An improved technique for voice-based security systems

Abstract: A voice-based security system requires that a series of utterances to be uttered by the requester contain at least one repeated utterance. The system compares a representation of each instance of the repeated utterance as uttered by the requester to both a prestored template for the utterance and to each representation of the other instances of the utterance as uttered by said requester. The requester is authenticated only if each representation of the repeated utterance as uttered by said requester matches the prestored template and the representations of the repeated utterance as uttered by said requester do not match each other to such a high degree that they are deemed to have been mechanically generated.

Description: Technical Field This invention relates to voice-based security systems. Background of the Invention The identity of a requester seeking access to a secured destination often needs to be authenticated. Among the known techniques for authenticating the identity of a requester are techniques that take advantage of the uniqueness of each person's voice. A problem with such techniques is that utterances made by an authorized person can be mechanically recorded and later played back by an attacker who thereby gains fraudulent access to the secured destination. A method as set out in the preamble of claim 1 is disclosed by Michael H. Kuhn and others in VDI-Zeitschrift, vol. 122, no. 4, February 1980, pages 125- 130. The problem of use of mechanical recording apparatus is recognised and it is proposed to generate a pseudo-random sequence of utterances and to require a response within a very short period, not allowing time for tapes to be changed or rewound or even for several play-back devices to be used. Summary of the Invention The above-described difficulties with prior voice-based security systems are overcome, in accordance with the principles of the invention, by requiring that the series of utterances to be uttered by the requester contain at least one repeated utterance and comparing a representation of each instance of the repeated utterance as uttered by the requester not only to a prestored template as in the prior art, but also to each representation of the other instances of the utterance as uttered The requester is authenticated only if a) each representation of the repeated utterance matches the prestored template to within a predetermined tolerance while b) the representations of the repeated utterance do not match each other to such a high degree that they are deemed to have been mechanically generated. Brief Description of the Drawing In the drawing: FIG. 1 is a flow chart of an exemplary method for use in voice-based security systems in accordance with the principles of the invention; FIG. 2 shows, in simplified block diagram from, an exemplary voice-based security system for executing the method shown in FIG. 1; and Shown in FIG. 3 is a representative sample space for an utterance for use with the method shown in FIG. 1. Detailed Description Shown in FIG. 1, in flow chart form, is an exemplary method for use in voice-based security systems in accordance with the principles of the invention. The method is entered via step 101 when a security system receives a request for access to a particular destination by a requester who alleges the identity of a user authorized to have access to the particular destination. In step 105 a variable, RETRY_COUNT is set to zero (0). RETRY_COUNT is a count of the number of times the requester has attempted in one access request to achieve access. In step 109, in accordance with the principles of the invention, an utterance series including at least one repeated utterance element is generated. For purposes of clarity of exposition it is assumed herein that only one utterance element is repeated. Extension to applications where more than one utterance element is repeated will be obvious to one skilled in the art. In step 113 the requester is prompted to utter the utterance series that was generated in step 109. The utterance series as uttered by the requester in response to the prompting of step 113 is received by the security system in step 117. branch received utterance of the utterance series, as uttered by the requester, is compared in step 121 to determine if it matches a prestored template for that utterance as uttered by the authorized user whose identity was alleged. Thereafter, conditional branch point 125 tests to determine if all the utterances of the utterance series, as uttered by the requester, match the prestored templates for those utterances. If the test result in step 125 is NO, control is passed to conditional branch point 129, which tests to determine if the value of RETRY_COUNT equals RETRY_LIMIT. RETRY_LIMIT is an implementation-dependent constant which controls the number of times a requester may attempt to achieve access in one access request. An exemplary value of RETRY_LIMIT is 2. If the test result in step 129 is NO, control is passed to step 133, in which the value of RETRY_COUNT is incremented. Control is then passed back to step 109. If the test result in step 129 is YES, control is passed to step 137 which causes access to be denied. This may be achieved by playing a message to the requester indicating that access has been denied and disconnecting