Abstract:
The invention concerns a biometric identification or authentication system, comprising several matching units associated with biometric data storage units, data units for updating the biometric data of the data units and control means for processing matching requests and/or updating biometric data from at least one client unit, the control means comprising transaction management means designed on the basis of a transactional monitor to cause said units to communicate.

Description:
BACKGROUND OF THE INVENTION 
     The present invention relates to biometric identification and/or authentication systems. These systems manipulate biometric data, consisting, for example of fingerprint coding data. Naturally, they may also represent other types of biometric measurements, for example on the eye, the hand, the face, the voice, etc. 
     More specifically the invention relates to relatively large-scale systems, in which many fingerprint records or other biometric data are stored in databases. These systems have to process matching requests accompanied by coded data representing a fingerprint, and determine, from among the numerous stored fingerprint records, the one or those that display the closest match. 
     The system must also be able to process update requests to insert or delete fingerprint records stored in the databases. 
     Distributed architectures are known to be adopted in these large systems, with a number of matching units among which the matching request processing load is distributed. Each matching unit operates with one part of the database. Several matching units form a string covering the whole of the database. Several strings of this type may be provided for processing several matching requests in parallel. For each part of the database, one data unit ensures the updating of the stored data according to the insertion and deletion requests submitted by the users. 
     Coordinating the processing of the different requests is a relatively delicate matter for ensuring the general consistency of the system. Many requests of various kinds succeed one another and the system must be capable of remaining stable and reliably answering each of these requests. 
     Achieving this objective normally requires considerable software development as part of a proprietary solution for the system. 
     One object of the present invention is to simplify this development in order to ensure good system performance and some flexibility in upgrading. 
     SUMMARY OF THE INVENTION 
     The invention thus provides a biometric identification or authentication system, comprising several matching units associated respectively with biometric data storage units, data units for updating the biometric data of the storage units and control means for processing matching requests and/or requests for updating stored biometric data originating from at least one client unit, the control means comprising transaction management means designed on the basis of a transactional monitor to cause said units to communicate. 
     The transactional monitor is a set of software modules created, in remote transaction commercial applications, to provide the properties of atomicity, consistency, isolation and durability (“ACID”). It has been found that these properties can be used to considerably simplify the coordination of exchanges in a distributed biometric identification system. 
     The property of atomicity ensures that all the operations belonging to a transaction form a work unit, which means that they must all be successfully performed or all rejected. 
     The property of consistency means that each transaction must pass through the database from one consistent state to another. If the transaction does not reach a stable final state, it brings the system back to the previous state. 
     The property of isolation means that the results of a transaction are only visible to other transactions once the transaction is validated. In other words, although they are executed simultaneously, the transactions appear to be executed sequentially. 
     The property of durability means that the modifications resulting from a validated transaction will never be lost. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a diagram illustrating the architecture of a system according to the invention; and 
         FIG. 2  is a diagram illustrating different processes used in the system. 
     
    
    
     DESCRIPTION OF PREFERRED EMBODIMENTS 
     The system  1  shown in  FIGS. 1 and 2  is used in a fingerprint identification application. This is called a “matcher”. It includes several intercommunicating servers. A “server” is understood here to be either a software process, or a programmed machine following such a process. 
     These servers include a number of matching units MU 0 -MU 3  for processing matching requests originating from one or more client units  2 . The set of fingerprint data is subdivided into n parts (n=4 in the example shown). Each of these parts is loaded into a memory MEMO-MEM 3  of at least one of the matching units MU 0 -MU 3 . Each interrogated unit MU 0 -MU 3  selects one or more entries from its part of the database by means of matching algorithms. These responses are then consolidated to present an overall response to the client  2 . 
     As illustrated diagrammatically in  FIG. 1 , the matching units MU 0 -MU 3  may each be present in a number of copies, each associated with the same part of the database. So the system comprises several strings of n=4 matching units MU 0 -MU 3 . One matching request is processed by one of these strings. 
     A loading server  5  ensures the presence of different parts of the fingerprint database in the memories of the matching units MU 0 -MU 3 . It obtains the data in question from n data units DU 0 -DU 3 , which process updating requests (insertion, deletion, etc.) originating from the client units  2 . The data units DU 0 -DU 3  also keep a copy of the database up to date in a long term storage memory, for example hard disk units BD 0 -BD 3 . 
     The system  1  further includes servers forming one or more control units  6  providing a number of monitoring functions: request management, administration, keeping request logs, access authorization, parameter setting and configuration, queue management, database initialization, indexing, file management, etc. 
     For organizing the exchanges between the various servers and the client or clients, the control units  6  cooperate with elements of a transactional monitor  7 . 
     Transactional monitors are well-known means of transaction management in client-server architectures. Several types of transactional monitors have been standardized, especially by the International Standards Organization (OSI-CCR and OSI-TP) and by X/Open (DTP specification, Distributed Transaction Processing). Examples of commercial products usable as a transactional monitor  7  in the system  1  are “Encina” marketed by IBM and “Tuxedo” marketed by BEA Software. 
     With reference to  FIG. 2 , the system  1  includes an interface module  10  with the client units  2 , which conventionally cooperates with an authentication server  11  validating client access to the system. 
     Requests emanating from the clients  2  are placed in an input queue  12  before being submitted to a routing server  13 . The server  13  separates the matching requests routed to a second queue  14  and the update requests routed to the data units DU 0 -DU 3 . Other requests may be routed to a system configuration and parameter setting server  15 . This server  15  cooperates with a memory unit  16  where the system configuration parameters are recorded. 
     Update requests are processed by the data units DU 0 -DU 3 , which record the modifications in the stored databases BD 0 -BD 3 , and which send the loading server  5  any data updating commands present in the memories MEMO-MEM 3  associated with the matching units MU 0 -MU 3 . 
     The processing of matching requests coming out of the queue  14  is monitored by one or more management matching units MM (Management Matching). These present the requests to the matching units MU 0 -MU 3 , taking into account the partition of the fingerprint databases and the occupation of the various strings. The units MM collect the responses produced by the matching units MU 0 -MU 3 , consolidate the results returned by these units MU 0 -MU 3 , and send back the consolidated results to an output queue  18 . The interface module  10  extracts these results from the queue  18  to present them to the client units concerned. 
     In the diagram in  FIG. 2 , the arrows shown inside the system  1  represent exchanges monitored by the transactional monitor  7 , so as to ensure the aforementioned ACID properties. In addition, the transactional monitor  7  takes over the servers meeting the XA interface standard. File servers meeting this standard may be used for perpetuating biometric data and configuration data.