Abstract:
A system for enabling identity verification of an individual in a transaction between the individual and an entity that utilizes a data processing system, an entity device, and an individual device. The individual registers with the data processing system biometric data taken from the individual and data pertaining to an individual device. The entity registers with the data processing system entity identifying information. Once the individual and entity agree on a transaction, the entity notifies the data processing system of the pending transaction and requests verification of the individual&#39;s identity. The individual communicates to the data processing system individual biometric data. The data processing system compares the biometric data from the individual with registered biometric data. The data processing system forwards a result of the comparison to the entity and upon a successful comparison, may forward any requested information regarding the individual to the entity.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
     This application is a continuation-in-part of co-pending U.S. application Ser. No. 13/587,708, filed Aug. 16, 2012, which is a continuation of U.S. application Ser. No. 12/423,628, filed Apr. 4, 2009, now U.S. Pat. No. 7,970,678, which is a division of U.S. application Ser. No. 09/871,241, filed May 30, 2001, now U.S. Pat. No. 7,565,329, which claims the benefit of U.S. provisional application Ser. No. 60/208,680, filed May 31, 2000, herein incorporated by reference. 
    
    
     FIELD OF THE INVENTION 
     This invention relates to the field of biometric authentication. Specifically, this invention is directed towards a system and method for biometric authentication of individual biometric data for the purposes of verifying that individual&#39;s identity in a transaction using a wired or wireless communication system and portable or static devices such as a telephone (wired or wireless), a personal digital assistant (PDA), a computer (tablet, laptop, or desktop) or a similar device, wherein a biometric, such as a finger image or voice print, is used. 
     BACKGROUND OF THE INVENTION 
     There is an increasing need for individuals to be able to conveniently and securely verify their identities via biometric authentication for various types of transactions with entities. 
     Conventionally, in a biometric authentication system, individuals must present their biometric data to an entity via an entity device. The entity device then communicates with a data processing system to affect biometric data matching of the presented biometric data to registered biometric data to determine if individuals presenting the biometric data are who they claim to be. However, for some individuals, presenting biometric data via an entity device has proven a transaction deterrent, as they may question the security of entering such personal data into the entity device. 
     There are numerous problems with this conventional approach. First, the conventional approach is often uncomfortable for the individual to use, as he must enter a significant amount of personal data into an entity device, thereby trusting the entity with his highly personal data. Second, this approach requires that an entity invest in a biometric device that it may not use often and must incorporate somewhere near a point of transaction where it inevitably monopolizes valuable space. Third, this approach is inflexible in that it requires that the individual and entity be co-located in order to affect a transaction. Fourth, in the case of a financial, token-based transaction, those made without a card being physically present (as in the case of a telephone or Internet order) are charged a higher “discount rate” than transactions where the card is present. The discount rate is the amount that the credit card associations, issuing banks, acquiring banks, and third-party transaction processors collectively charge the entity (e.g., merchant) on each transaction, generally expressed as a percentage of the gross transaction amount. Discount rates of 3%-5% for card-not-present transactions are common. 
     As a result, there is a need for a system that solves these problems. Accordingly, it is an object of this invention to provide a new biometric authentication system and method for facilitating identity verification of individuals conducting transactions that allows an individual to utilize an individual device to enter sensitive biometric data into the system. 
     Biometric authentication systems are known in the art; examples include U.S. Pat. No. 5,613,012 to Hoffman et al., U.S. Pat. No. 5,838,812 to Pare, Jr. et al., U.S. Pat. No. 5,870,723 to Pare, Jr. et al., U.S. Pat. No. 6,230,148 to Pare, Jr. et al., U.S. Pat. No. 6,154,879 to Pare, Jr. et al., U.S. Pat. No. 7,613,659 to Hoffman, et al., U.S. Pat. No. 7,512,567 to Bemmel, et al., and U.S. Pat. No. 7,269,737 to Robinson, all of which are incorporated by reference. 
