Abstract:
A process for generating a number representative of an analogue data source (ADS) in which during enrolment a distinctive characteristic of the ADS is measured to obtain physical data (PD). Part of the PD is used to generate a physical value (PV) representative of the ADS. An error correction algorithm (ECA) is applied to the PV to generate error correction data (ECD), which is transformed, using another part of the PD, to generate transform data. During subsequent regeneration of the PV, the distinctive characteristic is re-measured to generate a new set of PD, and a PV is generated using the same part of the PD physical data as was used during enrolment. ECD is generated by transforming the transform data, using the same part of the PD as was used to transform the ECD during enrolment. The ECA uses the regenerated ECD to correct errors in the PV representative of the ADS.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a divisional patent application of co-pending U.S. patent application Ser. No. 10/516,173, filed on Aug. 15, 2005, which is a National Phase Application based on PCT/GB2003/002381, filed on Jun. 2, 2003, and claims the priority of International Patent Application No. PCT/GB02/02512, filed on May 31, 2002, and Great Britain Patent Application No. 0228428.9, filed on Dec. 5, 2002, and Great Britain Patent Application No. 0228434.7, filed on Dec. 5, 2002. Each patent application identified above is incorporated herein by reference in its entirety. 
     
    
     FIELD OF THE INVENTION 
       [0002]    This invention relates to the generation of a number representative of data from an analogue source. The invention has particular, but not exclusive, relevance to generating a number representative of an individual by processing biometric data obtained by measuring a distinctive characteristic of the individual. 
       BACKGROUND OF THE INVENTION 
       [0003]    Every individual has a number of distinctive characteristics (e.g. fingerprints, iris patterns and retinal patterns) having attributes which can be measured to generate biometric data representative of the individual, and these distinctive characteristics form the basis of many identification systems. Generally, during an enrolment process a reference set of biometric data is generated for an individual, and in a subsequent identification process a new set of biometric data is measured and compared with the reference set of biometric data. A positive identification is made if the new set of biometric data is sufficiently similar to, but not necessarily identical with, the reference set of biometric data. The reason why the newly measured set of biometric data need not be identical with the reference set of biometric data for a positive identification is that each time the same distinctive characteristic is measured, slightly different biometric data is generated due to the analogue nature (i.e. having values within a continuous range) of the measured attributes of the distinctive feature. 
         [0004]    A paper entitled “On the relation of error correction and cryptography to an offline biometric based identification scheme”, WCC99, Workshop on Coding and cryptography January 1999, Paris, France, describes generating a biometric value which is exactly reproducible on a regular basis by employing error detection and correction techniques. In particular, this paper describes measuring the iris of an individual during enrolment to obtain an array of binary digits (bits), and applying conventional error correction algorithms, as are commonly used in forward error correction (FEC) encoding in digital data communication, to generate corresponding check bits. During a subsequent identification, the iris of the individual is re-measured to form a new array of data bits, and then the error correction algorithm corrects the new array of data bits using the check bits generated during enrolment. A disadvantage of this system is that the check bits generated during enrolment must be stored, and could therefore be used to aid fraudulent use of the biometric value for the individual. 
       SUMMARY OF THE INVENTION 
       [0005]    An object of the present invention is to provide alternative schemes using error correction algorithms to enable a repeatable value to be derived from data obtained by measuring an analogue data source. 
         [0006]    According to an aspect of the invention, there is provided a process for generating a number representative of an analogue data source in which during enrolment a distinctive characteristic of an analogue source is measured to obtain physical data, which is separated into parts. A first part is used to generate a physical value which is representative of the analogue source. An error correction algorithm is applied to the physical value to generate error correction data, which is then transformed by a binomial mapping operation, using a second part of the physical data, to generate transform data. During subsequent regeneration of the physical value, the distinctive characteristic is re-measured to generate a new set of physical data, which is separated into parts in the same manner as during enrolment. A physical value is regenerated using a first part of the physical data in the same manner as during enrolment, and error correction data is generated by transforming the transform data, using an inverse transform to that used during enrolment, using a second part of the new set of physical data. The regenerated error correction data is then used by the error correction algorithm to correct errors in the physical value representative of the analogue source. 
         [0007]    By using part of the physical data set to transform the error correction data and then storing the resultant transform data, the security of the original physical data is improved. 
         [0008]    If the inherent randomness of the physical data is high, then in a preferred embodiment plural error correction operations are performed. In particular, during enrolment, the physical data is processed as described above to generate an intermediate data and a first set of transform data. The intermediate data is then split into two parts, the first part forming a physical value and the second part forming redundant data which is used to generate a second set of transform data. This process may continue iteratively until the repeatability of the physical value reaches an acceptable level, although each additional error correction operation reduces the size, and therefore the distinctiveness, of the final physical value. 
         [0009]    According to another aspect of the invention, there is provided a process for generating a number representative of an analogue data source in which during enrolment a distinctive characteristic of an analogue source is measured to obtain physical data having a plurality of data elements, with at least some of the data elements comprising plural binary digits. As the likelihood of errors occurring in the higher significant bits of the data elements is less than in the lower significant bits, the lower significant bits are processed using an error correction technique having a higher power of error correction than a different error correction technique which is used for the higher significant bits. In this way, the amount of error correction data required can be minimized. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0010]    Various embodiments of the invention will now be described with reference to the accompanying Figures in which: 
           [0011]      FIG. 1  schematically shows the main components of a number generation system according to the invention; 
           [0012]      FIG. 2  schematically shows the main components of a number generator and process data forming part of the number generation system illustrated in  FIG. 1 ; 
           [0013]      FIG. 3  schematically shows the main components of a source data splitter forming part of the number generator illustrated in  FIG. 2 ; 
           [0014]      FIG. 4  schematically shows the main components of an error correction data generator forming part of the number generator illustrated in  FIG. 2 ; 
           [0015]      FIG. 5  schematically shows the main components of a number regenerator forming part of the number generation system illustrated in  FIG. 1 , together with the main components of the process data; 
           [0016]      FIG. 6  schematically shows the main components of a source data splitter forming part of the number regenerator illustrated in  FIG. 5 ; 
           [0017]      FIG. 7  schematically shows the main components of an error corrector forming part of the number regenerator system illustrated in  FIG. 5 ; 
           [0018]      FIG. 8  shows the main components of a number generator which forms part of a first alternative number generation system; 
           [0019]      FIG. 9  shows the main components of a number regenerator which forms part of the first alternative number generation system; 
           [0020]      FIG. 10  shows the main components of a number generator which forms part of a second alternative number generation system; 
           [0021]      FIG. 11  shows the main components of a number. regenerator which forms part of the second alternative number generation system; and 
           [0022]      FIG. 12  shows the main components of an error corrector forming part of the number regenerator illustrated in  FIG. 11 . 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     First Embodiment 
       [0023]    Overview 
         [0024]      FIG. 1  schematically shows the main components of a system for generating a biometric number K bio  from the iris pattern of an eye  1  of a human being. As shown, an iris scanner  3  records an image of the eye  1  and outputs corresponding image data to a data formatter  5 , which configures the image data into a standard format. In this embodiment, the data formatter  5  processes the image data using the image processing techniques described in U.S. Pat. No. 5,291,560, whose full content is hereby incorporated by reference, to form an iris code comprising four thousand and ninety-two bits arranged in a five hundred and twelve by eight array. 
