Patent Description:
Various types of biometric systems are used more and more in order to provide for increased security and/or enhanced user convenience.

In particular, fingerprint sensing systems have been adopted in, for example, consumer electronic devices, thanks to their small form factor, high performance, and user acceptance.

For continued trust in fingerprint sensing systems, it is important to provide fingerprint sensing systems with high performance in terms of convenience as well as security. In particular, it would be desirable to provide fingerprint sensing systems that are capable of rejecting attempts to get a positive authentication result using a fake finger.

Various fingerprint sensing systems, employing so-called anti-spoofing measures, have been suggested.

For example, <CIT> discloses a fingerprint sensor including a finger sensing area and a controller. The controller aligns authentication data and enrollment data and performs spoof attempt detection based on corresponding pairs of finger features and their spatial locations in the aligned enrollment and authentication data.

<NPL> relates to a method for discriminating fake fingers from real ones, based on the analysis of skin distortion. The user is required to move the finger while pressing it against the scanner surface, thus deliberately exaggerating the skin distortion.

However, it would still be desirable to provide for authentication with an improved performance, in particular in respect of rejecting spoofing attempts.

In view of the above-mentioned and other drawbacks of the prior art, it is an object of the present invention to provide for improved authentication, in particular in respect of rejecting spoofing attempts.

According to a first aspect of the present invention, it is therefore provided a method as defined by claim <NUM>.

It should be noted that the steps of methods according to embodiments of the present invention need not necessarily be in the order recited in the claims.

It should also be noted that a fingerprint authentication system may be comprised in a stand-alone electronic device, such as a mobile communication device, a watch or a smart card, or may be formed by interconnected devices, such as a computer and a fingerprint acquisition device connected to the computer.

The fingerprint sensing arrangement may, for example, be a capacitive fingerprint sensing arrangement, detecting a measure indicative of the capacitive coupling between each sensing element in an array of sensing elements and a finger surface touching the sensing arrangement surface. Sensing elements at locations corresponding to ridges in the fingerprint will exhibit a stronger capacitive coupling to the finger than sensing elements at locations corresponding to valleys in the fingerprint.

However, the various embodiments of the present invention are not limited to a particular fingerprint sensing technology, but are equally applicable to, for instance, acoustic, optical, thermal or piezo-electric fingerprint sensing arrangements etc..

Furthermore, the fingerprint authentication system according to embodiments of the present invention may be embodied as a system of components, or in a single component, such as an integrated circuit.

The present invention is based upon the realization that only a small portion of a spoof made from a latent fingerprint is likely to be of sufficiently high quality to potentially achieve a successful authentication when conventional template matching is used, and that the most likely way an impostor would use such a spoof would be to move it between authentication attempts to try to align the small high quality portion with the sensing area of the fingerprint sensor using trial and error.

The present inventor has further realized that this expected attack pattern can be identified by, in addition to the match score of the current authentication attempt, evaluating a change in the liveness score between authentication attempts. For instance, a relatively large change in liveness score between successive authentication attempts may indicate an ongoing spoofing attempt, so that the authentication attempt may be determined to be unsuccessful even if the match score taken by itself would indicate a successful authentication. The above-mentioned qualification metric thus indicates an estimated likelihood of an ongoing spoofing attempt. The relation between the liveness score for the current authentication attempt and the liveness score for the at least one previous authentication attempt is an indication of a difference (or differences) in liveness score for successive authentication attempts.

The at least one previous authentication attempt may include the most recent authentication attempt directly preceding the current authentication attempt. According to embodiments, the at least one previous authentication attempt may include a plurality of previous authentication attempts, so that the qualification metric provides an indication of a development over time of the liveness score.

Accordingly, embodiments of the present invention strengthen the defenses against spoofing attacks, especially so-called presentation attacks.

According to various embodiments, the above-mentioned qualification metric may be further based on a variation between the match score for the authentication attempt and a match score for at least one previous authentication attempt.