     In particular, it is an object of the invention that an individual be enabled to use an individual device to facilitate verification of his identity in a variety of transactions. 
     It is another object of the invention that the system and method are secure, eliminating the possibility of fraud via intercepting transmissions from the individual device. 
     It is another object of the invention that the system and method provide the flexibility of supporting multiple types of individual and entity devices. 
     It is still another object of the invention that it be easy to integrate the present invention with existing entity computer, information, and transaction systems. 
     SUMMARY OF THE INVENTION 
     This invention provides a method for biometric identity verification of an individual in a transaction between the individual and an entity using an electronic data processing system (DPS), an individual device, and an entity device. A transaction may comprise any number of communicative interactions between two parties, e.g., an entity and an individual, in which the identity of one or more of the parties must be verified. Examples of such transactions include financial transactions, age verifications, identity verifications, ticket redemptions, incentive transactions, peer-to-peer payments, peer-to-peer privilege transfers, physical access requests, virtual access requests, or the like. To utilize the system, an individual registers with the DPS biometric data and an individual device code (ID code) that is associated with an individual or individual device. The biometric data may be taken directly from the individual&#39;s person, from a token, from a data store, or a combination thereof. The ID code may be any code that can be used to identify or assist in identifying the individual or individual device. In a transaction, the individual and entity establish communications with each other. Such communications may be face-to-face or via communication of individual and entity devices or any other method. The individual device may communicate to the entity its associated ID code, which the entity may forward to the DPS. The individual and the DPS may then use the ID code to establish communications. The individual device may communicate the ID code to the DPS, which may utilize it to verify the ID code received from the entity and utilize it to determine registration biometric data to compare with biometric data taken directly from the individual&#39;s person to produce a successful or failed identification of the individual. Upon successful comparison of biometric data, the DPS may verify the individual&#39;s identity to the entity. The DPS may additionally forward individual data registered with the DPS to the entity upon a successful comparison of biometric data. Such data may include, for example, the individual&#39;s age, name, address, or any other data that the individual has registered with the DPS. 
     The foregoing and other objects, features, and advantages of the invention will become more readily apparent from the following detailed description of the invention which proceeds with reference to the accompanying drawings. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  shows the overall collection of elements comprising the system. 
         FIG. 2  illustrates an example operation of the system. 
     
    
    
     DETAILED DESCRIPTION 
     Overall Architecture 
     As shown in  FIG. 1 , the invention comprises DPS  100 , which is capable of communicating with individual device  104  and entity device  102 . An individual may use DPS  100  to verify one or more aspects of his identity. Similarly, an entity may use DPS  100  to obtain verification of one or more aspects of the individual&#39;s identity. The individual has access to individual device  104 . As described in greater detail below, individual device  104  may be a device that is at least capable of communicating with DPS  100  and accepting biometric data from the individual. Individual device  104  may additionally be capable of communicating directly with entity device  102 . Biometric data may be any unique human characteristic of which a scan or image is taken directly from the person and may be, but is not limited to, a voice print, a fingerprint, a retinal image, an iris image, a facial image, an electronic representation of the above, such as a template, or the like. 
     DPS  100  may provide the ability to accept data pertaining to the individual (e.g., biometric and other data), to identify the individual from this data, to verify the identity of the individual to an entity, and to provide the entity with individual data upon request. It is understood that DPS  100  may be owned and/or operated by the entity, the individual, or a third party. 
     DPS  100  may be a single computer or a collection of computers and may serve a particular entity or a number of different entities. Although only a single instance of each component is depicted, this is for illustrative purposes only and is not to be construed as limiting. Furthermore, although each component is depicted and described herein as separate, this is not to be construed as limiting, and components may be combined per implementation. For example, components of DPS  100  may be combined (e.g., biometric data and additional data may be stored in the same location). 