         [0025]    During enrolment, a switch  7  directs the iris code generated by the data formatter  5  to a biometric number generator  9 , which processes the iris code to generate a biometric number K bio  and process data  11  which is stored for use in a subsequent biometric number regeneration operation. In particular, as will be described in more detail hereafter, the biometric number generator  9  splits the iris code into two parts, uses the first part to generate the biometric number K bio  and error correction data, and uses the second part to transform the error correction data to generate transform data which is stored as part of the process data  11 . 
         [0026]    During a biometric number regeneration operation, iris scanner  3  records a new image of the eye  1 , and the data formatter  5  configures the resultant image data to produce a new iris code. The switch  7  directs the new iris code produced by the data formatter  5  to a biometric number regenerator  13  which, using the process data  11 , regenerates the biometric K bio . 
         [0027]    The operation of the biometric number generator  9  during enrolment and the biometric number regenerator  13  during the regeneration of the biometric number K bio  will now be described in more detail. 
         [0028]    Enrolment Mode 
         [0029]      FIG. 2  shows the main components of the biometric number generator  9  and the process data  11 . As shown, the number generator  9  comprises a source data splitter  21  which splits the bit stream of data from the iris code, hereafter called S-data, into two bit streams in accordance with control signals from a controller  23 . In particular, the source data splitter  21  outputs a first data bit stream conveying data, hereafter called K-data, for forming the biometric number, and a second data bit stream conveying data, hereafter called R-data, for use in the generation of the transform data. 
         [0030]    The relative proportions of S-data used for forming the K-data and the R-data are determined by the error correction algorithm applied by the biometric number generator  9 . In this embodiment, the error correction algorithm simply receives a single data bit of K-data, and outputs a corresponding codeword comprising the data bit followed by four check bits each having the same value as the received data bit. Therefore, if the error correction algorithm unit receives a data bit having a value “0”, the error correction algorithm unit outputs the codeword “00000”. This algorithm will hereafter be referred to as the repetition/voting algorithm, and is applied by a repetition/voting algorithm unit  25 . 
         [0031]    In general, any error correction algorithm receives a block of k bits of data, generates p check bits, and outputs a codeword having k+p bits. Therefore, for the repetition/voting algorithm used in this embodiment, the k value is one and the p value is four. 
         [0032]    One bit of R-data is required for each check bit in order to generate transform data. Therefore, in this embodiment only one-fifth of the S-data can be used to form K-data because the remaining four-fifths are required to form R-data. In order to ensure that the source data splitter  21  splits the S-data into K-data and R-data in the correct proportions, the controller interrogates the repetition/voting algorithm unit  25  to determine the k and p values, and sends a control signal to the source data splitter indicative of the determined k and p values. 
         [0033]    The source data splitter  21  also outputs reference map data  27 , which forms part of the process data  11 , indicating for each bit of the K-data and the R-data the location of the corresponding bit of S-data. In this way, during a subsequent number regeneration operation, it can be ensured that the same bits of S-data are used to form the K-data and the R-data as the enrolment process. 
         [0034]    As well as being output by the number generator  9  to form the biometric number K bio , the K-data bit stream is input to an error correction data generator  29 , which is connected to the repetition/voting algorithm unit  25 . In this embodiment, the error correction data generator  29  sends each bit of K-data to the repetition/voting algorithm unit  25 , extracts the check bits from the corresponding codewords returned by the repetition/voting algorithm unit  25 , and outputs the extracted check bits as a stream of error correction data, hereafter called EC-data. The EC-data bit stream output by the error correction data generator  29  and the R-data bit stream output by the source data splitter  21  are input to a transform data generator  31 , which applies a bitwise exclusive-OR operation to the EC-data bit stream and the R-data bit stream to generate transform data  33 , which forms part of the process data  11 . 
         [0035]    As an example, for a sequence “100” of K-data, the corresponding EC-data bit stream is “111100000000”. If the corresponding sequence of R-data is “101110100100”, then the resulting transform data is “010010100100”. It will be appreciated that, without knowledge of the corresponding R-data sequence, the EC-data cannot be recovered from the transform data and therefore the stored transform data  11  gives no information about the K-data which forms the biometric value K bio . 
         [0036]    The source data splitter  21  will now be described in more detail with reference to  FIG. 3 . As shown, the source data splitter  21  includes a reference word generator  41  which receives the number N of data elements in the iris code (in this embodiment four thousand and ninety-two) and the control signal from the controller  23  indicating a k value of one and a p value of 4. The reference word generator  41  then generates a reference data stream having N data elements, with each data element comprising a map code indicting the position of that data element within the reference data stream. In particular, in this embodiment the first data element of the reference data stream has a map code “0”, the second data element has a map code “1”, the third data element has a map code “2”, and so on until the final data element which has a map code “4091”. 
         [0037]    The reference word generator  41  then partitions the reference data stream into a sequence of words, each word formed by k+p consecutive data elements, and discards any data elements at the end of the data stream which are not contained in a full word. Therefore, as in this embodiment k+p equals five, the reference word generator  41  separates the four thousand and ninety-two data elements into a sequence of eight hundred and eighteen words, each including five consecutive data elements, and discards the remaining two data elements. 
         [0038]    The reference word generator  41  outputs the generated sequence of words to a data scrambler  43 , which performs a pseudo-random scrambling of the data elements (i.e. a shuffling which appears random in nature but is in fact deterministic), and the shuffled data elements are output to a reference map generator  45 , which forms a reference map indicating the position in the S-data of each bit of K-data and R-data. The reference map generator  45  receives the k and p values from the controller  23  in order to ensure that the correct amounts of S-data are apportioned to K-data and R-data. 
         [0039]    The source data splitter  21  also includes a data partitioner  47 , which receives and caches the bit stream of S-data from the data formatter  5 . The data partitioner  47  then uses the reference map generated by the reference map generator  45  for the K-data and R-data bit streams. In particular, to form the K-data bit stream the data partitioner  47  looks up in the reference map data the location of the bit of the S-data bit stream which forms the first bit of the K-data, and outputs the value of the located bit, and so on for the second and subsequent bits of the K-data bit stream. The R-data bit stream is formed by the data partitioner  47  using the reference map data in an analogous way to the K-data bit stream. Therefore, in this embodiment the data partitioner outputs a K-data bit stream comprising eight hundred and eighteen bits and a R-data bit stream comprising three thousand two hundred and seventy-two bits. 
         [0040]    As stated previously, the data formatter  5  stores the iris code in the form of a bit array having eight rows and five hundred and twelve columns. Although there is a high level of randomness to the values of the bit array, in this embodiment the data in each column, which corresponds to a radial direction of the iris, shows a level of order. The data formatter  5  outputs the iris code column by column, and therefore neighboring bits of the S-data bit stream show some measure of correlation. However, the pseudo-random scrambling performed by the data scrambler  43  disperses the data elements in each column and therefore increases the randomness of the K-data and R-data bit streams. A further advantage of dispersing the data elements in each column is that if there is a localized group of errors in the iris code, then it is easier to correct the group of errors after dispersion. 