the requester from the security system. Thereafter, in step 141 the method is exited. If the test result in step 125 is YES, control is passed to step 145 in which each instance of the repeated utterance as uttered by the requester is compared to each other. In accordance with the principles of the invention, conditional branch point 149 tests to determine if the instances of the repeated utterance as uttered by the requester are identical to each other. If the instances of the repeated utterance are identical, or nearly so, to within a predetermined threshold, this indicates that the utterances were probably reproduced from a recording. Therefore, in accordance with the principles of the invention, if the test result in step 149 is YES control is passed to step 137 which causes access to be denied. Thereafter, in step 141 the method is exited. If the instances of the repeated utterance are not identical, or not nearly so, to within a predetermined threshold, this indicates that the utterances were probably not reproduced from a recording but were instead actually uttered by a human being, most likely the authorized user whose identity was alleged. Therefore, in accordance with the principles of the invention, if the test result in step 149 is NO control is passed to step 153 which causes access to be granted. Thereafter, in step 141 the method is exited. Many variations of the basic method will be readily apparent to those skilled in the art. Some of the variations include: if no utterance series or an incomplete one is received in step 117, control may be optionally passed to step 129. Also, control may optionally be passed from step 133 back to step 113 rather than step 109. Step 109 may be performed prior to the access request and the generated utterance series made known to the requester in the form of a password. Therefore, at the time of the request, the requester is merely prompted to utter the series which he already knows and control may be passed directly from step 105 to step 113. Furthermore, if the requester knows the series of utterances prior to making a request, he could utter the series at a predetermined point in the request process, e.g., immediately after alleging his identity. It would thus not be required to prompt the requester to utter the utterance series and control may pass from step 105 directly to step 117. The utterances as uttered by the requester could be processed so as to remove noise, both those in the environment of the requester as well as system caused noise, prior to comparing them to the prestored templates or to each other in steps 121 or 145. Also, at least one representation of the received repeated utterance as uttered by the requester could be distorted in accordance with distortion techniques (or their inverses thereof) that would still allow the distorted utterance to match the prestored template of the utterance. The resulting distorted representations of the one utterance would also be compared in step 145 to the representation of the other instance of the repeated utterance as uttered by the requester. If any of the distorted representations were found to identically match the other instance of the repeated utterance as uttered by the requester the test result in step 149 would be YES and access would be denied. FIG. 2 shows, in simplified block diagram form, exemplary voice-based security system (security system) 200 for executing the method shown in FIG. 1. In the manner shown, controller 204 is connected via bidirectional links 208 to analog to digital converter unit (A/D) 212, utterance comparison unit 216, utterance template store 220, utterance series generator 224 and text to speech unit 228. Bidirectional links 208 need not be identical and may be, at the implementor's discretion, any commonly used communications links such as: serial links, parallel links, shared memory, a common bus or software defined interface. A/D 212, utterance comparison unit 216, utterance template store 220, utterance series generator 224 and text to speech unit 228 are also interconnected in the manner shown by bidirectional links 232. Bidirectional links 232 also need not be identical and may be any commonly used communication links A/D 212, utterance comparison unit 216, utterance template store 220, utterance series generator 224 and text to speech unit 228 may be implemented as any combination of hardware or software. The factors necessary for determining the implementation details will be readily apparent to one skilled in the art. Controller 204 controls the overall operation, including timing and sequencing, of security system 200. When controller 204 determines that a request for access to a particular destination by a requester who alleges the identity of a user authorized to have access to the particular destination the method shown in FIG. 1 is begun. In the embodiment shown, controller 204 makes this determination by monitoring communications line 236. Also, communications line 236 is a telephone line and controller 204 includes multi- frequency tone detectors and a memory containing a list of authorized users. Utterance series generator 224 generates the utterance series of step 109 (FIG. 1) which includes a repeated utterance element. The individual utterance elements of the generated utterance series are drawn from those utterance elements having templates