     Communication Links 
     Communication links may exist or may be established between individual device  104  and entity device  102 , individual device  104  and DPS  100 , and the entity device  102  and DPS  100 . A communication link may be a permanent connection (e.g., a leased line), a temporary switched-circuit connection (e.g., a dialup telephone call), a network (e.g., cellular networks, the Internet, Wi-Fi, GPS, NFC, WAN, LAN, WLAN, WPAN, etc.), a virtual connection (e.g., via packet switching), or any other suitable connection. Encryption may be employed on all communication links to protect sensitive data, as is standard in the industry. 
     Individual Device 
     Individual device  104  is any device that is capable of communicating with DPS  100  and accepting a biometric sample from the individual. Individual device  104  may be a portable device, such as a wireless telephone, a two-way pager, a personal digital assistant (e.g., a smartphone), an Internet-enabled phone, a portable computer (e.g., a laptop, a tablet computer) or the like. Individual device  104  may alternatively be a static device, such as a wired telephone, a desktop computer, a kiosk, or the like. Individual device  104  may additionally be capable of communicating directly with entity device  102 . Different individual devices may be preferable in different situations. In one embodiment, an individual may use a device such as a wireless telephone to call an entity and conduct a transaction. In such a case, individual device  104  may be used as a biometric input device utilizing the individual&#39;s voice as a biometric and the wireless telephone&#39;s microphone as a biometric reader. Individual device  104  may also be equipped with a finger image scanner or other biometric sensor, such as a camera for capturing facial data. Other individual devices will be apparent to those of ordinary skill in the art and the aforementioned examples are not to be construed as limiting. 
     Individual device  104  may be associated with an ID code. This ID code may be unique to individual device  104  but is not required to be. Examples of ID codes may include a digital certificate, a Subscriber Identity Module (SIM) code, a code for enabling short-range transmissions (e.g., Near Field Communications), a telephone number, an electronic serial number (ESN), a mobile identification number (MIN), a hardware identification code, an encryption of a challenge message using a private key, or the like. An ID code may also be a code that is not directly associated with the device but instead may be unique to an individual. Examples of such ID codes could include social security numbers, driver&#39;s license numbers, telephone numbers, birth dates, PIN codes, etc. Such an ID code may enable the individual to utilize any individual device  104 , whether it is his device or a shared device. Communication of the ID code may be accomplished via caller identification, hand-keying, voice recognition, automated transmission, or the like, and communication between the entity and individual may be established via a telephone call, three-way calling, induced three-way calling, packet switching, a data exchange, a face-to-face interaction, text messaging, the Internet, a local area network (LAN), a personal area network (PAN), a wireless local network (WLAN), a wide area network (WAN), a wireless personal network (WPAN, e.g., Bluetooth), Near Field Communication (NFC), or the like. 
     Entity Device 
     Entity device  102  is any device that is capable of communicating with DPS  100 . Entity device  102  may be a stand-alone device or a network of devices utilized to function as entity device  102 . Entity device  102  may communicate with DPS  100  directly or via one or more communication networks. The “entity” may be an individual or institution with which the individual is interacting. For example, an entity may be a retailer, an airline or other travel entity, a government agency, or the like, or an entity may be an individual employed by such an institution or acting independently. Entity device  102  may additionally be capable of communicating with individual device  104  and/or of receiving entity biometric data. As with individual device  104 , entity device  102  may be a portable or static device. Additional forms of entity device  102  may include a point of transaction station, such as a point-of-sale terminal, ticket redemption counter, a kiosk, an identification check point, a vending machine, or the like. In other embodiments, the entity may be another individual utilizing a second individual device to conduct a peer-to-peer transaction. In this scenario, the second individual device interacts with DPS  100  in a manner similar to that of entity device  102 . Entity device  102  may also be associated with an entity identification (EID) code, which may help DPS  100  more easily identify the entity. This EID may be unique to entity device  102  but is not required to be. Examples of EID codes may include a digital certificate, a Subscriber Identity Module (SIM) code, a code for enabling short-range transmissions (e.g., Near Field Communications), a telephone number, an electronic serial number (ESN), a mobile identification number (MIN), a hardware identification code, an encryption of a challenge message using a private key, or the like. Communication of the EID code may be accomplished via caller identification, hand-keying, voice recognition, automated transmission, or the like, and communication between the entity and individual may be established via a telephone call, three-way calling, induced three-way calling, packet switching, a data exchange, a face-to-face interaction, text messaging, the Internet, a local area network (LAN), a personal area network (PAN), a wireless local network (WLAN), a wide area network (WAN), a wireless personal network (WPAN, e.g., Bluetooth), Near Field Communication (NFC), or the like. 