By evaluating combinations of the liveness score and the match score for different authentication attempts, patterns indicating a presentation attack can be identified, increasing the possibility of recognizing and stopping an ongoing spoofing attack.

In various embodiments of the method according to the present invention, the qualification metric may be further based on an estimated movement of the candidate finger probe since a previous authentication attempt.

The property that the candidate finger probe is moved between authentication attempts, to eventually try a rather large area of the candidate finger probe is characteristic to a presentation attack. Further basing the qualification metric on an estimated movement between successive authentication attempts may therefore increase the chances of successfully recognizing an ongoing presentation attack. It should be noted that the movement of a fingerprint pattern is, perse, straight-forward to determine.

Advantageously, the qualification metric may be further based on a time period since said previous authentication attempt. Even more advantageous may be to base the qualification metric on several time periods between successive authentication attempts in the sequence of authentication attempts.

Hereby, additional information can be obtained to aid in the recognition of an ongoing presentation attack. The attacker will typically be aware that he/she will only have a rather small number of attempts before the mobile phone or other electronic device is locked for a certain time, or another form of authentication is required. Therefore, it is likely that authentication attempts during a presentation attack are made with care, so that the time between authentication attempts needs to be more than one or a few seconds.

Further basing the qualification metric on the time between successive authentication attempts may therefore increase the chances of successfully recognizing an ongoing presentation attack.

According to embodiments, the qualification metric may be determined using an empirical model. Such an empirical model may advantageously be determined using machine learning techniques, such as neural networks and/or multivariate statistical analysis etc..

According to embodiments, furthermore, the step of determining the authentication result may comprise the step of: providing, when the match score indicates that the authentication representation matches with the enrollment representation and the qualification metric indicates that a likelihood of an ongoing spoofing attempt is greater than a predefined threshold likelihood, a signal indicating a failed authentication.

In embodiments, the method according to the present invention may further comprise the steps of, for each authentication attempt in the sequence of authentication attempts: when the liveness score for the authentication attempt indicates a likely spoof: providing a signal indicating a failed authentication; determining an anti-spoofing representation based on the candidate fingerprint image; and storing the anti-spoofing representation.

By determining and storing an anti-spoofing representation of a likely spoof, the chances of rejecting subsequent spoofing attempts can be increased further, even when the small high quality portion of a spoof is aligned with the sensing area of the fingerprint sensor.

In embodiments, the method according to the present invention may further comprise the steps of, for each authentication attempt in the sequence of authentication attempts: retrieving a stored anti-spoofing representation associated with a previous authentication attempt; comparing the authentication representation with the anti-spoofing representation associated with the previous authentication attempt; and when the authentication representation matches with the anti-spoofing representation, providing a signal indicating a failed authentication.

Using the stored anti-spoofing representation, the present authentication attempt can be rejected even if the authentication representation matches well with the stored enrollment representation. A good match between the present authentication representation and the stored anti-spoofing representation is an indication that the present authentication attempt is with the same spoof that was identified in the previous (failed) authentication attempt.

Any additional matching requirement (in addition to template matching) may result in an increase of the occurrence of false rejections, which is undesirable. It would therefore be advantageous to only match an authentication representation against an anti-spoofing representation when a presentation attack or similar may reasonably occur and/or to limit the coverage of the stored anti-spoofing representation(s). To that end, it may be advantageous to discard any stored anti-spoofing representation upon receiving an indication of a successful authentication by the user.

This may, in particular, be the case when the successful authentication provides a supplementary indication of user presence, by an alternative authentication method. For instance, the successful authentication may be the result of the entry of a correct passcode (such as a password or PIN-code).

According to a second aspect of the present invention, there is provided a fingerprint authentication system as defined by claim <NUM>.

The processing circuitry may be realized as hardware and/or as software running on one or several processors.

Further embodiments of, and effects obtained through this second aspect of the present invention are largely analogous to those described above for the first aspect of the invention.