         [0041]    In this embodiment, the data scrambler  43  performs two data scrambling operations. Firstly, the data scrambler  43  shuffles the words received by the reference word generator  41 . The data scrambler  43  then forms an array by sequentially stacking the shuffled words. Therefore, in this embodiment, the array is formed by eight hundred and eighteen rows each having five data elements. The data scrambler  43  then performs a rotational shifting operation of the data elements in each column. In this embodiment, in the rotational shifting operation: the data elements of the first column remain in the same locations within the array; the data elements of the second column are shifted down the column one hundred and sixty-four places (i.e. are shifted by approximately one fifth of the size of the column) so that the first data element in the column becomes the one hundred and sixty-fifth data element in the column, and the bottom one hundred and sixty-four data element are shifted to the top of to column; in the same manner, the data elements of the third, fourth and fifth columns are shifted by three hundred and twenty-eight, four hundred and ninety-two and six hundred and fifty-six places respectively. 
         [0042]    The data scrambler  43  outputs the array formed by the shuffling operation to the reference map generator  45 , which separates the first k columns (i.e. in this embodiment the first column) to provide the locations of the data elements in the S-data bit stream to form the K-data bit stream, and then uses the remaining p columns to provide the locations of the data elements in the S-data bit stream to form the R-data bit stream. 
         [0043]    The error correction data generator  29  will now be described in more detail with reference to  FIG. 4 . As shown, the K-data bit stream is input to a data block generator  51 , together with a control signal from the controller  23  indicating the value of the number k of data bits to be included in each block of data bits sent to the repetition/voting algorithm unit  25 . The data block generator  51  partitions the K-data bit stream into a sequence of data blocks having k (i.e. in this embodiment one) bit, and outputs the sequence of data blocks to a data block transmitter  53 , which sequentially transmits the data blocks to the repetition/voting algorithm unit  25 . For each data block transmitted, the repetition/voting algorithm unit  25  returns a codeword comprising the k data bits and p check bits. Each codeword is received by a codeword receiver  55 , which forwards each received codeword to a check bits pass filter  57  which removes the k data bits and outputs the p check bits to form the EC-data bit stream. 
         [0044]    Regeneration Mode 
         [0045]      FIG. 5  schematically shows the main components of the biometric number regenerator  13 . As described previously, during regeneration a new image is formed of the eye  1  and the corresponding image data processed by the data formatter  5  to form a new iris code. As shown, a S′-data bit stream output by the data formatter  5  during enrolment is input to a source data splitter  61 , which splits the S′-data bit stream into a K′-data bit stream and a R′-data bit stream in accordance with a control signal from a controller  63  and using the reference map data  27  forming part of the process data  11  generated during enrolment. The control signal from the controller  63  conveys the values of k and p associated with a repetition/voting error correction algorithm unit  65  (i.e. a k value of one and a p value of four), which is connected to the controller  63 . 
         [0046]    The K′-data bit stream and the R′-data bit stream are input to an error corrector  67  and an error correction data generator  69  respectively. The error correction data generator  69  applies a bitwise exclusive-OR operation to the R′-data bit stream and the transform data  33  generated during enrolment, to form an EC′-data bit stream, which is input to the error corrector  67 . The error corrector  67  forms a sequence of codewords using the K′-data bit stream and the EC′-data bit stream and outputs each codeword to the repetition/voting algorithm unit  65 . In this embodiment, each codeword is formed by one bit from the K′-data bit stream followed by four bits from the EC′-data bit stream. For each received codeword, the repetition/voting algorithm unit  65  performs a voting operation to determine which bit value appears more often (hereafter called the majority bit value), converts all of the bits of the codeword to the determined majority bit value to form a converted codeword, and outputs the converted codeword. 
         [0047]    For example, as described above if during enrolment the K-data bit stream has a sequence  100  and the corresponding sequence of the R-data bit stream is “101110100100”, then the stored transform data is “010010100100”. In a subsequent regeneration operation, the generated K′-data and R′-data bit streams normally exhibit a number of differences from those generated during enrolment, and a typical example of corresponding bit sequences for the K′-bit stream and the R′-bit stream would be “ 101 ” and “100110001100” respectively. The error correction data generator  69  applies a bitwise exclusive-OR operation on the R′-data bit stream and the corresponding stored transform data to generate the EC′-data sequence “110100101000”. 
         [0048]    The error corrector  67  combines each bit of the K′-data bit sequence with the corresponding four bits of the EC′-data bit stream to form the following three codewords:
       codeword 1—11101   codeword 2—00010   codeword 3—11000       
 
         [0052]    The codewords are then sequentially sent to the repetition/voting algorithm unit  65 , which sets all the bits of each codeword to the majority bit value for the codeword, and returns the corrected codewords:
       corrected codeword 1 11111   corrected codeword 2 00000   corrected codeword 3 00000       
 
         [0056]    From the corrected codewords, the error corrector  67  retrieves the data bits to form the corrected K′-data bit sequence “100”, which is identical with the corresponding K-bit sequence generated during enrolment. 
         [0057]      FIG. 6  shows the main components of the source data splitter  61 . The control signal from the controller  63  indicating the values of k and p, which as described above are one and four respectively in this embodiment, are input to a reference map generator  75  together with the reference map data  27 . The reference map generator  75  generates a reference map indicating for each bit of the K′-data and R′-data bit streams the location of the corresponding bit of the S′-data bit stream. 
         [0058]    The S′-data bit stream is input to a data partitioner  77  which caches the S′-data bit stream, and then outputs the K′-data bit stream and the R′-data bit stream using the reference map provided by the reference map generator  75 . In particular, for each bit of the K′-data and the R′-data bit streams, the data partitioner  77  identifies and outputs the corresponding bit of the S′-data bit stream using the reference map. 
         [0059]      FIG. 7  shows the main components of the error corrector  67 . As shown the K′-data bit stream is input to a data bits block generator  81  which groups the K′-data into blocks of k bits, the value of k being provided by a control signal from the controller  63 . Similarly, the EC′-data is input to a error correction bits block generator  83  which groups the EC′-data into blocks of p bits, with the value of p being provided by a control signal from the controller  63 . The data bit blocks and the error correction bits blocks are sequentially input to a codeword generator  85 , which concatenates each data bit block with the corresponding error correction bit block to form a codeword. 
         [0060]    The codeword generator  85  sequentially outputs the generated codewords to a codeword transmitter  87 , which transmits each codeword to the repetition/voting algorithm unit  65 . The corrected codewords produced by the repetition/voting algorithm unit  65  are received by a corrected codeword receiver  89  and forwarded to a data bits pass filter  91 , which removes the check bits of the codeword and outputs the corrected data bits to form the biometric number K bio . 
       Second Embodiment 
       [0061]    Overview 
         [0062]    In the first embodiment, the iris code from the data formatter  5  is split into two parts. During enrolment, the first part is used to generate a biometric number K bio  and associated error correction data, and the second part is used to transform the error correction data to form transform data. During biometric number regeneration, the first part of the iris code is used to regenerate the biometric number, and the second part is used to revert the transform data back to error correction data. The error correction data is then used to correct errors in the regenerated biometric number. 
         [0063]    The generated biometric number K bio  has eight hundred and eighteen bits. With this size of biometric number, there may still be a significant possibility of errors in one or more of the bits. A second embodiment will now be described, with reference to  FIGS. 8 and 9 , in which two passes of error correction are performed to reduce the likelihood of error in the biometric number K bio . In  FIGS. 8 and 9 , components which are identical to corresponding components of the first embodiment have been referenced by the same numerals and will not be described in detail again. 
