WO1998047110A1

WO1998047110A1 - Identity verification method

Info

Publication number: WO1998047110A1
Application number: PCT/EP1998/002201
Authority: WO
Inventors: Jens Bookhagen; Lutz Donnerhacke; Henry Steger; Klaus Weniger
Original assignee: Iks Gmbh Information-Kommunikation-Systeme
Priority date: 1997-04-15
Filing date: 1998-04-15
Publication date: 1998-10-22
Also published as: DE19715644A1

Abstract

The present invention relates to an identity verification procedure as a prerequisite to granting an access and/or use permission, whereby at least one data set based on biometrical signs enabling identification is built using a data entry and processing system. The invention also relates to facilities for implementing said method. In order to fulfil that task, the biometrical features are first captured in the form of reproductible feature data; a first data set is then generated from random data, which data set is stored on a data medium as a control data set; at least part of the feature data is related to at least part of the control data set and converted by a non-reversible computing operation into a second data set; and this second set is used as a criterion fo granting an access and/or use permission and/or as a cryptographical key setting.

Description

title

Identity verification process

FIELD OF THE INVENTION The invention relates to a method for identity verification as a prerequisite for granting access and / or exercise authorization, in which at least one data record is generated on the basis of biometric features with the aid of a data acquisition and data processing system and in which the proof of identity is used of the underlying biometric features. The invention also relates to arrangements for carrying out this method.

State of the art

From the point of view of current development trends in society, there is an increasing need to rule out unauthorized access to things, an unauthorized drawing of events and / or an unauthorized exercise of actions. In connection with this, various types of procedures and arrangements have been developed that allow access or Issue an exercise permit only after the identity check of persons has been successfully carried out.

For example, the patent DE 43 22 44 5 Cl describes a method for coding identification cards by means of fingerprints, in which a number of fingerprints are taken from the holder of the identification card with the aid of a sensor, and an imprint of the removed fingerprints is applied to the identification card as a key code is selected and after a processing key at least one of the other fingerprints is used as the identification code and is saved. The key code fingerprint can be stored, for example, in the form of a hologram.

The method proposed here provides that the card holder inserts his identification card into a fingerprint comparison device and places a plurality or all of the fingers of both hands on a fingerprint sensor. There is a comparison of the fingerprint stored on the card with one of the natural fingerprints, after which, in the event of a positive comparison, an access to a memory is opened by means of an output signal which contains the fingerprint of the cardholder selected according to a scrambling system. This memory can be a local terminal at the location where the card is used. However, a central terminal is also proposed, which is connected to the fingerprint comparison device on site. With the open access to the memory, a comparison of the stored fingerprint with the transmitted fingerprints and, if the stored fingerprint matches with one of the transmitted fingerprints, the identification card is released.

Due to the double coding, a relatively high security standard is achieved. The disadvantage here, however, is that a large number of users whose access authorization is to be checked requires a high capacity for storing all fingerprints, and that each user must also have an identification card with them.

Another procedure with associated arrangement is described in DE 42 20 971 AI. Here, a fingerprint scanning device is used for identity verification, in which an image input device is coupled to a storage device for the photoelectronic storage of fingerprints of registered persons. A feature recognition device processes the image data and generates a spectra pattern. A determination device identifies the person entering as a registered person. An output signal device generates an unlocking signal and sends it to a door locking device.

A line thinning is provided in the feature recognition device used here, which separates the thick elements of the fingerprint lines from the two-dimensional fingerprint data that have been transmitted from a CCD camera to the feature recognition device. Furthermore, the feature recognition device a middle position recognition device which determines the middle section of the two-dimensional fingerprint data. Furthermore, a data recognition device is provided which recognizes a fingerprint section within a certain radius from the center position in order to present it as identification data. On the basis of this determination data, a two-dimensional Fourier transformation takes place, the result of which is the two-dimensional Fourier-transformed image which is recorded as a spectra pattern.