The fingerprint authentication system according to embodiments of the present invention may be included in an electronic device, further comprising a processing unit configured to control the fingerprint authentication system to carry out a fingerprint authentication of a user, and to perform at least one action only upon successful authentication of the user.

In the present detailed description, various embodiments of the electronic device according to the present invention are mainly discussed with reference to a mobile phone with a substantially square fingerprint sensor being accessible through an opening in the back cover. Furthermore, the fingerprint sensor <NUM> and the processing circuitry are schematically indicated as being different separate components.

It should be noted that this by no means limits the scope of the present invention, which equally well includes, for example, other types of electronic devices, such as smart watches, smart cards, laptop computers etc. Furthermore, the fingerprint sensing device need not be substantially square, but could be elongated or have any other suitable shape. Moreover, the fingerprint sensing device may be arranged in any suitable location in the electronic device, such as being integrated with a button on the front or the side of the mobile phone, or arranged under a cover glass etc. In addition, the processing circuitry, or parts of the processing circuitry, may be integrated with the fingerprint sensor.

<FIG> schematically illustrates an example embodiment of the electronic device according to the present invention, in the form of a mobile phone <NUM> having a housing <NUM> and an integrated fingerprint sensor <NUM> being accessible through an opening in the housing <NUM>. The fingerprint sensor <NUM> may, for example, be used for unlocking the mobile phone <NUM> and/or for authorizing transactions carried out using the mobile phone etc..

<FIG> is an enlarged view of the fingerprint sensor <NUM> and its integration with the housing <NUM>.

With reference to <FIG>, which is a schematic block-diagram of the mobile phone is <FIG>, the mobile phone <NUM>, in addition to the above-mentioned fingerprint sensor <NUM>, comprises communication circuitry <NUM>, user interface circuitry <NUM>, processing circuitry <NUM>, and a fingerprint sensor interface <NUM>, here schematically indicated by the line arrows indicating control signals and the block arrow indicating data transfer.

As is schematically indicated in <FIG>, the fingerprint sensor <NUM> comprises a sensor array <NUM> and finger detecting circuitry, here provided in the form of finger detecting structures 11a-b and a finger detection circuit <NUM> connected to the finger detecting structures 11a-b. The sensor array <NUM> includes a plurality of sensing elements 13a-b (only two neighboring sensing elements are indicated with reference numerals in <FIG> to avoid cluttering the drawing). The fingerprint sensor <NUM> further comprises a finger detection output <NUM> for externally providing a Finger Detect and/or a Finger Lost signal from the finger detection circuit <NUM>. Although not shown in <FIG>, the fingerprint sensing device <NUM> additionally comprises readout circuitry for converting sensing signals from the sensing elements to provide a representation of a fingerprint touching the sensor surface. Exemplary readout circuitry will be described further below with reference to <FIG>.

The above-mentioned communication circuitry <NUM> may, for example, comprise one or several of various antennas and control units for wireless communication, and the above-mentioned user interface circuitry <NUM> may, for example, comprise one or several of a display, a microphone, a speaker, and a vibration unit.

<FIG> is a schematic cross section of a portion of the fingerprint sensing device <NUM> in <FIG> taken along the line A-A' with a finger <NUM> placed on top of a protective dielectric top layer <NUM> covering the sensor array <NUM> and the finger detecting structures 11a-b. Referring to <FIG>, the fingerprint sensing device <NUM> comprises an excitation signal providing circuit <NUM> electrically connected to the finger via a conductive finger drive structure (not shown in <FIG>), a plurality of sensing elements 13a-b, and a finger detection arrangement comprising the finger detecting structure 11b, and the finger detection circuit <NUM> connected to the finger detecting structure 11b.

As is schematically indicated in <FIG>, each sensing element 13a-b comprises a conductive sensing structure, here in the form of a metal plate 17a-b underneath the protective dielectric top layer <NUM>, a charge amplifier 18a-b, and selection circuitry, here functionally illustrated as a simple selection switch 21a-b for allowing selection/activation of the respective sensing element 13a-b.