         [0064]    Enrolment Mode 
         [0065]      FIG. 8  schematically shows the main components of a number generator  101  of the second embodiment, which during enrolment receives S-data from a data formatter which is identical to the data formatter of the first embodiment. The S-data is input to a source data splitter  21 , which is identical to the source data splitter  21  of the first embodiment. In this embodiment, the first pass of error correction uses a repetition/voting algorithm unit  25  which applies the same repetition/voting algorithm as described in the first embodiment. A controller  103  interrogates the repetition/voting algorithm unit  25  to determine the associated k value and p value, and sends a control signal to the source data splitter  21  indicated the determined k and p values. Therefore, in this embodiment the control signal received by the source data splitter  21  indicates that the value of k is one and the value of p is four. 
         [0066]    The source data splitter  21  outputs a K 1 -data stream and a R 1 -data stream, together with reference map data  27  which forms part of process data  105 , in the same manner as described in the first embodiment. The K 1 -data stream output by the source data splitter  21  is processed by the first error correction data generator  29   a , using the repetition/voting algorithm unit  25 , in the same manner as described in the first embodiment to generate an EC 1 -data stream. The R 1 -data stream and the EC 1 -data stream are then input into a first transform data generator  31   a , which performs an exclusive-OR operation to generate a first set of transform data  33  which is stored as part of the process data  105 . 
         [0067]    In this embodiment, the eight hundred and eighteen bits of K 1 -data form intermediate source data which is processed in a similar manner to the S-data to generate the biometric number K bio  and a second set of transform data  105 . In this embodiment, a Golay (23,12) error correction algorithm, which is a conventional error correction algorithm used for FEC encoding in digital data communications is used during the processing of the K r data. For the Golay (23,12) error correction algorithm, a block of twelve data bits are processed to generate a block of eleven check bits, and the data bits and check bits are then combined to form a twenty-three bit codeword. Therefore, for the Golay (23,12) algorithm the value of k is twelve and the value of p is eleven. 
         [0068]    The Golay (23,12) error correction algorithm is applied by a Golay (23,12) algorithm unit  109 , and the controller interrogates the Golay (23,12) algorithm unit  109  to determined the k value of twelve and the p value of eleven. As shown in  FIG. 8 , the K 1 -data bit stream is input to a data splitter  107  together with a control signal from the controller  103  indicating the determined k and p values for the Golay (23,12) algorithm unit. The data splitter  107  partitions the K 1 -data bit stream into blocks of twenty-three bits, and for each block outputs the first twelve bits as a sequence of a K 2 -data bit stream and the remaining eleven bits as a sequence of a R 2 -data bit stream. In this way, the eight hundred and eighteen bits of K 1 -data form a four hundred and twenty bit sequence of K 2 -data, which forms the biometric number K bio , and a three hundred and eighty-five bit sequence of R 2 -data. The final eighteen bits of K 1 -data are discarded. 
         [0069]    The K 2 -data bit stream is input to a second error correction data generator  29   b , together with a third control signal from the controller  103  conveying a k value of eleven and a p value of twelve. The second error correction data generator  29   b  is functionally identical to the error correction data generator of the first embodiment. In particular, in accordance with the control signal from the controller  103 , the second error correction data generator  29   b  partitions the K 2 -data bit stream into blocks of twelve data bits and sends each block to the Golay (23,12) algorithm unit  109 , which applies the Golay (23,12) algorithm to generate a twenty-three bit codeword comprising the twelve data bits and eleven check bits. The Golay (23,12) algorithm unit  109  outputs each codeword to the second error correction data generator  29   b , which extracts the check bits from each codeword and outputs the extracted check bits as an EC 2 -data bit stream. 
         [0070]    The EC 2 -data stream is input, together with the R 2 -data bit stream, to a second transform generator  31   b  which applies a bitwise exclusive-OR operation to the EC 2 -data bit stream and the R 2 -bit stream to form second transform data  111 , which is stored as part of the process data  105 . 
         [0071]    Regeneration Mode 
         [0072]      FIG. 9  schematically shows the main components of the number regenerator  121  of this embodiment. The S′-data from the data formatter  5  is input to a source data splitter  61 , which is identical to the source data splitter of the number regenerator of the first embodiment. A controller  123  interrogates a repetition/voting algorithm unit  65  to determine the associated k and p values, and outputs a control signal to the data splitter  61  indicating a k value of one and a p value of 4. The source data splitter  61  converts the S′-data into a K 1 ′-data bit stream and a R 1 ′-data bit stream in accordance with the control signal from the controller  123 , using the reference map  27  in the process data  105  generated during enrolment. 
         [0073]    The R 1 ′-data bit stream is input, together with the first set of transform data  33  of the process data  105  generated during enrolment, to a first error correction data generator  69   a , which applies a bitwise exclusive-OR operation to generate an EC 1 ′-data bit stream. The K 1 ′-data and the EC 1 ′-data bit streams are input to an error corrector  67   a  which, in the same manner as in the first embodiment, outputs a corrected K 1 ′-data bit stream using the repetition/voting algorithm unit  65 , which applies the same repetition/voting error correction algorithm as the first embodiment. 
         [0074]    The eight hundred and eighteen bits of the corrected K 1 ′-data bit stream forms intermediate source data which is processed using a Golay (23,12) algorithm unit  127 . The controller  123  interrogates the Golay (23,12) algorithm unit  127  and determines the associated k value of twelve and p value of eleven. 
         [0075]    The K 1 ′-data bit stream is input to a data splitter  125  together with a control signal from the controller  123  indicating a k value of twelve and a p value of eleven. The data splitter  125  partitions the K 1 ′-data into a sequence of thirty five blocks of twenty-three bits, sequentially outputs the first twelve bits of each block as a K 2 ′-data bit stream, and sequentially outputs the remaining eleven bits of each block as a R 2 ′-data bit stream. The R 2 ′-data bit stream is input to a second error correction data generator  69   b , together with the second set of transform data  111  stored in the process data  105  during enrolment. The second error correction data generator  69   b  applies a bitwise exclusive-OR operation to the R 2 ′-data bit stream and the second set of transform data  111  to form an EC 2 ′-data bit stream, which is input to a second error corrector  67   b  together with the K 2 ′-data bit stream. 
         [0076]    The second error corrector  67   b  is functionally identical to the first error corrector  67   a , and receives a control signal from the controller  123  indicating a k value of twelve and a p value of eleven. Accordingly, the second error corrector  67   b  partitions the K 2 ′-data into blocks of twelve bits and the EC 2 ′-data into blocks of eleven bits, and combines each block of K 2 ′-data with a corresponding block of EC 2 ′-data to form a codeword. The second error corrector  67   b  then sequentially transmits the codewords to the Golay (23,12) algorithm unit  127 , which applies the Golay (23,12) error correction algorithm on each received codeword to generate a corrected codeword which is transmitted back to the error corrector  67   b . As each corrected codeword is received, the second error corrector  67   b  extracts the data bits and outputs the extracted data bits to form the biometric number K bio . 
