Patent Publication Number: US-6671672-B1

Title: Voice authentication system having cognitive recall mechanism for password verification

Description:
FIELD OF THE INVENTION 
     The present invention pertains to the field of voice authentication. More particularly, the present invention relates to techniques for performing password verification in a voice authentication system. 
     BACKGROUND OF THE INVENTION 
     Voice authentication is a technique by which the identity of a person is determined or verified based on his voice. Such techniques are required in many fields, such as telephone banking and investing. In these applications, a person may make or redeem investments or transfer balances over the telephone using only his voice, without a human operator on the other end of the telephone connection. Voice authentication systems commonly assign a password to each user to facilitate identification. The password typically is a computer-assigned Personal Identification Number (PIN), random digit string, or random phrase. However, users of voice authentication systems often prefer to select their own personalized password. One problem with allowing them to do so, however, is that users tend to forget the password they selected. 
     A simple approach to enabling a user to remember his password is to direct the user to select a password of a predetermined type that is easy to remember, such as his mother&#39;s maiden name. This approach, however, is overly restrictive of the user&#39;s choices of passwords and is therefore undesirable. Another approach is to avoid the use of passwords and simply ask users to repeat short phrases during enrollment and authentication. This approach is also undesirable, because it is time-consuming, adds complexity to the voice authentication system, and can be annoying to the user. 
     SUMMARY OF THE INVENTION 
     The present invention includes a method and apparatus for enrolling a user for voice authentication. The method includes outputting a first prompt designed to elicit a first utterance from the user, and then receiving and storing the first utterance as a password prompt for the user. The method further includes outputting a second prompt designed to elicit a second utterance from the user, and then receiving and storing the second utterance as a password corresponding to the password prompt. 
     Another aspect of the present invention further is a method and apparatus for performing voice authentication. The method includes outputting a password prompt to the user which is representative of an utterance previously received from the user and which corresponds to a password for the user, and then verifying the user based on whether a spoken response to the password prompt is received which matches the password. The present invention further includes embodiments in which such enrollment and authentication are combined. 
    
    
     Other features of the present invention will be apparent from the accompanying drawings and from the detailed description which follows. 
     BRIEF DESCRIPTION OF THE DRAWINGS 
     The present invention is illustrated by way of example and not limitation in the figures of the accompanying drawings, in which like references indicate similar elements and in which: 
     FIG. 1 illustrates a computer system including a voice-activated application and authentication software. 
     FIG. 2 is a block diagram of the components of a computer system in which the present invention can be implemented. 
     FIG. 3 illustrates components of the authentication software. 
     FIG. 4 is a flow diagram illustrating routine for enrolling a user for voice-based password verification. 
     FIG. 5 is a flow diagram illustrating a routine for creating a password. 
     FIG. 6 is a flow diagram illustrating routine for voice-based password verification. 
    
    
     DETAILED DESCRIPTION 
     A method and apparatus are described for facilitating cognitive recall of a password in a voice authentication system. As will be described in detail below, the system enrolls a user for password verification by receiving a voice input from the user representing the password prompt and another voice input representing a correct response to the password prompt. The voice inputs may be stored as waveforms, as voiceprints, recognized speech data, or a combination thereof. During password verification, the system verifies the identity of the user by outputting the user-provided password prompt and evaluating a response to password prompt against the correct response. As a result, the user is able to select his own password prompt to facilitate cognitive recall of the password during a subsequent verification phase. 
     The voice authentication system and the included cognitive recall technique may be embodied in software, either in whole or in part. That is, the voice authentication system may be carried out in a computer system in response to its central processing unit (CPU) executing sequences of instructions contained in memory. The instructions may be executed from memory and may be loaded from a persistent store, such as a mass storage device and/or from one or more other remote computer systems (collectively referred to as “host computer system”). In the latter case, for example, a host computer system may transmit a sequence of instructions to the (“target”) computer system in response to a message transmitted to the host computer system over a network by target computer system. As the target computer system receives the instructions via the network connection, the target computer system stores the instructions in memory. The target computer system may store the instructions for later execution or execute the instructions as they arrive over the network. 