The charge amplifier 18a-b comprises at least one amplifier stage, here schematically illustrated as an operational amplifier (op amp) 24a-b having a first input (negative input) 25a-b connected to the sensing structure 17a-b, a second input (positive input) 26a-b connected to sensor ground or another reference potential, and an output 27a-b. In addition, the charge amplifier 18a-b comprises a feedback capacitor 29a-b connected between the first input 25a-b and the output 27a-b, and reset circuitry, here functionally illustrated as a switch 30a-b, for allowing controllable discharge of the feedback capacitor 29a-b. The charge amplifier 18a-b may be reset by operating the reset circuitry 30a-b to discharge the feedback capacitor 29a-b.

As is often the case for an op amp 24a-b in a negative feedback configuration, the voltage at the first input 25a-b follows the voltage at the second input 26a-b. Depending on the particular amplifier configuration, the potential at the first input 25a-b may be substantially the same as the potential at the second input <NUM> a-b, or there may be a substantially fixed offset between the potential at the first input 25a-b and the potential at the second input <NUM> a-b. In the configuration of <FIG>, the first input <NUM> a-b of the charge amplifier is virtually grounded.

When a time-varying potential is provided to the finger <NUM> by the excitation signal providing circuitry <NUM>, a corresponding time-varying potential difference occurs between the sensing structure <NUM> a-b and the finger <NUM>.

The above-described change in potential difference between the finger <NUM> and the sensing structure 17a-b results in a sensing voltage signal Vs on the output 27a-b of the charge amplifier 18a-b.

When the indicated sensing element <NUM> a-b is selected for sensing, the selection switch 21a-b is closed to provide the sensing signal to the readout line <NUM>. The readout line <NUM>, which may be a common readout line for a row or a column of the sensor array <NUM> in <FIG>, is shown in <FIG> to be connected to a multiplexer <NUM>. As is schematically indicated in <FIG>, additional readout lines from other rows/columns of the sensor array <NUM> may also be connected to the multiplexer <NUM>.

The output of the multiplexer <NUM> is connected to a sample-and-hold circuit <NUM> and an analog-to-digital converter <NUM> in series for sampling and converting the analog signals originating from the sensing elements <NUM> a-b to a digital representation of the fingerprint pattern of the finger <NUM> on the sensor <NUM>.

As is schematically indicated in <FIG>, the finger detection circuit <NUM> here comprises a dedicated finger detecting structure 11b in the form of a metal plate, a charge amplifier <NUM> and a detection signal processing circuit <NUM>. The charge amplifier <NUM>, which is similar in principle to the charge amplifiers 18a-b comprised in the sensing elements 13a-b described above. Accordingly, the charge amplifier <NUM> comprises at least one amplifier stage, here schematically illustrated as an operational amplifier (op amp) <NUM> having a first input (negative input) <NUM> connected to the finger detecting structure 11b, a second input (positive input) <NUM> connected to sensor ground or another reference potential, and an output <NUM>. In addition, the charge amplifier <NUM> comprises a feedback capacitor <NUM> connected between the first input <NUM> and the output <NUM>, and reset circuitry, here functionally illustrated as a switch <NUM>, for allowing controllable discharge of the feedback capacitor <NUM>. The charge amplifier may be reset by operating the reset circuitry <NUM> to discharge the feedback capacitor <NUM>. As is also indicated in <FIG>, the output of the charge amplifier is a finger detection signal Sd (in the form of a voltage) indicative of the capacitive coupling between the finger <NUM> and the finger detecting structure 11b.

In <FIG>, the finger <NUM> is shown as being connected to an excitation circuit <NUM> for providing the desired potential difference between the finger, and the sensing plates 17a-b of the sensor array <NUM> and the finger detecting structure 4a. It should be noted that this desired potential difference may alternatively be provided by changing the ground level of the fingerprint sensing device in relation to the ground level of the electronic device (such as mobile phone <NUM>) in which the fingerprint sensing device <NUM> is included.