         [0077]    As described above, in the second embodiment a second pass of error correction is applied to improve the repeatability of the biometric number K bio , at the expense of reducing the number of bits of the biometric number K bio  because a larger proportion of the original S-data is effectively used to provide transform data for encoding the error correction data. 
       Third Embodiment 
       [0078]    Overview 
         [0079]    In the first and second embodiments, an iris code is formed by the data formatter  5  having four thousand and ninety-two data elements, with each data element comprising a single bit. An alternative type data formatter is described in International Patent Application WO 02/098053, the whole content of which is incorporated herein by reference. In particular, WO 02/098053 describes a feature template generator which extracts plural features from an image of an iris, with each feature having one or more attributes, and an attribute value stabilizer which uses data stored during enrolment to stabilize the respective values of the attributes. The resultant feature template is a forty-five by eighteen array of data elements, with each data element having a multi-bit value. 
         [0080]    A third embodiment will now be described, with reference to  FIGS. 10 to 12 , in which the image data of the eye of an individual is configured by a data formatter as described in WO  02 / 098053  to produce a forty-five by eighteen array of data elements, with each data element having a multi-bit value. In  FIGS. 10 to 12 , components which are identical to corresponding components of the first embodiment have been referenced by the same reference numerals and will not be described in detail again. 
         [0081]    A consequence of the multi-bit nature of the data elements is that there is a greater likelihood of an error in the lower significant bits than the higher significant bits. Therefore, in this embodiment the lower significant bits and the higher significant bits are processed using different error correction algorithms with the aim of reducing the amount of error correction data required to achieve a desired level of repeatability. 
         [0082]    Enrolment Mode 
         [0083]      FIG. 10  schematically illustrates the main components of a number generator  141  which in this embodiment processes the data array produced by the data formatter to generate a biometric number K bio  and process data  143  for use in a subsequent number regeneration operation. 
         [0084]    The data from the data formatter is input to a data element splitter  145 , which for each data element directs the least significant bit of the associated value to a LSB data array  147  and directs the next least significant bit of the associated value to a HSB data array  149 . In this embodiment, any bits of the value of a data element above the second least significant bit are discarded. Both of the LSB data array  147  and the HSB data array  149  are therefore in the format of a forty-five by eighteen array of data elements with each data element comprising a single data bit. 
         [0085]    In this embodiment, error correction data for the LSB data array  147  and the HSB data array  149  are processed separately using different error correction algorithms. In particular, the LSB data array  147  is processed using the repetition/voting error correction algorithm, and the HSB data array is processed using the Golay (23,12) error correction algorithm. As shown, a first switch  151   a  is positioned with the LSB data array  147  and the HSB data array  149  on one side of the first switch  151   a , and a source data splitter  21  which is identical to the source data splitter of the first embodiment on the other side of the first switch  151   a . Further, a second switch  151   b  is positioned with an error correction data generator  29  on one side of the second switch  151   b , and a repetition/voting error correction algorithm unit  25  and a Golay (23,12) error correction algorithm unit  109  on the other side of the second switch  151   b.    
         [0086]    Firstly, a controller  153  outputs control signals to set the first switch  151   a  so that the LSB data array  147  is connected to the source data splitter  21 , and to set the second switch  151   b  so that the error correction data generator  29  is connected to the repetition/voting error correction algorithm unit  25 . The controller  153  also extracts the k value of one and the p value of four from the repetition/voting algorithm unit  25 , and sends corresponding control signals to the source data splitter  21  and the error correction data generator  29 . 
         [0087]    In the same manner as the first embodiment, the source data splitter  21  separates the eight hundred and ten data bits from the LSB-data array  147  into one hundred and sixty-two K L -data bits and six hundred and forty-eight R L -data bits in accordance with a generated LSB reference map, and stores LSB reference map data  155   a  as part of the process data  143 . The K L -data bit stream is output to form part of the biometric number K bio , and is also input to the error correction data generator  29  which generates an EC L -data bit stream using the repetition/voting algorithm unit  25  as described in the first embodiment. The EC L -data bit stream is input, together with the R L -data bit stream, to a transform data generator  31  which performs a bitwise exclusive-OR operation to generate six hundred and forty eight bits of LSB transform data  157   a  which are stored as part of the process data  147 . 
         [0088]    After the LSB data array  147  has been processed, the controller  153  switches the first switch  151   a  and the second switch  151   b  so that the HSB data array  149  is connected to the source data splitter  21  and the error correction data generator  29  is connected to the Golay (23,12) algorithm unit  109 . The controller  153  also extracts the k value of twelve and the p value of eleven from the Golay (23,12) algorithm unit, and sends corresponding control signals to the source data splitter  21  and the error correction data generator  29 . 
         [0089]    The source data splitter  21  separates the eight hundred and ten data bits from the HSB-data array  149  into four hundred and twenty K H -data bits and three hundred and eighty-five R H -data bits (the remaining five data bits being discarded) according to a generated HSB reference map, and stores HSB reference map data  155   b  as part of the process data  143 . The K H -data bit stream is output to form the remainder of the biometric number K bio , and is also input to the error correction data generator  29 , which generates an EC H -data bit stream using the Golay (23,12) algorithm unit  109 . The error correction data generator  29  outputs an EC H -data bit stream which is input, together with the R H -data bit stream, to the transform data generator  31 , which performs a bitwise exclusive-OR operation to generate three hundred and eighty-five bits of HSB transform data  157   b  which are stored as part of the process data  143 . 
         [0090]    As described above, due to the lower likelihood of errors arising in the HSB data array  149  than in the LSB data array  147  during a subsequent number regeneration, the proportion of the data bits of the HSB data array  149  used to generate transform data is less than for the LSB data array  147 . 
         [0091]    Regeneration Mode 
         [0092]      FIG. 11  schematically shows the main components of a number regenerator  161  which is used to regenerate the biometric number K bio  using the process data  143  generated during enrolment, from a data array produced by the data formatter from a scan of the eye of the individual. 
         [0093]    In the same way as during enrolment, the data from the data formatter is input to a data element separator  145 , which directs the lowest significant bit of each data element to a LSB data array  147 , directs the next lowest significant bit to a HSB data array  149 , and discards any remaining bits. As shown, a first switch  163   a  is positioned with the LSB data array  147  and the HSB data array  149  on one side, and a source data splitter  61  (which is identical to the source data splitter of the number regenerator of the first embodiment) on the other side. Further, a second switch  163   b  is positioned with an error corrector  165  on one side, and a repetition/voting error correction algorithm unit  65  and a Golay (23,12) error correction algorithm unit  127  on the other side. 
         [0094]    Firstly, a controller  167  outputs control signals to set the first switch  163   a  so that the LSB data array  147  is connected to the source data splitter  21 , and to set the second switch  163   b  so that the error corrector  29  is connected to the repetition/voting error correction algorithm unit  25 . The controller  153  also extracts a k value of one and the p value of four from the repetition/voting algorithm unit  25 , and sends corresponding control signals to the source data splitter  21  and the error corrector  165 . 
         [0095]    The source data splitter  61  separates the eight hundred and ten data bits from the LSB-data array  147  into one hundred and sixty-two K L ′-data bits and six hundred and forty-eight RC-data bits in accordance with the LSB reference map data  155   a  stored in the process data  143 . The K L ′-data bit stream and the R 1 ′-data bit stream are input to the error corrector  165  and an error correction data generator  69  respectively. The error correction data generator  69  applies a bitwise exclusive-OR operation to the RC-data bit stream and the LSB transform data  157   a  from the process data  143  generated during enrolment to generate an EC L ′-data bit stream which is input to the error corrector  165 . 