     In some cases, the downloaded instructions may be directly supported by the CPU of the target computer system. Consequently, execution of the instructions may be performed directly by the CPU. In other cases, the instructions may not be directly executable by the CPU. Under those circumstances, the instructions may be executed by causing the CPU to execute an interpreter that interprets the instructions or by causing the CPU to execute instructions which convert the received instructions to instructions which can be directly executed by the CPU. 
     In various embodiments of the present invention, hardwired circuitry may be used in place of, or in combination with, software instructions to implement the present invention. Thus, the present invention is not limited to any specific combination of hardware circuitry and software, nor to any particular source for the instructions executed by a computer system. 
     FIG. 1 illustrates a voice authentication system in which the described cognitive recall technique for password verification can be implemented. As shown, a computer system  1  includes a voice-activated software application (henceforth simply “application”)  21 , which is functionally coupled to authentication software  22 . The application  21  and the authentication software  22  are stored in, and execute from, memory  20  within the computer system  1 . The computer system  1  may be, for example, a server computer system or a client computer system maintained by a business entity such as a bank or an investment brokerage. Alternatively, computer system  1  may be a combination of two or more computer systems; for example, the application  21  might execute within a client computer system while the authentication software  22  executes within a server computer system. 
     Hence, the application  21  may be, for example, a software application for enabling bank customers or investors, respectively, to perform transactions by voice over a telephone. The application  21  receives voice input from a remote caller via a telephone line. As shown, the application  21  includes an enroller component  23  and a password control user interface (PCUI) component  24 . As will be described in detail below, the enroller  23  is used to enroll a user for password verification in accordance with the present invention, while the PCUI  24  provides an interactive audio interface with a telephone caller and coordinates the enrollment and verification processes in accordance with the present invention. These functions are performed in cooperation with functions performed by the authentication software  22 , which is described in detail below. 
     FIG. 2 is a block diagram showing the hardware components of computer system  1 , according to one embodiment. Note, however, that computer system  1  may alternatively represent multiple, physically distinct computer systems, as noted above. In the embodiment shown in FIG. 2, the computer system  1  includes a microprocessor (CPU)  10 , random access memory (RAM)  11 , read-only memory (ROM)  12 , and a mass storage device  13 , each connected to a bus system  9 . Memory  20 , in which the application  21  and the authentication software  22  reside (FIG.  2 ), may represent RAM  11 , ROM  12 , mass storage device  13 , or any combination thereof. The bus system  9  may include one or more buses connected to each other through various bridges, controllers and/or adapters, such as are well-known in the art. For example, the bus system  9  may include a main bus, or “system bus”, that is connected through an adapter to one or more expansion buses, such as a Peripheral Component Interconnect (PCI) bus. 
     Also coupled to the bus system  9  are a telephone interface  14 , a display device  15 , a number of different input devices  16  and  17 , and a data communication device  18 . The telephone interface  14  includes the hardware that connects the computer system  1  to the telephone line  8  to provide a voice interface with a telephone caller. The telephone interface  14  provides functions such as analog-to-digital (A/D) conversion, echo cancellation, and other types of signal conditioning, as well as a voice activity detector (VAD) (sometimes referred to as an “endpointer”) function for determining the temporal boundaries of a telephone caller&#39;s speech. Such devices are well-known in the art and are commercially available. 
     Mass storage device  13  may include any suitable device for storing large volumes of data, such as a magnetic disk or tape, magneto-optical (MO) storage device, or any of various types of Digital Versatile Disk (DVD) or compact disk (CD-X) storage. The display device  18  may be any suitable device for displaying alphanumeric, graphical and/or video data to a user, such as a cathode ray tube (CRT), a liquid crystal display (LCD), or the like, and associated controllers. The input devices  16  and  17  may include any of various types of input devices, such as a keyboard, and mouse, touchpad, or trackball, or a microphone for speech input. The communication device  18  may be any device suitable for or enabling the computer system  1  to communicate data with another computer system over a communication link  7 , such as a conventional telephone modem, a cable television modem, an Integrated Services Digital Network (ISDN) adapter, a Digital Subscriber Line (xDSL) adapter, a network interface card (NIC), an Ethernet adapter, or the like. Note that many variations upon the embodiment of FIG. 2 can also support the techniques described herein. 