     Data Processing System (DPS) 
     DPS  100  may include a data and/or call-processing system comprising one or more of execution module  106 ; biometric comparison mechanism  110 ; linking mechanism  118 ; and data stores capable of storing identifying data, such as biometric data  108 , individual additional data  112 , entity additional data  114 , individual device data  116 , and entity device data  120 . The inclusion of differing data stores is for illustrative purposes and is not to be considered limiting. Such data stores could also be combined and/or further segmented, depending on the embodiment of DPS  100 . DPS  100  may be a single computer or a collection of computers and may serve a particular entity or a number of different entities. 
     Biometric data store  108  may store biometric data of individuals and entities registered to use DPS  100 . Device data stores  116  and  120  may store an ID code and an EID code, respectively, and other data associated with individual device  104  and entity device  102 . Additional data stores  112  and  114  may store individual and entity data other than biometric data and device data, such as identity information, location information, age information, contact information, financial account information, or the like. Biometric comparison mechanism  110  may compare biometric data received from individual device  104  and/or entity device  102  with registered biometric data stored in biometric data store  108 . 
     DPS  100  may utilize ID codes or any other individual- or entity-specific data to reference and locate registered data. For example, an individual&#39;s registered biometric data and additional data may be stored in association with an ID code received from individual device  104 . Alternatively, individual and/or entity data may be associated with a system identifier (SI) code. An SI code may reference the entirety of the individual&#39;s or entity&#39;s data stored within DPS  100 . The SI code may be included in a registry to enable DPS  100  to index biometric data, additional data, and device data, or the like to better facilitate locating such data throughout DPS  100 . 
     Execution module  106  may serve as the computing mechanism to affect communication within DPS  100 , with entity device  102 , with individual device  104 , and may assist in the enablement of the transaction between the individual and the entity. Linking mechanism  118  may assist DPS  100  in linking data received from entity device  102  and individual device  104  in order to facilitate responding to entity requests. While DPS  100  is depicted as comprising biometric comparison mechanism  110 , the system may also be structured to utilize a biometric comparison mechanism that may be present in individual device  104 . For example, DPS  100  may communicate registered biometric data to individual device  104  to enable a biometric comparison mechanism residing on individual device  104  to compare to the registered biometric data with captured biometric data. An example of such a system configuration is further discussed in U.S. Pat. No. 7,269,737 to Robinson, which is herein incorporated by reference. 
     DPS  100  may accept queries including biometric data and utilize this data to identify individuals. Once an individual is identified, DPS  100  may retrieve data associated with that individual necessary for completion of a transaction. Such data may be requested by the entity or the individual and may be used to approve or disapprove a requested transaction. Such information may include an electronic copy of an identification document (e.g., a passport, a driver&#39;s license, a visa, etc.), information associated with one or more individual financial accounts, medical records, a yes/no answer to the query of whether or not the individual is a certain age, an indication of the individual&#39;s identity, or the like. 
     An example of a system such as DPS  100  is illustrated in U.S. Pat. No. 5,613,012 to Hoffman, et al., which is hereby incorporated by reference. 
     Use of DPS  100   
     An individual and an entity may wish to utilize DPS  100  to facilitate a transaction in which the entity seeks verification of the individual&#39;s identity. The individual and the entity establish a communication link to negotiate the details of the transaction. The manner of establishing this link may be, for example, via face-to-face interaction or device-to-device interaction. For example, the individual may use individual device  104  to contact entity device  102 . 