         [0096]    The error corrector  165  forms a sequence of codewords using the K L ′-data bit stream and the EC L ′-data bit stream and outputs corresponding codewords to the repetition/voting algorithm unit  65 . When processing the LSB data array  147 , each codeword is formed by one bit from the K L ′-data bit stream followed by four bits from the EC L ′-data bit stream. For each received codeword, the repetition/voting algorithm unit  65  generates and outputs a corrected codeword. The error corrector  165  sequentially receives the corrected codewords, removes the check bits, and outputs the remaining data bits to form part of the biometric number K bio . As will be described in more detail hereafter, the error corrector  165  also compares each original codeword output to the repetition/voting algorithm unit  65  with the returned corrected codeword, and identifies which data bits have been changed. This information is subsequently used in the processing of the HSB data array  149 . 
         [0097]    After all the data bits of the LSB data array  147  have been processed, the controller  167  outputs control signals setting the first switch  163   a  to connect the HSB data array  149  and the source data splitter  21  and the second switch  163   b  to connect the error corrector  165  and the Golay (23,12) algorithm unit  127 . The controller  163  also interrogates the Golay (23,12) algorithm unit  127  to recover the k value of eleven and the p value of twelve, and sends corresponding control signals to the source data splitter  61  and the error corrector  165 . 
         [0098]    The source data splitter  61  separates the eight hundred and ten data bits from the HSB-data array  147  into four hundred and twenty K H ′-data bits and three hundred and eighty-five R H ′-data bits in accordance with the HSB reference map data  155   b  stored in the process data  143 . The K H ′-data bit stream and the R H ′-data bit stream are input to the error corrector  165  and the error correction data generator  69  respectively. The error correction data generator  69  applies a bitwise exclusive-OR operation to the R H ′-data bit stream and the HSB transform data  157   b  from the process data  143  generated during enrolment to generate an EC H ′-data bit stream which is input to the error corrector  165 . 
         [0099]    The error corrector  165  forms a sequence of codewords using the K H ′-data bit stream and the EC H ′-data bit stream and outputs corresponding codewords to the Golay (23,12) algorithm unit  127 . When processing the HSB data array  149 , each codeword is formed by twelve bits from the K H ′-data bit stream followed by eleven bits from the EC H ′-data bit stream. For each received codeword, the Golay (23,12) algorithm unit  127  generates and outputs a corrected codeword. The error corrector  165  receives the corrected codewords, and uses the corrected codewords to form the remaining bits of the biometric number K bio . 
         [0100]    The operation of the error corrector  165  will now be described in more detail with reference to  FIG. 12 . In this embodiment, the error corrector  165  includes a suspect data elements identifier  171  which during the processing of the LSB data array  147  identifies the data bits whose values are corrected by the repetition/voting algorithm unit  25 . If the lowest significant bit of a data element is incorrect, then there is a higher likelihood that the next lowest significant bit of that data element is also incorrect. The knowledge of the position of these suspect data elements is used during the processing of the HSB data array  149 . This allows a reduced amount of error correction data to be generated and stored during enrolment, and consequently allows the biometric number K bio  to have an increased number of bits. 
         [0101]    During processing of the LSB data array  147 , the K L ′-data bit stream is input to a data bits block generator  173  which, in accordance with a control signal from the controller  167  indicating a k value of one, outputs the K L ′-data in blocks of one data bit to a codeword generator  85 . The EC L ′-data is input to a check bits block generator  175  which, in accordance with a control signal from the controller  167  indicating a p value of four, outputs the R L ′-data to the codeword generator  85  in blocks of four check bits. The codeword generator  85  forms a codeword by concatenating each data bit with the corresponding block of four check bits, and outputs the generated codeword to a codeword transmitter  87  and to the suspect data elements identifier  171 . The codeword transmitter  87  outputs each generated codeword to the repetition/voting algorithm unit  65 , and a corrected codeword receiver  89  receives a returned corrected codeword. Each received corrected codeword is input to the suspect data elements identifier  171  and to a codeword selector  177 , which during processing of the LSB data array  147  simply transmits each corrected codeword to a data bits pass filter  91  which removes the check bits and outputs the remaining data bits to form part of the biometric number K bio . 
         [0102]    During processing of the LSB data array  147 , each codeword is compared to the corresponding corrected codeword by the suspect data elements identifier  171  to identify which bits have been corrected. For each corrected bit identified, the suspect data elements identifier  171  identifies the corresponding data element of the LSB data array  147  using the LSB reference map data  155   a , then identifies the location of the bit of the K H ′-data or EC H ′-data which corresponds to the identified data element using the HSB reference map data  155   b , and then tags that data bit location as a suspect data bit. 
         [0103]    During processing of the HSB data array  149 , the K H ′-data bit stream is input to a data bits block generator  173  which, in accordance with a control signal from the controller  167  indicating a k value of twelve, partitions the K H ′-data into blocks of twelve data bits. Similarly, the EC H ′-data bit stream is input to a check bits block generator  175  which, in accordance with a control signal from the controller  167  indicating a p value of eleven, partitions the EC H ′-data into blocks of eleven bits. 
         [0104]    For each block of K H ′-data and corresponding block of EC H ′-data, the suspect data elements identifier  171  determines the total number S of suspect bits. The suspect data elements identifier  171  then controls the data bits block generator  173  and the check bits block generator  175  to output data bit blocks and check bit blocks so that the codeword generator  85  outputs test codewords with every possible combination of values of the suspect bits, so that the codeword generator  85  generates 2.sup.s different test codewords. The generated test codewords are input to the codeword transmitter  87 , and the 2.sup.s corrected test codewords received from the Golay (23,12) algorithm unit  109  are input to the codeword selector  177 , which compares the 2.sup.s corrected codewords and outputs the codeword which appears most frequently to the data bits pass filter  91  which removes the check bits and outputs the remaining data bits to form part of the biometric number K bio . 
         [0105]    For example, if a data bits block and a check bits block contain between them three suspect bits, then eight (i.e. 2.sup.$) test codewords are generated, with the values of the suspect bits in the eight test codewords being assigned the values 0-0-0, 0-0-1, 0-1-0, 0-1-1, 1-0-0, 1-0-1, 1-1-0 and 1-1-1 respectively. The Golay (23,12) algorithm is able to correct three incorrect data bits and therefore, if the only differences between the test codewords and the corresponding original codeword generated during enrolment are in the suspect data bits, the Golay (23,12) algorithm unit  109  corrects all the differences and returns eight identical corrected code words. If, however, in the eight test codewords one of the bits other than the suspect bits is different from the corresponding bit of the corresponding original codeword, then four of the corrected codewords are identical, corresponding to the four of the test codewords in which two or three of the suspect bits have been assigned the correct value, with the remaining four corrected codewords generally having differing values. The codeword selector  177  then identifies the value of the four identical codewords, and outputs the identified value. 
         [0106]    It will be noted that in the above example, although the Golay (23,12) algorithm is only able to correct three errors, potentially four errors were corrected (i.e. if all the received suspect data bits were incorrect). This is possible because of the processing of the LSB data array  147  provides additional information concerning the locations of possible errors. 
