Abstract:
A device for use by an authorized person having an unique biometric parameter to obtain information for use in accessing a secured site. The device comprises a biometric interface unit engaged with a portable body member. The device further comprises biometric circuitry adapted to generate and store an initialized biometric template upon presentment of the person&#39;s unique biometric parameter to the biometric interface unit. The biometric circuitry is further adapted to generate a second biometric template upon subsequent presentment of the person&#39;s unique biometric parameter to the biometric interface unit. The device further comprises compare circuitry adapted to generate an first signal indicative that the second biometric template is substantially identical to the initialized biometric template. The device further comprises a storage device for storing a plurality of passwords. The device further comprises password circuitry adapted to generate a password in response to the first signal from the compare circuitry. The password circuitry being adapted to store the password in the storage device. The device further comprises water marking circuitry adapted to generate and embed a watermark within the password. The water marking circuitry may further comprise a plurality of memory registers and a data base having a plurality of public domain watermarks randomly assigned to each memory register. The device further comprises pager circuitry adapted to receive a signal from the secure site indicative that access has been attempted using said password and to generate an audible tone.

Description:
This Application claims priority to and is a continuation-in-part of application Ser. No. 09/356,940 filed on Jul. 19, 1999. 
    
    
     BACKGROUND OF THE INVENTION 
     The present invention relates to apparatus for and methods of verifying both the physical identity of an individual and that individual&#39;s authority to gain access to a secured site. More particularly, the invention relates to methods of verifying user identity and authority to access an otherwise inaccessible physical space, body of data, etc., and to a hand held device useful in the implementation of such methods. The methods and apparatus of the invention are of the type including input and recognition of a biometric parameter of the user. 
     For purposes of the present discussion and disclosure of the invention, the term “secure(d) site” is used to refer to both physical areas, spaces and devices, as well as electronic domains, databases, and the like, to which access is restricted to certain authorized users. Access to a secured site may be provided either entirely electronically, as to a data bank, or by a combination of electronic and mechanical means, as by releasing a lock in response to authenticated electrical signals. The term “biometric parameter/characteristic/feature” is used to denote one or more physical attributes uniquely associated with a particular individual, such as a finger, thumb or hand print, a retinal or facial scan, a DNA sample, and the like. The term “biometric template” refers to a body of stored or storable electronic signals which uniquely correspond to a biometric parameter. The acronym “PIN” (Personal Identification Number) is defined as a sequence of characters (numbers, letters, symbols, etc.) each of which is, or may be, represented by a corresponding electrical signal, electrically or magnetically recorded code, or the like, and is used synonymously with “password.” The art and science of authentication and identification of human individuals is embodied in the simple concept of uniqueness. Uniqueness is defined, within acceptable risk parameters, as one or a combination of only three possible things, namely, (in the order of their traditional ranking from weakest to strongest): 1. something known only (uniquely) by the individual and which is verifiable by the secure host (e.g., mother&#39;s maiden name, a PIN, etc.) 2. something physically possessed only (uniquely) by the individual and verifiable by the secure host (e.g., a token, smart card or synchronous algorithm result), and 3. some (unique) biometric parameter of the individual verifiable by the host. When one or more of these indicia of uniqueness is/are presented to and verified by the host, the individual is deemed to be authenticated as to identity and access to the secure site is permitted. In order for an individual to present biometric and token based indicia of uniqueness to a host by conventional means, special provisions must be made at each host, often requiring apparatus at the user site interconnected to the host. For example, under traditional biometric and token based systems, a biometric template and/or token is passed to the host for authentication via a client-side reader compatible with the particular security/authentication hardware and software employed. The indicia of uniqueness must be received by the host and compared against a known and correlated collection of stored data. Accordingly, a privacy issue is raised as the individual user is required to relinquish otherwise private biometric data, in template form, to the host. Understandably, this results in a reluctance to accept and utilize such systems and is responsible, in large part, for the fact that such systems are not in widespread use today. Although a biometric scan is often used as the sole presentation of uniqueness to gain access to a secure workplace, and therefore “voluntary” only to the extent of accepting or declining the work, the combination of possessive (coded card) and cognitive (short PIN) indicia of uniqueness remains the ubiquitous form of authentication. 