In this procedure, the required storage capacity is reduced due to the two-dimensional Fourier transformation, but disadvantageously, a comparison of structures or structural patterns of the data that are recorded by the entering person with the data of the registered person is still necessary. There is therefore uniqueness of the stored biometric data in relation to the biometric data newly read in by the person entering. However, there is still the possibility of decrypting the stored fingerprints and the data available for comparison; i.e. the risk of abuse by unauthorized persons is not completely excluded.

Description of the invention

The invention has for its object to provide a method of the type described, in which, in contrast to the prior art, no permanent storage of data records is required, which are obtained from biometric sources and whose content is shaped by the characteristics of these biometric sources.

The object of the invention is achieved in that a first data set is generated from random data without reference to the characteristics of a biometric source and is stored on a data carrier as a control data set. Since this data set is based on random data, it does not allow any conclusions to be drawn about a biometric source of origin, even when evaluated by unauthorized persons. This first data record is assigned as a tax data record to one of the persons belonging to the group of persons authorized to access. It will be saved permanently at least until the next access request is drawn.

In the event of a request for access, the person authorized to access calls the first data record from the memory; in addition, the character Teristic biometric features of a biometric source to be identified of the person requesting access, for example the characteristic of a fingerprint, are recorded in the form of a feature data record, which is, however, not stored permanently, but is provided temporarily for linking to the control data record.

At least some of the feature data and at least some of the control data record are now transformed into a second data record by an irreversible arithmetic operation. This second data record created in this way is used as a characteristic data record for granting access and / or exercise authorization and / or as a cryptographic key.

The main difference from the prior art is that the data, which have a reference to the characteristics of the biometric source, are not permanently stored in a memory and thus an uncontrollable access to this data is not possible. In addition, the method according to the invention does not provide a YES / NO decision on the access authorization, but rather a value corresponding to the characteristic data record within a certain value range, the value range being able to be predetermined by the amount of the data to be recorded and processed.

This value, which corresponds to the characteristic data record, is subsequently used as the basis for a YES / NO decision on access authorization. With each access request, this value or characteristic data record is regenerated from the combination of the permanently stored control data record with the currently obtained temporary biometric data. Only one value out of the total possible amount of achievable values is correct.

If an incorrect biometric source is present, an error is not signaled as previously in the methods known in the prior art, but an incorrect characteristic data record is generated. First of all, this creates the prerequisite for a decision to grant access and / or exercise authorization. The decision on the access authorization can now the temporary Kennda ^¬ cost rate and the pen name of the applicant, ie the control data set, one to ^¬ gang control is passed which durchfuhrt the Zugangsprufung and decides on the admission. The pseudonym or the tax record can be renewed as often as you like. With the solution according to the invention of the task of the invention to be tested, namely to make a decision on access authorization or with the method steps according to the invention to prepare the decision about access authorization without the permanent storage of biometric characteristic data being necessary, security has been successfully achieved to significantly increase this type of identity check.

The second data set is unambiguous with regard to the combination of the tax data set with the biometric data which are recorded by the person requesting access; however, it is not unique in relation to the biometric data read in alone. A comparison of images or structures to identify the biometric source (fingers, facial features or voice) is no longer possible.

The second data record, which is generated in the manner described and is intended to serve as an access criterion, is always related to the data read in and is generated anew and differently with every entry request, even if it is the same person. At the same time, however, this means that it is not possible to predict the content of the second data record generated during the next and the next but one access request, even if the same biometric data are used. This ensures that it is not possible for unauthorized parties to draw conclusions about the biometric data or to preview the data records that are generated as requests for access. This symbolically means that as a prerequisite for access, a key for an existing lock is not necessary as was previously the case, but for each new access a new, unpredictable lock has to be overcome and an unknown key is required for this.

If the second data record, together with the name of the user, is used as a criterion or password for an examination, access and / or exercise authorization is only granted to those who meet the corresponding identity requirement.

This provides an extremely high level of security without the user or the person requesting access having to carry an identification card or a similar object on which data is stored. The data to be stored are also reduced so far compared to previously known methods that only a significantly reduced storage capacity is required. Furthermore, it is no longer necessary to equip the device for reading in the features, for example, with a center position detection or to provide an image selection unit with regard to a fingerprint section within a specific radius from the center position.