An example embodiment of a method according to an aspect of the present invention will now be described with reference to the flow-chart in <FIG> together with illustrations in other figures where applicable.

In a first step <NUM>, a candidate fingerprint image of the candidate finger probe is acquired using the fingerprint sensor <NUM>. The candidate finger probe may be a real finger, or a spoof that may have been manufactured based on a latent print. A schematic illustration of such a spoof <NUM> is provided in <FIG>.

Referring now briefly to <FIG>, such a spoof <NUM> may have a first spoof portion <NUM> in which the topography is similar to that of the real finger, and a second spoof portion <NUM> that differs, in various ways, from the real finger.

Since the sensing area of the fingerprint sensor <NUM> is considerably smaller than the candidate finger probe, only a portion of the candidate finger probe will be imaged by the fingerprint sensor <NUM> as the above-mentioned candidate fingerprint image. Assuming in the following that the candidate finger probe is the spoof <NUM> in <FIG> and that a so-called presentation attack is taking place, a schematic example first fingerprint image <NUM> acquired in connection with a first authentication attempt is schematically shown in <FIG> shows a schematic example second fingerprint image <NUM> acquired in connection with a second authentication attempt, and <FIG> shows a schematic example third fingerprint image <NUM> acquired in connection with a third authentication attempt.

For purposes of illustration, it is here assumed that two previous authentication attempts have been made, based on the first fingerprint image <NUM> in <FIG> and the second fingerprint image <NUM> in <FIG>, respectively, and that the fingerprint image that is acquired in the first step <NUM> of the flow-chart in <FIG> is the third fingerprint image <NUM> in <FIG>.

Returning to the flow-chart in <FIG>, an authentication representation is determined based on the third candidate fingerprint image <NUM> in step <NUM>, and a stored enrollment representation of an enrolled fingerprint of the user is retrieved in step <NUM>.

In step <NUM>, qualification data for previous authentication attempts is retrieved. Such qualification data includes liveness scores determined in connection with a first authentication attempt based on the first candidate image <NUM> in <FIG> and in connection with a second authentication attempt based on the second candidate image <NUM> in <FIG>. The retrieved qualification data may additionally include match scores determined in connection with the first and second authentication attempts, and/or and an indication of candidate finger probe movement between the first and second authentication attempts, and/or an indication of a time period between the first and second authentication attempts.

In step <NUM>, the authentication representation determined in step <NUM> is compared with the enrollment representation retrieved in step <NUM>, and a match score is determined based on the comparison. Since various ways of forming suitable biometric representations based on fingerprint images as well as various ways of comparing such biometric representations to determine a match score are well known in the art, no detailed description of this is provided here.

In step <NUM>, a qualification metric QM for the current authentication attempt based on the third fingerprint image <NUM> in <FIG> is determined, the retrieved qualification data is updated based on the current authentication attempt, and the updated qualification data is stored.

The qualification metric QM is determined based on the previous qualification data retrieved in step <NUM> and qualification data determined in connection with the current authentication attempt, at least including a liveness score for the current authentication attempt.

Concerning the liveness score, there are various well-known ways of determining a liveness score. For instance, the candidate fingerprint image may be analyzed in view of various properties of the enrolled fingerprint, such as ridge dimensions, the presence and distribution of sweat pores, the existence of perspiration etc. According to other known ways of determining a liveness score, auxiliary sensors may be used for detecting one or several properties of the candidate finger probe. It could, for instance, be feasible to use the above-described finger detection circuitry to obtain a measure indicative of electrical properties of the candidate finger probe.

In the next step <NUM> it is determined whether or not the authentication representation and the enrollment representation match. In particular, the match score determined in step <NUM> may be compared with a threshold that may be predefined or adaptive.

If it is determined in step <NUM> that there is no match, it is concluded that the authentication attempt failed, as indicated in <FIG>.