stored in utterance template store 220 for the identity alleged by the requester. The generated utterance series is supplied from utterance series generator 224 to text to speech unit 228 for use in prompting the user in step 113 (FIG. 1). The generated utterances series is also supplied to utterance comparison unit 216 for use in comparing the utterances received from the requester with the prestored templates for those utterances and with each other, as called for in steps 121 and 145 in accordance with the principles of the invention. A/D 212 receives utterances as analog voice via communication lines 236 and converts them into a digital representation. The digital representations of the utterances can be supplied via bidirectional links 232 to either utterance comparison unit 216 of utterance template store 220. When the method shown in FIG. 1 is executed the digital representations are supplied to utterance comparison unit 216 as part of step 117. The digital representations are supplied to utterance template store 220 when the utterance templates for later use are initially stored by each authorized user. The ultimate decision of whether or not access is to be granted, including the decisions in conditional branch points 125 and 149 is made by controller 204, based on the results of the comparisons performed by utterance comparison unit 216. If access is to be denied, because step 137 has been reached, controller 204 may cause the text of a denial message to be supplied to text to speech unit 228. This message is then converted to speech and spoken to the requester via communication line 236. At the conclusion of the speaking of the denial message controller 204 causes communication line 236 to hang up. If access is to be granted, because step 153 has been reached, controller 204 sends a message via access control link 240 to cause the requester to be granted access to the destination. Shown in FIG. 3 is representative sample space 301 of an utterance having a prestored template for use with the method shown in FIG. 1. Sample space 301 is defined by axes P1 and P2 which correspond to predetermined parameters of a particular speaker verification system. The selection of such parameters would be readily apparent to one skilled in the art. Threshold 303, as defined by a constant radius T1, represents the outer boundary of match space 305 of sample space 301 in which a match for the utterance may fall. Any representation of the utterance falling within match space 305 is considered a match for the utterance. Any representation of the utterance falling outside match space 305 is considered not the match the utterance. Other well known methods for defining threshold 303, and thereby specifying the boundaries of match space 305, may be used. Sample point 309 is a representation in sample space 301 of a representation of a first instance of the utterance as uttered by a requester when the utterance is a repeated utterance of an utterance series. Similarly, sample point 313 is a representation in sample space 301 of a representation of a second instance of the utterance as uttered by a requester when the utterance is a repeated utterance of an utterance series. Both sample points 309 and 313 fall within match space 305 and are therefore considered a match for the utterance. Around sample points 309 and 313 are thresholds 317 and 321, respectively, defined by radius T2. Thresholds 317 and 321 define "identical spaces" 325 and 329. Any sample points that fall within the "identical space" of a sample point are considered to be identical for purposes of the comparison in step 149 (FIG. 1). This is because the samples match each other to such a high degree that they are deemed to have been mechanically generated. Thus, sample point 333 is considered identical to sample point 309 and sample point 337 is considered identical to sample point 313. If the two sample points of the repeated utterance were sample points 309 and 313, as originally mentioned, then the test result in step 125 (FIG. 1) would be YES and the test result in step 149 would be NO. Access would therefore be granted in step 153. If the two sample points of the repeated utterance were sample points 309 and 333 then the test result in step 125 (FIG. 1) would be YES but the test result in step 149 would also be YES. Therefore, access would be denied in step 137. Likewise, if the two sample points of the repeated utterance were sample points 313 and 337, the test result in step 125 (FIG. 1) would be YES and the test result in step 149 would also be YES. Access would also be denied in step 137. Finally, if sample point 341 was the sample point for one of the repeated utterances, the test result in step 125 would be NO and control passed to step 129 (FIG. 1), regardless of which of the other sample points corresponded to the second sample point. If the RETRY_COUNT equaled the RETRY_LIMIT in step 129, access would be denied in step 137. The selection of T1 and T2 is implementation dependent. The selection depends upon the tolerance required by the implementor. However, it is necessary that T1 << T2, in the manner shown. It will be readily apparent to one skilled in the art that the sample space employed need not be limited to two parameters and that any arbitrarily region can be selected to define both match space 305 and "identical spaces" 325 and 329.