       Modifications and Further Embodiments 
       [0107]    In the third embodiment, during number regeneration the suspect data elements identifier generates a fault map identifying data elements of the source data which contain errors in the lowest significant bit. This fault map is used in the third embodiment during the processing of higher significant bits of the suspect data elements in order to allow a reduced amount of error correction data to be used. Such a fault map could be used in a number of other ways to improve the reliability of number regeneration. 
         [0108]    If the fault map indicates a cluster of errors associated with a common portion of the iris, then this may indicate that the recorded image of that portion of the iris is unsound, for example due to reflected light or by being obscured by eyelids or eyelashes. In an alternative embodiment, if the fault map does indicate such a cluster of errors, then the suspect data elements identifier tags all the data elements associated with the corresponding portion of the iris, even those whose values were not corrected, suspect. The number regenerator then re-processes the lowest significant bit data, and in the same manner as the third embodiment process the suspect data bits by creating multiple test codewords containing all possible combinations of values of the suspect bits, applying the error correction algorithm to all the test codewords, and selecting from the resulting corrected codewords the value which appears most frequently. In this way, the amount of error correction data needed to process the LSB data is reduced. It will be appreciated that such an arrangement may be applied to systems in which the data formatter configures the image data into data elements each having a single data bit, as in the first and second embodiments. 
         [0109]    In another alternative embodiment, if the fault map indicates a cluster of errors corresponding to a common portion of the iris, then the number regenerator outputs a signal requesting that the eye is imaged again to generate new S-data. Preferably, the eye is imaged to provide replacement image data for just the suspect image portions, as the other image portions have already been judged sound. 
         [0110]    The faults identified in the fault map could arise from a number of sources. As described above, the faults could be caused by a region of the iris being obscured during an image capture. Alternatively the faults could be caused by random measurement error. In both of these cases, the location of the faults on the fault map should vary in a random manner. Another source for the faults in the fault map is systemic error, and such faults are characterized by appearing in the same place within the fault map with high regularity. 
         [0111]    In an embodiment, fault maps for a plurality of number regeneration operations are stored and compared to identify regularly occurring faults indicating systemic error. Preferably the fault maps are stored in an encrypted format. Further, in a preferred embodiment the biometric number K bio  is used as the cryptographic key of a symmetric encryption algorithm which is used to encrypt the fault maps. 
         [0112]    If stored fault maps do indicate systemic error, then this information can be exploited in a number of ways to improve performance of the number generation system. In one embodiment, data elements within the source data which are affected by systemic error are identified from the fault maps, and are labeled as suspect. The processing of the suspect data elements is then performed as described above. In an alternative embodiment, additional transform data is used to transform the data elements exhibiting systemic error back to their enrolment values. In another alternative embodiment, if the stored fault maps indicate systemic error, then a new enrolment process is performed. 
         [0113]    In the third embodiment, the S-data comprises a plurality of data elements with each data element having a multi-bit value. The lowest significant bits of the data elements are initially processed, and suspect data elements identified. In this way, the error correction of the higher significant bit can be made more efficient. It will be appreciated that the same technique can be applied to data which is not in binary format. It will also be appreciated that instead of processing only the least significant bit and the secondly significant bit of each data element, alternatively, other combinations of significant bits of the data element could be processed. For example, if each data element has a four bit value, of which the least significant bit is found to vary randomly between captures of source data, then the least significant can be discarded and the biometric number generated using the second and third least significant bits. 
         [0114]    It will be appreciated that more than two bits of a multi-bit data element can be processed to generate the repeatable number. In general, the lowest significant bits are first processed and a first fault map generated, the second least significant bits are then processed using the first fault map and a second fault map generated indicating errors in the second significant bits, the third significant bits are then processed using the second fault map and a third fault map generated indicating errors in the third significant bit, and so on to the most significant bit which is processed. 
         [0115]    In the second embodiment, the first pass of error correction is performed using a repetition/voting algorithm. This is generally preferred because the repetition/voting algorithm allows correction of a comparatively large number of errors, albeit at the expense of requiring a large amount of error correction data. A feature of the repetition/voting algorithm used is that each codeword includes a single data bit. This allows the K 1 -data from the first pass of error correction to be separated into K 2 -data and R 2 -data without any data shuffling, because typically any errors in the K 1 -data are randomly distributed. 
         [0116]    A feature that is common to most error correction algorithms is that if the codeword contains more errors than the algorithm can correct, then the codeword generated by applying the algorithm includes at least as many errors as the original codeword. For example, if four errors are present in a twenty-three bit codeword for the Golay (23,12) algorithm, then the resultant codeword contains more than four errors. Such a concentration of errors is unlikely to be correctable in a second pass of error correction. 
         [0117]    In an alternative to the second embodiment, the Golay (23,12) algorithm is used to perform the first pass of error correction, and the BCH (32,21) algorithm is used for the second pass of error correction. In the number generator of this alternative embodiment, the data splitter  107  of the number generator is replaced by a data splitter functionally identical to the source data splitter of the number generator of the first embodiment. The source data splitter shuffles the data bits of the K 1 -data bit stream and stores corresponding reference map data. The data splitter of the number regenerator is replaced by a source data splitter which is functionally identical to the source data splitter of the number regenerator of the first embodiment. The source data splitter uses the stored reference map data to shuffle the data bits of the K 1 ′-data bit stream in the same manner as the data bits of the K 1 -data bit stream were shuffled during enrolment. In this way, errors in the K 1 -data bit stream are dispersed. 
         [0118]    In the second embodiment, the K 1 -data effectively forms a first biometric number representative of the iris and the K 2 -data forms a second biometric number representative of the iris, with the second biometric number having a higher repeatability but less binary digits. In an alternative embodiment, the K 2 -data is split into K 3 -data and R 3 -data, the K 3 -data being used to form a third biometric number representative of the iris and the R 3 -data being used to form redundant data for mapping error correction data corresponding to the third biometric number. In this way, three passes of error correction are performed. It will be appreciated that the only limit to the number of error correction passes performed is the amount of the original source data, as with each pass of error correction the resulting biometric number will have less binary digits. 
         [0119]    It will be appreciated that the multiple pass error correction technique of the second embodiment could also be applied to the multi-bit processing of the third embodiment. In particular, the biometric number generated from the LSB-data and/or the HSB-data could be split into new K-data and R-data for another pass of error correction. It will be appreciated that when multiple passes of error correction are performed, the same error correction algorithm could be used for each pass of error correction, or alternatively different error correction algorithms could be used for different passes of error correction. 
         [0120]    In the illustrated embodiments, during enrolment a transform data generator applies a bitwise exclusive-OR operation to a stream of error correction data and a stream of redundant data (i.e., the R-data) to generate transform data, and during number regeneration an error correction data generator applies to bitwise exclusive-OR operation to a stream of redundant data (i.e. the R′-data) and the stored transform data to recover the error correction data. Alternative mapping operations could be performed to map between the error correction data and the transform data using redundant data without the transform data providing information on the biometric number K bio . For example, a simple addition operation could be performed on the error correction data and the redundant data during enrolment, and a simple subtraction operation performed on the transform data and the redundant data during number regeneration. Such mapping operations are generically termed binomial mapping operations. 