     Once the individual and the entity have negotiated the details of the transaction via their established communication link, they may utilize DPS  100  to verify the identity of the individual. For example, the individual may wish to verify his identify to the entity, and the parties may utilize DPS  100  to facilitate biometric identity verification of the individual in order to do so. 
       FIG. 2  shows an example method of verifying the identity of an individual via DPS  100 . The method depicted may be implemented through the use of various embodiments of individual device  104 . 
     At step  202 , DPS  100  receives a communication link request, in which entity device  102  requests to establish a communication link with DPS  100 . Once a communication link is established between DPS  100  and entity device  102 , at step  204  execution module  106  receives a verification request, in which entity device  102  requests that DPS  100  verify the identity of an individual in a transaction. This verification request may include transaction data, such as an ID code that corresponds to an individual or an individual device  104 , entity identifying information (e.g., an EID code associated with entity device  102 , a name, an address, a location identifier, a telephone number, etc.), details of the transaction that the individual and entity have negotiated, or the like. In negotiating the details of the transaction, entity device  102  may have received the ID code from individual device  104  in various ways. For example, in a device-to-device embodiment, this may be accomplished via caller identification or another automated method. In a face-to-face embodiment, the individual may tell the entity his ID code, which the entity may then enter into entity device  102 . Execution module  106  may receive the verification request from entity device  102  via an out-of-band channel (e.g., a separate network connection, via a virtual private network, etc.) or it may be passed in-band via the initiation of a connection. 
     Execution module  106  may forward the verification request to linking mechanism  118 , where it may be assigned a reference code and held for use by DPS  100  to facilitate a request response to entity device  102 . The reference code may provide DPS  100  with a way to track transaction data as it is utilized throughout DPS  100 . The reference code may be a portion of the transaction data, such as the ID code, an entity identifier, or the like. Alternatively, execution module  106  may assign a system-generated reference code to the verification request. The reference code may be associated with any pertinent data as it is communicated internally or externally to aid with data processing. 
     In step  206 , execution module  106  may utilize the received ID code to locate or to assist in locating registered biometric data stored in biometric data store  108 . As mentioned, DPS  100  may be configured to associate registered biometric data with ID codes or with other identifiers. If registered biometric data is not associated directly with ID codes, the execution module may locate the registered biometric data via another identifier also referenced with the received ID code, such as an SI code. 
     In step  208 , DPS  100  and individual device  104  may establish a communication link. This may be accomplished via execution module  106  utilizing the ID code to establish a connection with individual device  104 . Alternatively, execution module  106  may search individual device data store  116  for associated device data it may use to contact individual device  104 . In a further embodiment, if entity device  102  and individual device  104  have established a communication link, entity device  102  may transfer its communication link with DPS  100  to individual device  104  so that individual device  104  and DPS  100  may interact. And in yet an alternative embodiment, execution module  106  may await a communication link request from individual device  104 . In an embodiment in which individual device  104  initiates communication with DPS  100 , individual device  104  may identify itself to DPS  100  via presentment of its ID code. Execution module  106  may forward the ID code to linking mechanism  118  to retrieve necessary data to continue processing of the initial request received from entity device  102 . 
     Once communication is established between DPS  100  and individual device  104 , in step  210  execution module  106  may prompt individual device  104  to provide biometric data. Individual device  104  may, in turn, prompt the individual to input biometric data if he has not already done so. Depending on the configuration of individual device  104 , biometric data may be a finger image, a voiceprint, or any other type of biometric. 
