve, for example, the user10presenting the user's credentials24in the predefined secret sequence46and the authority18identifying and verifying the user10based on the combination of user presented credentials24and predefined shared secret sequence46. In an aspect of an embodiment of the present invention, user credentials24, such as fingerprints28, can be relaxed in the foregoing user authentication process, because of the pre-defined shared secret42. For example, the thresholds for acceptance of each fingerprint template can be lowered, and imposters will still be rejected, because imposters will not know the predefined shared secret42.

In an embodiment of the present invention, the verification parameters of user credentials24, such as threshold levels for matching of fingerprints28, the quality of scanners, or the tolerance to input biometrics26, such as the case of cuts on a user's finger, can be controlled by the authority, such as the host computer18, in the user authentication process, depending on the risk of the application run by the authority18and the strength of the predefined shared secret42. The strength of the secret42is controlled by the authority18and forces the user10to present the user's credentials24under the directions of the authority18. For a lower level of security, this can be by presenting one or more fingerprints28. For a higher level of security, it can be verification of fingerprints28, voice30, and iris34of the user10in the predefined sequence46. At the same time, the authority18can adjust the threshold levels for each biometric template to a lower or higher level to allow a desired level of control of the secure access.

In an aspect of the user authentication process for an embodiment of the present invention, the authority, such as host computer18is a financial organization, such as a bank50, and the user's digital credentials40or copies of the user's actual documents36are stored in a database54of the bank50. The shared secret42is known as the user's PIN44and is stored in the same database54. The user10can present the user's credential to the bank50in the predefined shared secret sequence46and receive, for example, all bank services. The system for an embodiment of the present invention is designed in such a way that the representatives of the authority18do not know the shared secrets42of the user10, although it is stored in the authority's database54. For example, the shared secret42can be stored encrypted and digitally signed.

In another aspect of user authentication for an embodiment of the present invention, the user10has one or more shared sequences46with the authority18so that a silent alarm can be activated if the user10is in danger. In a further aspect of user authentication for an embodiment of the present invention, the user10has one or more shared sequences46with the authority18, so that the authority18can request which sequence46to use to prevent a replay attack. In an additional aspect of user authentication for an embodiment of the present invention, the authority18can randomly request the user10to present additional credentials out of previously enrolled credentials24to prevent a replay attack.

In yet a further aspect of user authentication for an embodiment of the present invention, the authority18takes the form of a user token, such as a smart card66. The user credentials24, such as fingerprints28, are stored in the user's smart card66. The shared secret42is also stored on the smart card66. The user10can present his credentials24to the smart card66in the predefined shared secret sequence46and open the smart card66for its normal usage. In this aspect, the user's credentials24, such as biometric templates, digital certificates, and the like, verification parameters, and shared secrets42can be signed with the user's private key and stored locally for fraud prevention, such as smart card tampering.

In still another aspect of user authentication for an embodiment of the present invention, the authority18is in the form of a local device48, such as a front gate controller, garage opener, telephone or television activator, or the like. The local device48has its own secure local database or may use a remote database for additional security. The user credentials24, such as fingerprints28, are stored in the database of the local device48, together with the shared secret42. The user10can present the credentials24to the local device48in the predefined shared secret sequence46and open or activate the local device48for its normal usage.