     OBJECTS OF THE INVENTION 
     In general terms, the object of the present invention is to provide an authentication system based on indicia of uniqueness which includes biometric parameters without relinquishing personal possession and privacy of such parameters, i.e., a system wherein the host does not store or recognize biometric templates and plays no role in the authentication of the user. 
     More specifically, it is an object of the invention to provide an authentication system (apparatus and method) for gaining access to secure site(s) which requires no reader or other such input device at the user side interconnected to the host which protects access to the secured site. 
     Another object is to provide access authentication apparatus in the form of a hand-held device for storing a biometric parameter of an individual and operable to provide a PIN only in response to presentation of that parameter by the individual to input means on the device. 
     A further object is to provide novel and improved apparatus and methods of verifying the identity of an individual and authenticating that individual&#39;s authority to access a secure site utilizing biometric activation techniques and purely random PIN generation, time stamp management and encrypted storage, through a pocket-size device which never leaves the individual&#39;s possession. 
     Still another object is to provide a highly secure, totally private, commercially viable system of authenticating identity of an individual user and verifying that the individual is among those having authorized access to one or more secure sites. 
     A still further object is to provide apparatus for gaining access to a secured site wherein the apparatus is actuable only in response to confirmed biometric identification of the user without requiring storage of or otherwise permitting access to any biometric parameter or template other than by the user. 
     Other objects will in part be obvious and will in part appear hereinafter. 
     SUMMARY OF THE INVENTION 
     In accordance with and furtherance of the foregoing objects, the invention contemplates a form of security apparatus in the nature of a hand-held, pocket sized device comprising a unitary body portion having thereon a window for an LCD display, a small keypad and a biometric input pad. Within the body portion are a microprocessor with a plurality of on-chip peripheral devices including means for generating and storing a bionic template in response to biometric information presented to the input pad, a random number generator, ROM program storage, SRAM data storage and EEPROM memory. The device may optionally include a conventional output port. The keypad of the illustrated embodiment consists of four scroll keys (up, down, left, right) and an “enter” key. The device is initially set up, prior to the first use, by pressing the enter key, placing the ball of a selected finger (hereinafter assumed to be and denoted as a thumb print) on the biometric input pad until “Accepted” appears on the LCD display, indicating that the bionic template has been generated and stored within the device. The device may then be deactivated either by pressing the enter key or by non-use for a predetermined time period. In order either to generate and store new PINs or to recall previously stored PINs for use with secure sites, the device must first be activated by the authorized user placing his/her thumb on the biometric input pad and pressing the enter key, whereupon the device will be activated if the presented thumb print template matches the previously stored template. To generate a new PIN, after activating the device the user presses the scroll-down key until “New Password” appears on the LCD display and then presses the enter key. The scroll keys are then used to compose an alphanumeric name, one character at a time, for the system to which the password is to apply. When the name assigned to the system appears in the LCD display, the enter key is again pressed. A template for the PIN (length, a/n positioning, security level) is displayed and the user enters the desired parameters and again presses the enter key, in response to which a random number is generated within the device and displayed in the LCD window. It is contemplated that the PIN will be relatively long, e.g., 20 characters, and is not intended to be memorized by the user. After going online to the logon screen of the system to be accessed via a PC in communications with the system, the user follows the system&#39;s instructions for initial PIN entry and enters the PIN shown in the LCD display via the PC keyboard. Alternatively, the PIN may be downloaded from memory within the device, through an output port on the device to PC memory or directly to the secure site via a PC in communication therewith. After entry of a PIN, the device is deactivated by pressing the enter key or by a period of non-use. 