The arrangements for carrying out the method according to the invention can therefore be produced with less effort and, due to the uncomplicated construction, also have a higher functional reliability than the arrangements known in the prior art.

A very preferred development of the invention consists in the fact that the computing operation for transforming the data takes place according to a cryptographic HASH function. This ensures that the transformation is irreversible with a high degree of certainty. The HASH function converts a variable variable, for example any set of values, into a fixed string. The arithmetic operation is easy to perform for any value, but is not reversible. Input sizes of any length become output sizes of fixed length, which briefly but precisely reproduces the original information.

In an advantageous embodiment of the invention, it is provided that the characteristic biometric features are recorded multiple times in order to achieve sufficiently reproducible feature data, and a feature extraction is carried out after each data acquisition. This has the advantage that later identification is possible with greater certainty. The feature extraction can be carried out by multiple image recognition and "minutiae detection" analogous to forensic processing.

In a further embodiment of the invention it is provided that, after each feature extraction, a verification is carried out for the previous data acquisition. Due to the multiple run in connection with a verification, the later storage of decipherable data can be excluded with increased security.

The method according to the invention can be carried out in such a way that the control data record (y) is generated on the basis of an optoelectronic recording of a fingerprint by the user in such a way that the image data obtained is combined in one Data processing system are adopted that data m obtained on the basis of the minutiae of the finger in accordance with the aforementioned claims and transformed into the control data record according to the HASH function H (m) = f {y} and this is uncoded under the name of the user in a user database the data carrier is stored.

Another important advantage of the proposed method is that the control data record can be stored uncoded on the data carrier without the risk of unauthorized decryption.

The second data record can be generated by checking the presence of an assigned control data record (y) on the data carrier by entering the user name on a keyboard and, if necessary, calling up the opto-electronic recording of the fingerprint of the user and from this accordingly of the aforementioned claims sufficiently reproducible characteristic data (x) are obtained, that the data (x) are linked to the control data record (y) and transformed according to the HASH function H (z) = f {x, y} into a second data record which serves as a "private" data record (z) as a criterion for granting access and / or exercise authorization and / or as a cryptographic key.

Although the method according to the invention can be applied very well on the basis of the biometric data of a finger, it can also be used in another way, e.g. based on the shape of the face or based on the voice. In the first two cases mentioned, the recording of the characteristic biometric data is carried out by capturing electronic image information, whereas when the voice is used as the basis, the data to be stored are generated using an electronic sound image.

The invention further relates to an arrangement for carrying out the method, with an opto-electronic image converter, an image data processing unit and a data output unit, in which a computing circuit for the irreversible transformation of the acquired data according to the HASH function H (m.) Between the image data processing unit and the data output unit ) = f {y} is provided. In a further arrangement which can be used to generate the second data record and which has an optoelectronic image converter, an image data processing unit, a data carrier and a data output unit, there is a computing circuit in the signal path between the image data processing unit, the data carrier and the data output unit provided for linking the control data record (y) with the characteristic data (x) and for the transformation according to the HASH function H (z) = f {x, y} into a second data record.

With these proposed arrangements, it is advantageously possible to carry out the method features described above in a functionally reliable manner.

Way of carrying out the invention

The invention will be explained in more detail using an exemplary embodiment. If, for example, a new user is to be included in the access authorization for a non-public data system, his name is first recorded in the user database and a control data record is generated on the basis of random data.

The control data record can be generated, for example, with the aid of an optical system, by taking the electronic image of any object, transferring it to a data processing system using frame grabbers and using a computing circuit, for example according to the HASH function H (m) = f {y}, in the control data record is transformed, which is kept on the data carrier for further use. This control data record has no relation to the characteristics of the user or to a biometric source.

In addition, the characteristic biometric features of a particular finger of this new user are recorded with high reproducibility using a high-resolution optical system, and a feature data record is obtained therefrom, which is not permanently stored on a data carrier, but is only used temporarily for linking to the control data record.