Claims: A method for use in a voice-based security system which controls the granting or denial of access to a secured destination. the method comprising: receiving representations of utterances as uttered by a requester for access to said destination: comparing a received representation of at least one particular utterance to at least one previously stored template for said at least one particular utterance as uttered by the individual whose identity was alleged; and making a determination of whether to grant access or deny access; CHARACTERISED IN THAT said received representations include at least two representations of said at least one utterance; said comparing step includes comparing each of said at least two representations to said at least one stored template; said method includes comparing said at least two representations to each other; and said determination is based on the results of both of said comparing steps. The method as defined in claim 1 CHARACTERIZED IN THAT said determination is to grant access if each of said at least two representations of said at least one particular utterance as uttered by said requester matches said at least one previously stored template for said at least one particular utterance as uttered by the individual whose identity was alleged and if any of said representations of said at least one particular utterance as uttered by said requester does not identically match any of the other representations of said at least one particular utterance as uttered by said requester. The method as defined in claim 1 CHARACTERIZED IN THAT said determination is to grant access if each of said at least two representations of said at least one particular utterance as uttered by said requester matches said at least one previously stored template for said at least one particular utterance as uttered by the individual whose identity was alleged to within a first predetermined threshold and if none of said representations of said at least one particular utterance as uttered by said requester matches any other representations of said at least one particular utterance as uttered by said requester to within a second predetermined threshold. The method as defined in claim 3 further CHARACTERIZED IN THAT said first predetermined threshold is greater than said second predetermined threshold. The method as defined in claim 1 wherein said determination is to deny access if each of said at least two representations of said at least one particular utterance as uttered by said requester does not match said at least one previously stored template as uttered by the individual whose identity was alleged for said at least one particular utterance. The method as defined in claim 1 wherein said determination is to deny access if any of said representations of said at least one particular utterance as uttered by said requester identically matches any of the other representations of said at least one particular utterance as uttered by said requester. The method as defined in claim 1 wherein said determination is to deny access if any of said representations of said at least one particular utterance as uttered by said requester matches any other representations of said at least one particular utterance as uttered by said requester to within a predetermined threshold. The method as defined in claim 1 wherein said determination is to deny access if any of said representations of said utterances as uttered by said requester does not match a corresponding previously stored template for said utterance as uttered by the individual whose identity was alleged. The method as defined in claim 1 further CHARACTERIZED BY the steps of: creating distorted versions of at least one of said at least one particular utterance as uttered by said requester by distorting said representations of said at least one particular utterance as uttered by said requester; and comparing said distorted versions of at least one of said at least one particular utterance as uttered by said requester to each of the other representations of said at least one particular utterance as uttered by said requester. The method as defined in claim 9 CHARACTERIZED IN THAT said determination is to deny access if any of said distorted versions of at least one of said at least of particular utterance as uttered by said requester identically matches any of the other representations of said at least one particular utterance as uttered by said requester. Apparatus (200) for use in a voice-based security system which controls the granting or denial of access to a secured destination, the apparatus comprising: means (212) for receiving representations of utterances as uttered by a requester in response to prompting; means (216) for comparing a received representation of at least one particular utterance to at least one previously stored template (220) for said at least one particular utterance as uttered by the individual whose identity was alleged; and means (204) for making a determination of whether to grant access or to deny access; CHARACTERIZED IN THAT said received representations include at least two representations of said at least one particular utterance; said means for comparing is arranged to compare each of said at least two representations to said at least one stored template; said apparatus includes means (216) for comparing each of said at least two representations of said at least one particular utterance to each other; and said means for making a determination is responsive to all of said means for comparing. The apparatus as defined in claim 11 further including means for prompting [204, 228] a requester for access to said destination to repeat a predetermined series of utterances, said series including at least two instances of at least one particular utterance. The apparatus as defined in claim 12 further including means for generating said series of utterances [224]. The apparatus as defined in claim 11 further including: means for creating distorted versions [212] of at least one of said at least one particular utterance as uttered by said requester by distorting said representations of said at least one particular utterance as uttered by said requester; and means for comparing [216] said distorted versions of at least one of said at least one particular utterance as uttered by said requester to each of the other representations of said at least one particular utterance as uttered by said requester. The apparatus as defined in claim 11 further including means for stimulating [204, 240] said destination to grant access by said requester to said destination if said determination is to grant access. A method for use in a voice-based security system which controls the granting or denial of access to a secured destination, the method comprising the steps of: prompting a requester for access to said destination to repeat a predetermined series of utterances; receiving representations of said utterances as uttered by said requester in response to said prompting; CHARACTERIZED IN THAT said series includes at least two instances of at least one particular utterance; said representations include at least two representations of said at least one particular utterance; and access is denied to said requester if said at least two representations of said repeated utterance as uttered by said requester are so identical to one another that they could not have been uttered by a human being.

Inventors: MCNAIR BRUCE E, MCNAIR, BRUCE E.
Applicants: AT & T CORP, AT&T CORP.
Application year: 1992
Main classification: G07C9
IPC codes: G10L17, G10L15, G07C9