     To access a system to which a name and PIN have been assigned, the user again activates the device by placing the thumb on the input pad and pressing the enter key. The scroll-down key is pressed until the name of the system to be accessed appears in the LCD display. The enter key is pressed, causing the previously assigned PIN to appear in the LCD display. The user enters the pin via the keyboard of the PC which is in communication with the system, whereupon the entered PIN is compared with the stored PIN and the user is granted access to the system. The device is capable of generating random PINs and storing them under a selected name for several (e.g., 20) systems to which the user is authorized to have access. The PIN may be changed, i.e., a new PIN assigned to any system, whenever the user wishes by logging onto the system and going through the “Change Password” protocol. This procedure may also be followed for changing from a previously assigned PIN in a particular system to a PIN randomly generated by the device of the invention. In any case, before generating a new PIN or recalling a previously assigned PIN it is necessary to activate the device by means of the user&#39;s thumb print, thus preventing activation of the device to enter or recall PINs by anyone other than the user whose biometric template is stored in the device memory. Moreover, the user&#39;s biometric data does not leave his/her possession, the single biometric template being stored in the device only for purposes of comparison with thumb prints presented to the biometric input pad subsequent to initialization. Accordingly, the device is useless to anyone other than the authorized user and no biometric information is even potentially accessible to others. The foregoing and other features of construction and operation of the device, and the steps involved in practicing the method of the invention, will be more clearly understood and fully appreciated from the following detailed description, taken in conjunction with the accompanying drawings. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is an illustration of a hand-held device representing an embodiment of the apparatus of the present invention; 
     FIG. 2 is a block diagram illustrating the electronic components of the device of FIG.  1  and an independent PC; 
     FIGS. 3 through 6 are partly pictorial flow charts illustrating the sequence of events in initializing, managing and utilizing the device of the invention in conjunction with a secure site; 
     FIG. 7 is a flow chart illustrating two alternate modes of operation of the device; and 
     FIGS. 8 and 9 are high level flow charts showing the operation of embedding a watermark within a password. 
    
    
     DESCRIPTION OF THE INVENTION 
     The device of the invention, a physical example of which is shown in FIG. 1, is denoted generally by reference numeral  10 . Device  10  includes body portion  12  which contains chips, microcircuits and other electronic modules for carrying out the various functions described later herein. Also on body  12  are window  14  through which an LCD display is visible, keypad  16  and biometric input pad  18 . Ordinary keys  20  are shown, attached to body  12  by chain  22  passing through slot  24  at one end of the body; the keys have nothing to do with the present invention, but are shown to provide an indication of the intended scale of device  10 , namely, that of a pocket-sized, hand-held item. In the illustrated embodiment keypad  16  includes a total of five keys, namely, up and down scroll keys  16 U and  16 D, respectively, left and right scroll keys  16 L and  16 R, respectively, and “enter” key  16 E. A block diagram of the electronic components of device  10  is seen in FIG.  2 . Block  22  represents the conventional electronics which present signals generated by pressing the various keys of keypad  16  to microprocessor  24 . Block  26  represents electronics, also of a commercially available type, which generate signals commensurate with a template of the bionic characteristic (thumb print) presented to input pad  18 . The electronics which interface signals from processor  24  with the LCD display on device  10  are represented by block  28 , and a conventional output port  30  may optionally be provided on body  12  for transmission of data through line  31  to separate computer (PC)  33  or through line  35  directly to secure site  37  in situations where the user is physically proximate to the secure site or to input means therefor having an input port compatible with output port  30 . Rather than (or in addition to) providing an output port on device  10 , the user may view the characters of display output  28  and manually enter them on keyboard  39  of PC  33  (or secure site  37 ). The remaining blocks in FIG. 2 represent other conventional components, any or all of which may be on-chip peripheral devices, including random number generator  32 , real-time clock  34 , ROM program storage  36 , SRAM data storage  38  and nonvolatile flash/EEPROM memory  40 , all of which interface with, or are a part of processor  24 . 
     Turning now to FIGS. 3-7, the sequence of events in various stages of use of device  10  are illustrated. Preferably, device  10  is issued to a user by a manufacturer or other source with a unique code, tantamount to a serial number, as well as a number of “prompts” stored in selected memory locations. It is also preferred that the device be delivered to the user with a tamper proof seal in place over the biometric input pad and/or keypad. After removal of the seal, device  10  is initialized, i.e., set up prior to first use, by pressing enter key  16 E and placing the user&#39;s thumb on input pad  18 . Biosensor  26  generates a bionic template in the form of signals unique to the thumb print and transmits this template to processor  24  where it is stored in SRAM storage  38 . Upon completion of this function, processor  24  connects a location in ROM storage  36  with LCD display output  28  causing the prestored prompt “Accepted” to appear in window  14 . This indicates to the user that the biometric template commensurate with the user&#39;s thumb print has been generated and stored. Device  10  may then be deactivated by pressing enter key  16 E or after passage of a predetermined period of nonuse. 