     FIG. 3 illustrates the components of the authentication software  22 , according to one embodiment. As shown, the authentication software  22  includes a voice activity detector (VAD)  31 , a feature extractor  32 , a speech recorder  33 , a voice authenticator  39 , a speech recognizer  35 , a knowledge verifier  36 , and several databases  34 ,  37 ,  38  and  40 . The VAD  31 , which is associated with hardware in the telephone interface  14 , receives voice inputs from an incoming telephone call and provides output indicating the temporal boundaries of a caller&#39;s speech to the feature extractor  32  and the speech recorder  33 . Note that in certain embodiments, separate feature extractors may be provided to support speech recognition and verification. Thus, feature extractor  32  may represent multiple feature extractors to support various different functions. The speech recorder  33  receives the output of the VAD  31  and stores this output as waveforms in database  34 . The feature extractor  32  extracts speech features from the output of the VAD  31  using techniques which are well-known in the art of speech recognition. The output of the feature extractor  32  is provided to both the voice authenticator  39  and the speech recognizer  35 . The voice authenticator  39  accesses stored voiceprints in database  40  to determine if the voice of the current caller matches a voiceprint stored in database  40 . The output of the voice authenticator  39  is an “accept” or “reject” signal (i.e., match or no match), as appropriate, which is provided to the application  21 . The speech recognizer  35  performs speech recognition in a conventional manner based on the output of the feature extractor  32  and speech models and language models stored in databases  37  and  38 , respectively. The output of the speech recognizer  35  is provided to the knowledge verifier  36  and may be in American Standard Code for Information Interchange (ASCII) format or any other suitable format. Knowledge verifier  36  compares the content of the output of the speech recognizer  35  with a specified content, such as a stored password, and outputs an “accept” or “reject” signal to the application  21 , accordingly. 
     Voice authentication may be viewed as including two distinct phases, an enrollment phase and a verification phase. The enrollment phase is the process in which the system configures itself for a particular user (e.g. a telephone caller) for later voice authentication, including establishing a password for the user. The verification phase is the process in which the identity of a telephone caller is verified using previously established enrollment data, including verifying the password. As noted above, the verification system of the present invention implements a cognitive recall technique which enables the user to more easily remember his password. In particular, the user is allowed to create his own password prompt during an enrollment phase, which is stored and later used to prompt the user for his password during a subsequent verification phase. The user is instructed to generate the password prompt such that the password represents the correct answer or response to the password prompt. The password prompt may be in the form of a question, although that need not be the case. The password prompt further may be in the form of a complete sentence or just a phrase. 
     An example of the cognitive recall technique will now be described. When a telephone caller first contacts the computer system  1  and initiates the enrollment phase, the enroller  23  and password control UI  24  cooperate to provide an audible prompt to the caller over the telephone line, such as, “Please make up a question that the system can ask you at a later time to verify your identity.” The caller then chooses the password prompt and speaks it into the telephone. An example of a caller&#39;s password prompt might be, “What is the telephone number for Aunt Beth?” The password prompt is then recorded using speech recorder  33  or recognized using speech recognizer  35  and stored in any appropriate format. The computer system  1  then prompts the caller for the actual password by stating, for example, “Please provide the answer to the password question.” The caller then responds with the password, for example, “Area code 650, 555, 5555.” The password may be recognized using speech recognizer  35  and stored, or it may be stored in the form of one or more voiceprints in database  40 . 
     During the verification phase, the password prompt is output to the telephone caller in an appropriate manner, depending upon how it was stored during the enrollment phase (i.e., recorded as opposed to speech-recognized). If the password prompt was simply recorded, then the recording is simply played back to the telephone caller during verification. On the other hand, if the password prompt was recognized using speech recognizer  35  during enrollment, then it may be output to the telephone caller during verification using a speech synthesizer. The user&#39;s response to the password question (i.e., the password) may be evaluated by using voice authenticator  39  to compare it to previously acquired voiceprints of the user&#39;s voice or by using speech recognizer  35  in conjunction with knowledge verifier  36 . 