     In step  212 , execution module  106  may receive biometric data from individual device  104  and forward the received biometric data to biometric comparison mechanism  110  where it may be compared to the registered biometric data that execution module  106  has identified as being associated with the ID code. The result of this comparison may be utilized to verify the individual&#39;s identity. In the event that the received biometric data does not sufficiently match the registered biometric data and the individual&#39;s identity cannot be verified, execution module  106  may prompt individual device  104  to obtain biometric data again. At step  218 , if the individual&#39;s identity cannot be verified after repeated tries, execution module  106  may transfer the communication link to a human customer service assistant, who may use other means to identify the individual or suggest to the entity that the transaction be declined. If the biometric comparison is successful, execution module  106  may retrieve the associated transaction data held in linking mechanism  118 . Execution module  106  may use this transaction data to either identify entity device  102 , should it have retained its communication with DPS  100 , or locate contact data for entity device  102  via use of entity device store  120 , entity additional data store  114 , and/or a combination of entity device store  120  and entity additional data store  114 . Alternatively, the transaction data may include entity device  102  contact data. Once entity device  102  is identified and/or its contact data located, at step  216 , execution module  106  may notify the entity that the individual&#39;s identity is verified. This notifying may include utilizing the located contact data to establish communications with entity device  102  again to do so. Alternatively, module  106  may retrieve and forward any additional individual data necessary for satisfying the verification request from individual additional data store  112 , according to the details of the received transaction data. Such information may include a yes/no answer to the query of whether or not the individual is a certain age, an indication of the individual&#39;s identity, account information pertaining to a credit card or other financial account data, a copy of an individual identification document, or the like. Upon communication of identity verification, the communication link between DPS  100  and entity device  102  may be maintained in order for the entity to query DPS  100  via entity device  102 . Such an embodiment may allow an entity to obtain further data about the individual that may have not be requested in the initial transaction data. 
     In an additional embodiment, at step  210 , should individual device  104  be equipped to effect biometric comparisons, execution module  106  may forward the registered biometric data associated with individual device  104  with a prompt for individual device  104  to provide the result of a comparison of the registered biometric data to individual biometric data retrieved via individual device  104 . Execution module  106  may receive the result of the individual device biometric comparison at step  212  and proceed to step  214  as illustrated. 
     In an alternate embodiment of  FIG. 2 , individual device  104  may additionally send biometric data to entity device  106  via the communication link initially established for negotiating the details of the transaction or via a subsequent communication link. In this embodiment, DPS  100  may receive biometric data of the individual via the verification request of step  204  (e.g., as included as transaction data) or via a subsequent communication link between DPS  100  and entity device  106 . Such a scenario may enable DPS  100  to provide verification of the individual&#39;s identity directly to the entity via entity device  106  without the need for establishing a separate communication link with individual device  104 . 
     In a further embodiment, individual device  104  may receive an entity identifier and details of the negotiated transaction via the initially established communication link for negotiating the details of the transaction, or via a subsequent communication link between the individual device  104  and the entity device  106 . In such a scenario, steps  202  through  206  of  FIG. 2  may be eliminated. In addition, DPS  100  may communicate with individual device  104  at step  216  and/or  218 , and individual device  104  may communicate with entity device  106  to either confirm or deny identity verification. 
     In preferred embodiments, encryption and cryptographic authentication mechanisms may be used to maintain the security, integrity, and non-repudiation of information communicated between individual device  104 , entity device  106 , and DPS  100 . Such encryption may include symmetric or “secret key” cryptosystems or public key cryptosystems, and such authentication mechanisms may include cryptographic message authentication codes, as are known in the industry. 
     From the foregoing it will be appreciated how the objects of the invention are met. As can be seen from the above, the invention is markedly advantageous over existing systems in numerous ways: 
     First, the invention is convenient for the individual, in that DPS  100  may handle all personal information, eliminating the need to recite or otherwise enter personal information into a static or portable device. 
     Second, the use of biometrics and encryption may provide security, eliminating the possibility of fraud via intercepting transmissions from the static or portable device. 
     Third, the system may support the use of multiple types of individual data, providing flexibility for the individual. 
     Fourth, by using ordinary telephone connections, existing wireless connections, Internet connections, or the like, the invention may easily integrate with existing computer, information, and payment systems. 
     Although the invention has been described with respect to particular transactions, it will be appreciated that various modifications of the system and method are possible without departing from the invention.