     Device  10  may be used to generate and store one or (preferably) more (e.g., 20) PINs, each associated with a separate secure site (system) to which the user wishes to have selective, authorized access. The previously initialized device  10  is activated by placing the thumb on input pad  18  and simultaneously pressing enter key  16 E. Scroll up key  16 U is then pressed to bring up successive prompts on the LCD. For example, a single press of the scroll up key may cause the prompt “New Password?” to appear on the display, as indicated at  42 , following which the user again presses enter key  16 E. The right/left scroll keys may then be used to bring up the first character of the name given by the user to the system for which a PIN is to be generated. For example, if the PIN is to be used for gaining access to a brokerage account, the user may assign the name BROKER 1  and proceed to bring up each character in succession, pressing the enter key after each character is brought into the display and double-clicking (pressing twice in rapid succession) the enter key upon appearance of the complete assigned name, indicated by block  44 , in display  28 . This signal, in addition to storing the assigned name in memory  40 , causes random number generator  32  to generate a random PIN, preferably a relatively long (e.g.,20 character alphanumeric password) which replaces the system name in the display. The operator, before, during or after the foregoing PIN generation sequence, places PC  33  in communication with the host computer of secure site  37 . That is, the user, via a PC wholly independent of device  10 , goes online to the logon screen of the system to be accessed. Following the system&#39;s instructions for first-time entry of a PIN, the PIN appearing in the LCD display, indicated in FIG. 4 by reference numeral  46 , is communicated to the host computer of secure site  37 . The communication may be line  31  from output port  30  of device  10  to PC  33  and then to the computer of secure site  37  or, when appropriate, directly via line  35  to the host computer. Alternatively, the user may manually enter via keyboard  39  the PIN displayed on the LCD and communicate the PIN from PC  33  to the computer of secure site  37 . After communication and storage of the PIN in the host computer, device  10  may be deactivated by pressing enter key  16 E or by expiration of a preset time period with the PIN stored both in device  10  and in the computer at the secure site. 
     In order to access the secure site named BROKER 1 , the sequence of steps illustrated in FIG. 5 is followed. The user activates device  10  by placing the thumb on pad  18  and pressing enter key  16 E. Scroll down key  16 D is then pressed until the previously stored name BROKER 1  appears in the LCD. Enter key  16 E is again pressed and the PIN of display  46  replaces the system name of display  44 . The user logs onto the secure site computer and enters PIN  46  via the PC keyboard  39  or through output port  30 , as previously described. PIN  46  is compared with the user&#39;s previously stored PIN in the secure site computer and, upon confirming a match, access is granted. Device  10  is then deactivated as before. 
     FIG. 6 illustrates the steps in managing or updating PINs, i.e., in changing a previously assigned PIN to a new PIN for use with device  10 . Again, device  10  must be activated by placing the authorized user&#39;s thumb on pad  18  and pressing enter key  16 E. The scroll up key is then pressed to bring up prompts on the display. If the prompt “New Password?” appears after the first press of key  16 U, as previously described, the prompt “Change Password?” may be programmed to appear after the second press. With prompt  42 ′ displayed, the user presses enter key  16 E and then presses scroll down key  16 D to bring up successive secure site (system) names in the display. When the name of the system for which the password is to be changed, e.g., BROKER 1 , appears as display  44 ′ the user again presses enter key  16 E. Random number generator  32  then creates a new PIN which will appear in display  46 ′. The user logs on, via PC  33  and its associated keyboard  39 , to the system computer and follows its instructions for entering a changed password. The newly generated PIN (changed password) will then be stored in both device  10  and the system computer for future comparison and access authentication. Device  10  is deactivated as before. 