         [0121]    Generally, the redundant data and the error correction data is formed by a random distribution of approximately equal numbers of bits having a value “1” and bits having a value “0”, in which case the randomness of the redundant data and error correction data is optimal. In some occasions, however, this may not be the case. For example, if the highest significant bit of a data element having multiple significant bits is processed, then it is possible that the majority of the redundant data will have a value “0”. If this coincides with error correction data which predominantly has the value “0”, then to improve security of the K-data and R-data the transform data may be generated by storing a series of instructions indicating how bits of redundant data can be inverted and/or re-ordered to form the error correction data. In this way, it is more difficult to extract useful information about the R-data and the error correction data from the transform data. 
         [0122]    The multi-bit data element processing techniques described above could also be applied to a number generation system in which error correction data is directly stored (i.e. is not mapped into transform data). 
         [0123]    In the illustrated embodiments, a repetition/voting error correction algorithm is applied in which four check bits are assigned to each data bit. It will be appreciated that an alternative number of check bits could be used, although it is preferred that an even number of check bits is used to prevent any ties in the voting operation during number regeneration (i.e. the same number of data bits having value “0” as having value “1”). 
         [0124]    In the previously described embodiments, the number generators and the number regenerators have been designed so that the error correction algorithm used can be changed simply by replacing the existing error correction algorithm unit by the error correction algorithm unit for the new error correction algorithm. The controller determines the k value and the p value associated with the new error correction algorithm unit, and outputs control signals ensuring that the data splitters apportion the S-data into K-data and R-data correctly, that the error correction data generator outputs blocks of k data bits to the error correction algorithm unit during enrolment, and that the error corrector outputs codewords having k data bits and p check bits to the error correction algorithm unit during number regeneration. 
         [0125]    Examples of other error correction algorithms which could be used include the BCH (32,21) algorithm and the Hamming (8,4) algorithm. 
         [0126]    In the illustrated embodiments, when the source data is separated into K-data and R-data, in some embodiments some of the source data is discarded because the amount of source data does not correspond to an integer number of codewords. It will be appreciated that this discarded data could be constructively used. For example, error detection data could be generated for the biometric number K bio , and the discarded source data used to map the error detection data into transform data. 
         [0127]    In the illustrated embodiments, during enrolment a source data splitter  61  generates a reference map indicating for the K-data and the R-data, the corresponding elements of the S-data. The reference map is stored and used by a source data splitter in a subsequent number regeneration operation. Alternatively, the source data splitter during enrolment could perform a predetermined shuffling operation, with the source data splitter being programmed to perform the same shuffling operation during number regeneration. In this way, there is no requirement to store the reference map. However, for embodiments in which a fault map identifying suspect data elements is formed during number regeneration, a reference map can be transiently formed during number regeneration to enable the suspect data elements to be tracked back to the original S-data locations. 
         [0128]    In the previously described embodiments, the source data is formed by imaging the iris of a human being. Alternatively, the source data could be formed by measuring other distinctive characteristics of an individual. For example, the source data could be formed by imaging a fingerprint or a retina of the individual. Alternatively, the source data could be formed by recording a sequence of utterances by the individual. Details of techniques for formatting biometric data from fingerprints and retina patterns can be found in International Patent Application WO 02/098053. 
         [0129]    The source data (S-data) could be formed from a number of source data pools relating to the same distinctive feature. For example, the S-data could be formed by the combination of formatted data provided by the iris image data processing techniques described in U.S. Pat. No. 5,291,560 and WO 02/098053. Alternatively, the S-data could be formed from a number of source data pools representing different distinctive characteristics (e.g. iris pattern and fingerprint) of an individual. As another alternative, if a particular region of a source data pool was found to have a higher susceptibility to errors than the rest of the source data pool, then the data associated with this region could be separated off to form a separate source data pool. 
         [0130]    Generally, each source data pool will have an associated error behavior. For example, one source data pool may have an expected error rate of one bit in ten while another source data pool may have an expected error rate of one bit in six. In a preferred embodiment, a plurality of source data pools are processed by respective error correction algorithms, which generally will not be the same, to produce respective intermediate source data pools all having a substantially constant error performance. The intermediate source data pools are then combined, and an additional pass of error correction applied to the combined intermediate source data pool. 
         [0131]    As described above, a wide variety of error correction algorithms can be used, in one or more passes of error correction, to process analogue data representative of an analogue data source to generate a number representative of the analogue data source. Preferably, the choice of error correction methodology is determined by predicting for a set of analogue data the fault rate for all possible error correction methodologies, and identifying the error correction methodology which provides the largest number with a predicted fault rate within a desired tolerance level. The error correction performance of each error correction methodology may be determined from the likelihood of errors in the source analogue data and the error correcting performance of the various error correction algorithms. 
         [0132]    It will be appreciated that biometric data from other animals could be used to generate a biometric number. 
         [0133]    Further, some inanimate objects have distinctive features from which a physical value representative of the inanimate object can be derived. For example, analogue data may be generated by imaging an engraving or a jewel with an image sensor. Alternatively, a purpose-defined object having sharply defined, but random, geometric properties can be probed using ultrasound to generate analogue data. 
         [0134]    Although in the first to third embodiments, the same apparatus is used both to carry out the enrolment process and the subsequent number regeneration, alternatively the enrolment process and the number regeneration process could be performed by separate devices. However, if the number regeneration is performed by a separate device to the enrolment, then the process data must be transferred from the enrolment apparatus to the number regeneration apparatus. This could be performed, for example, by transferring the process vector to a storage device (e.g. a floppy disc or a CD-ROM) which is moved to the number regeneration apparatus where the process vector is downloaded into the regeneration apparatus, or alternatively the enrolment apparatus and the number regeneration apparatus could be connected via a computer network, in which the process vector is transmitted across the computer network as an electrical signal. 
         [0135]    The processing of the analogue data can either be performed by a hardware device, software running on a computer, or the processing could be split between a hardware device and software running on a computer. The invention is well suited to being implemented in software using an object oriented programming language such as Java or C++. In particular, each error correction algorithm can be implemented by a respective different one of a library of program objects which can be selectively addressed by an error correction data generator and an error corrector. 
         [0136]    As described, as well as computer apparatus and processes performed in the computer apparatus, the invention also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the invention into practice. The computer program may be in the form of source code, object code, a code intermediate source and object code such as in partially compiled form, or in any other form suitable for use in the implementation of the processes according to the invention. 
         [0137]    The carrier may be any entity or device capable of carrying the program. For example, the carrier may comprise a storage medium such as a ROM, for example a CD ROM or a semiconductor ROM, or a magnetic recording medium, for example a floppy disk or hard disk. Further, the carrier may be a; transmissible carrier such as an electrical or optical signal which may be conveyed via electrical or optical cable or by radio or other means. 
         [0138]    When the program is embodied in a signal which may be conveyed directly by a cable or other device or means, the carrier may be constituted by such cable or other device or means. Alternatively, the carrier may be an integrated circuit in which the program is embedded, the integrated circuit being adapted for performing, or for use in the performance of, the relevant processes. 
         [0139]    Having thus described exemplary embodiments, it should be noted by those skilled in the art that the within disclosures are exemplary only and that various other alternatives, adaptations, and modifications may be made within the scope of this disclosure as described herein and as described in the appended claims.