     Thus, the present invention provides a cognitive recall mechanism by enabling a user to choose his own password prompt as well as the corresponding password. The user may therefore select a password prompt and corresponding password that are uniquely personal. By providing this cognitive recall mechanism, the voice authentication system retains its flexibility and ease-of-use and reduces the frequency of user&#39;s forgetting their passwords. This capability therefore reduces the need for costly human intervention, which reduces costs for businesses that use a voice authentication system. 
     FIG. 4 shows a routine that may be implemented in the computer system  1  to enroll a user for voice-based password verification. In one embodiment, the routine is performed by the enroller  23  in cooperation with the PCUI  24  and the authentication software  22 . At  401 , the system prompts the caller for an ID claim. The ID claim may be, for example, the caller&#39;s assertion of his name, which may be input by his pressing keys on his telephone keypad or by simply speaking his name. If the ID claim has been received at  402 , then at  403  the caller is prompted for a PIN. The PIN may be entered in the same manner as the ID claim. If the PIN has been received at  404 , then at  405  it is determined whether the entered PIN matches the PIN for the entered ID claim. If not, an appropriate error message is output to user at  409 , and the enrollment process fails. In that case, the user may be instructed to hang up and try again or to simply re-enter the ID claim and PIN. If there is a match at  405 , then at  406  the system performs the password creation routine described above, which is also described further below. Next, at  407  the system confirms the password question and answer and, if confirmed by the caller, the password question and answer are stored in appropriate format at  408 . 
     FIG. 5 shows the password creation routine of block  406 , according to one embodiment. At  501 , the system provides appropriate instructions and prompts the caller for the password question. At  502 , the system records or recognizes the caller&#39;s response. At  503 , the system prompts the caller for the password, which, the user is instructed, should be the proper answer to the password question. At  504 , the system recognizes and stores the password using speech recognizer  35  or builds a voiceprint of the password. 
     FIG. 6 shows a password verification routine that may be implemented by the computer system  1 , according to one embodiment. The routine may be performed by the PCUI  24  in cooperation with the authentication software  22 . At  601 , the system prompts the caller for an ID claim. If an ID claim has been received at  602 , then at  603  the system loads the appropriate password question and password for the received ID claim. At  604 , the system prompts the caller with the password question; as noted above, this prompt may simply involve playback of the caller&#39; recorded voice, or it may involve the use of a speech synthesizer, which converts a text string representing the password question to synthesized speech. At  605 , the knowledge verifier  36  determines whether the content of the caller&#39;s response is correct based on input from the speech recognizer  35 . At  606 , the voice authenticator  39  verifies whether the voice of the caller is that of the person whose password has been loaded, based on stored voiceprints. If either the content is not correct or the voiceprint does not match, then the authentication software  22  outputs a “reject” signal to the application  21  at  608 . If both the content of the password response and its voiceprint are verified, then the voice authentication software  22  outputs an “accept” signal to the application  21  at  607 . The application  21  considers the identity of the caller to be verified only if an “accept” signal is received from both the knowledge verifier  36  and the voice authenticator  39 , i.e., only if both the content of the password and the voiceprint are correct. Note that in an alternative embodiment, password verification may be performed without using speech recognizer  35  and knowledge verifier  36  at block  605 ; for example, verification may be performed by evaluating only a voiceprint of the user&#39;s password response against a stored voiceprint of the password obtained during the enrollment phase. 
     Thus, a method and apparatus have been described for facilitating cognitive recall of a password in a voice authentication system. Although the present invention has been described with reference to specific exemplary embodiments, it will be evident that various modifications and changes may be made to these embodiments without departing from the broader spirit and scope of the invention as set forth in the claims. Accordingly, the specification and drawings are to be regarded in an illustrative sense rather than a restrictive sense.