     FIG. 7, although somewhat repetitive, is useful in assimilating the manner of operation of device  10  in either generating new PINs or utilizing/changing previously generated and stored PINs. Some further, optional features of operation are also indicated in FIG.  7 . The key, of course, is initializing the device by storing within its memory a template commensurate with the user&#39;s thumb print, and requiring the same thumb to be placed on biometric input pad  18  for matching with the stored template for any subsequent activation of the device. When device  10  is to be used to assign a PIN for the first time to a particular secure site, following the lower branch of FIG. 7, the operator presses scroll up key  16 U once to bring up the prompt “New Password?” and presses enter key  16 E, thereby bringing up a blank, blinking display in window  14 . The scroll keys are then used to bring into the display successive characters in the name assigned to the system for which a PIN is to be generated, and the enter key is used to fix each selected character in the display. When the full name of the system has been entered, the enter key is double clicked. According to the preceding description, this directly resulted in generation of a random PIN which then appeared in the display. As indicated by block  50 , the display may first contain a template for establishing parameters of the PIN prior to its actual generation and storage. For example, the user may make certain entries indicating the length, alphanumeric positioning, security level, and/or other such parameters which will be taken into account by random number generator  32 . Use of a generator based on a Johnson Noise Amplifier is preferred in order to create truly random, rather than pseudo-random PINs. 
     The upper portion of FIG. 7 sets forth the steps involved in recalling, displaying and changing previously stored PINs. After activation, scroll down key  16 D is pressed to display the names of systems to which PINs have been assigned. When the name of the desired system is displayed, the enter key is pressed. If desired, the electronics of device  10  may include automatic monitoring of one or more PINs. For example, as indicated by block  52 , if the PIN previously assigned to the system whose name appears in the display has expired, e.g., by passage of a predetermined time period after initial generation or after having been recalled a predetermined number of times, the display may flash the “Change Password?” prompt, in response to which the user may press either key  16 R for “yes” or  16 L for “no.” Even when the initially assigned PIN has not expired (or if there is no PIN expiration capability), the user may scroll up to the “Change Password?” prompt and press the enter key to generate a different PIN for the system named in the original display. Whether using the previously assigned or a newly generated (changed) PIN, the multi-character PIN will appear in the display and be manually entered by the user via keyboard  39 , the keyboard/pad of the secure site, where such is available, or the line from output port  30 . 
     Referring to FIGS. 8 and 9, wherein high level flow charts show the process of embedding a water mark with a password or PIN generated by the device  10 . The device  10  may comprise water marking circuitry  100  (FIG. 2) connected along a path  102  to the CPU  24 . Each PIN may also contain a so-called watermark or stenographic key which uniquely identifies the PIN&#39;s generation (i.e. source) as having come from a particular unit and, further, a particular memory register within the unit. Although the application of mathematical watermarks to documents and data communications are conventional, this technique of embedding a watermark within a PIN created by the device is unique and is part of the current invention. With this linking of the source of the PIN to a particular unit, there is an assurance link established, via logical inference, that the PIN was submitted by the particular individual who was authorized and capable to use the unit. In essence, a mathematical bonding of the PIN code to the unit and, hence, to the individual authorized and capable to use the unit. If ordinary care is used in the protection of the unit from unauthorized use/display or attempted use/display, a novel method/process of authentication arises. This method, called “asymmetrical biometric authentication” can only coexist with this device. It is asymmetrical because the host does not possess nor compare the biometric of the user as it does under conventional biometric authentication. Conventional methods are considered symmetrical authentication because both client and host possess the biometric data. Under this method, no biometric is submitted. With the watermark, however, the host can be assured that the PIN originated with the unit in the individual&#39;s control. As such, within normal use parameters, it can infer that it is this particular authorized individual requesting authentication and access to the secure site. The stronger the stenographic key used to bind this one to one relationship between the PIN and the unit which is controlled by the individuals biometric, the stronger the inference. Another advantage is that with this method, the PIN, in essence, becomes a renewable, one to one digital proxy of the individual&#39;s fingerprint. Unlike these conventional biometric authentication methods, however, if the present invention is compromised, the relationship between the persons biometric and the PIN can be immediately canceled and therefore rendered useless for further identification and authentication of the individual. With conventional methods, if the biometric is compromised, (i.e. copied for purposes of representation without the users authorization) no such cancellation of the persons biometric can occur. 