If it is instead determined in step <NUM> that there is a match, as may well be the case for the third fingerprint image <NUM> in <FIG>, the method proceeds to step <NUM> to evaluate the above-mentioned qualification metric QM.

If the evaluation of the qualification metric QM indicates that the candidate finger probe is likely to be a real finger, it is concluded that the authentication attempt was successful, indicated by 'Pass' in <FIG>. If the evaluation of the qualification metric QM instead indicates that it is likely that there is an ongoing spoofing attempt, it is concluded that the authentication attempt failed, as indicated in <FIG>.

The qualification metric QM indicates a difference between the liveness score determined for the current authentication attempt and the liveness score retrieved in step <NUM>. Alternatively, the qualification metric QM may be determined based on an empirical model that may be continuously improved during use of the fingerprint authentication system.

To determine if the sequence of authentication attempts is in fact a spoofing attack of the presentation type, the qualification metric QM indicates a difference between the liveness scores of qualification of the authentication attempts of the sequence of authentication attempts, and the thus determined QM may be compared with a threshold, which may be predefined or adaptively determined.

A simplified example of how an analysis of qualification data, at least including the liveness scores for the authentication attempts, will now be provided with reference to the diagram in <FIG>, where example liveness scores for three sequential authentication attempts '<NUM>', '<NUM>', '<NUM>' are plotted together with a threshold value TH for the liveness score.

In the exemplary situation illustrated by the diagram in <FIG>, the first authentication attempt '<NUM>' is based on the first example fingerprint image <NUM> in which a relatively small portion of the 'good' part <NUM> of the spoof <NUM> is included. Therefore the first liveness score LS<NUM> is rather low, far below the liveness threshold TH. The second authentication attempt '<NUM>' is based on the second example fingerprint image <NUM> in which more of the 'good' part <NUM> of the spoof <NUM> is included. Therefore the second liveness score LS<NUM> is higher than the first liveness score LS<NUM>, but still below the liveness threshold TH. The third authentication attempt '<NUM>' is based on the third example fingerprint image <NUM> in which the 'good' part <NUM> of the spoof <NUM> covers almost the entire fingerprint sensor <NUM>. Therefore the third liveness score LS<NUM> is higher than the second liveness score LS<NUM>, and may even be higher than the liveness threshold TH as is indicated in <FIG>.

Considering the difference between the third liveness score LS<NUM>, and the previous first LS<NUM> and second LS<NUM> liveness scores, it can be concluded that there is a substantial variation in liveness score between authentication attempts in the sequence of authentication attempts. This variation in liveness scores, optionally together with other factors such as variations in the match score, and/or candidate finger probe movement between authentication attempts, and/or the time between authentication attempts, results, in this case, in the finding that the qualification metric QM indicates a likely spoofing attempt. Therefore, the authentication attempt fails, even though the match score as well as the liveness score LS<NUM> would indicate that there is a match with a live finger.

It should be noted that the steps of the method may be carried out in another order than indicated herein, and that steps may be carried out simultaneously.

Claim 1:
A method of authenticating a user by means of a fingerprint authentication system comprising a fingerprint sensing arrangement (<NUM>), said method comprising the steps of, for each authentication attempt in a sequence of authentication attempts:
receiving a touch by a candidate finger on said fingerprint sensing arrangement;
acquiring (<NUM>) a candidate fingerprint image of said candidate finger;
determining (<NUM>) an authentication representation based on said candidate fingerprint image;
retrieving (<NUM>) a stored enrollment representation of an enrolled fingerprint of said user;
determining (<NUM>) a match score based on a comparison between said authentication representation and said enrollment representation;
determining a liveness score for said authentication attempt based on said candidate fingerprint image;
determining a qualification metric (<NUM>) for said authentication attempt indicating a difference between the liveness score for said authentication attempt and a liveness score for at least one previous authentication attempt; and
determining an authentication result for said authentication attempt based on said match score, and said qualification metric.