     With reference to FIG.  8  and as indicated by blocks  104  and  106 , the authorized user biometrically authenticates themselves when activating the device  10 . As shown by block  108  and  100 , the watermarked password which could only have come from the unique device  10  is presented to the client to be forwarded to the host site. As indicated by block  100 , the host site can examine the watermark password for the following two attributes and authenticates the user if both are true: (1) is the password the correct password on file for this user and (2) is the static watermark associated with that user and known by the host site present in the password. The host site may be given the watermarked password when the user received the device  10  from the manufacturer and/or otherwise enrolled in the usage of the device  10 . As a practical matter, the host biometrically authenticates the user via inference by examining the password substituted for the person&#39;s biometric parameter. 
     With reference to FIG.  9  and as indicated by block  112 , the device  10  is operable to allow the user to enter an initial password. As indicated by block  114 , the device  10  is operable to calculate an initial random password which is not displayed or outputted. As indicated by block  116 , the device  10  is operable to look up a watermark for the memory register where the password is assigned. As indicated by block  118 , the device  10  has a data base of public domain watermarks randomly assigned to each memory register of the device  10  at the time the device  10  is manufactured. As indicated by block  120 , the device  10  is operable to mathematically embed the watermark to the password. As indicated by block  122 , the device  10  is operable to display the random password with the embedded watermark. 
     The device  10  as may further comprise a standard off the shelf pager chip circuitry  130  (FIG. 2) connected to the CPU along a path  132  and enrolled in a standard paging network. This beeper feature will be used in conjunction with a novel method of unauthorized access/intrusion detection into the secure site as follows; When the user accesses their account using the device  10 , the secure site will “beep back” the device  10  informing the user, via this separate and independent communication channel, that the account has been accessed. This “page back” communication will occur anytime the secure site is accessed, without regard to the authorized use of the device  10 . If unauthorized access to the secure site is attempted, (i.e. access attempts other than by the individual assigned/authorized to use the unit) the individual assigned/authorized to use the device  10  will be notified of this unauthorized access attempt via this communication method. When enrolled in a standard paging service network, this feature will “beep back” the unit informing the user, via this separate and independent communication channel, that the account has been accessed. This “page back” communication will occur anytime the secure site is accessed, without regard to the authorized use of the unit. If unauthorized access to the secure site is attempted, (i.e. access attempts other than by the individual assigned/authorized to use the unit) the individual assigned/authorized to use the unit will be notified of this unauthorized access attempt via this communication method. This forms a deterrent against password “surfing.” 
     From the foregoing it will be seen that the present invention provides a highly secure, authenticated environment in a device which is entirely within the possession and control of the user to which it is initially issued. The desirable feature of biometric authentication is provided without relinquishing personal control of any biometric information. That is, the invention does not require storage of biometric data anywhere other than in a small device intended to remain only in the possession of the original user, and essentially irretrievable and useless to anyone other than the user who may come into possession of the device. No biometric data, in template form or otherwise, is transmitted or compared to a file of such data at a host location. The device requires activation in response to biometric authentication, whereupon it will generate, store, display and manage large bit-size PINs for each of a plurality of systems to which the user requires authenticated access. There is no need for the user to memorize any password or to have any other unique knowledge. The generated PINs may contain a watermark or hash function extension which uniquely ensures that the PIN was created from an authenticated environment. While displayed on the device, the PIN is entered manually into a local system and transmitted to the secure site, which may be remote from the user. The computer at the secure site performs a look-up function, compares the entered PIN with that previously stored for the user and, upon validating a match, grants access. 
     Specific details of the electronic circuits and devices employed in the security device of the invention have not been provided as a variety of commercially available devices may be employed, depending upon desired levels of operation and performance. Processor  24  is preferably a low-voltage device with built-in power management capabilities. Its particular size (e.g., 16, 32, 64-bit) and speed will depend upon the complexity of the algorithms used for encryption, PIN generation and bio-sensor analysis, as well as the desired response time vs. battery life. Generator  32  is preferably a Johnson Noise Based Random Number Generator, for reasons previously mentioned. Features such as the manner of encryption of the PIN database, mapping of the bio-data to an id-tag or template, etc. are matters of choice well within the present state of the art.