Now the control data record and the feature data record are generated by an irreversible arithmetic operation, for example likewise by means of the arithmetic circuit according to

HASH function H (m) = f {y}, transformed into a characteristic data record. This characteristic rate corresponds to a specific numerical value that is used as the basis for a YES / NO decision on access authorization.

With each access request, this value or the characteristic data record is regenerated from the combination of the permanently stored control data record with the currently obtained temporary biometric data. Out of the total possible amount of achievable values, only one is correct, i.e. only one value of the possible values entitles to access.

The user is first asked to enter his name using the keyboard, whereupon it is checked whether the user name is known; if the result is positive, the control data record is activated.

Now the user is asked to put the corresponding finger on the fingerprint scanner and the biometric data are newly recorded, an electronic image is generated again and this is in turn read into the data processing system. Similar to the minutiae detection of forensic processing, a feature extraction is now carried out in the data processing system. The reading in of the biometric features of the fingerprint with subsequent feature extraction is repeated n times.

The feature data read in and the control data record are fed to the arithmetic circuit according to the HASH function H (z) = f {x, y}, linked there and transformed into the characteristic data record or the so-called “private” data record, which takes on the function of a password.

For example, if both the user name and the key data record are passed to a control system for checking and the control results in a positive result, access to the data system is opened for the user.

Claims

Expectations

1 . Method for checking identity as a prerequisite for granting access and / or exercise authorization, in which at least one data record is generated on the basis of biometric features with the aid of a data acquisition and data processing system and in which proof of identity is carried out on the basis of the underlying biometric features, characterized in that that a first data record is generated from random data without reference to the characteristics of a biometric source and stored on a data carrier as a control data record, that the characteristic biometric features of the biometric source to be identified are recorded in a sufficiently reproducible manner and are temporarily provided in the form of a characteristic data record for linking to the control data record, whereby at least part of the feature data and at least part of the control data record are converted into a second by an irreversible arithmetic operation

The data record is transformed and the second data record is used as a characteristic data record for granting access and / or exercise authorization and / or as a cryptographic key.

2. Method for checking identity according to claim 1, characterized in that the computing operation for transforming the data is carried out according to a cryptographic HASH function.

3. A method for checking identity according to claim 1, characterized in that the characteristic biometric features are recorded several times in order to achieve sufficiently reproducible feature data and a feature extraction is carried out after each data acquisition.

4. A method for checking identity according to claim 3, characterized in that a verification of the previous data acquisition is carried out after each feature extraction.

5. A method for checking identity according to one of the preceding claims, characterized in that the generation of the control data record (y) on the basis of an opto-electronic recording of a fingerprint by the user is carried out that the image data obtained are transferred to a data processing system that based on the minutiae of the finger in question, in accordance with the aforementioned claims, data m obtained and after the HASH

Function H (m) = f {y} are transformed into the control data record and this is stored uncoded under the name of the user in a user database on the data carrier.

6. A method for checking identity according to one of the preceding claims, characterized in that for the generation of the second data record by entering the user name on a keyboard, the presence of an associated control data record (y) is checked on the data carrier and optionally called up that the opto-electronic recording of the fingerprint of the user and characteristic data (x) which can be reproduced in accordance with the aforementioned claims are obtained from the fact that the data (x) is linked to the control data record (y) and according to the HASH function H (z) = f {x, y} are transformed into a second data record, which serves as a “private” data record (z) as a criterion for granting access and / or exercise authorization and / or is used as a cryptographic key.

7. Arrangement for performing the method according to claims 1 to 6, with an opto-electronic image converter, an image data processing unit and a data output unit, characterized in that between the image data processing unit and the data output unit, a computing circuit for the irreversible transformation of the captured data after the HASH - Function H (m) = f {y} is provided.

8. Arrangement for performing the method according to claims 1 to 6, with an opto-electronic image converter, an image data processing unit, a data carrier, and a data output unit, characterized in that In the signal path between the image data processing unit, the data carrier and the data output unit, a computing circuit for linking the control data record (y) with the feature data (x) and for transformation according to the HASH function H (z) = f {x, y} is provided in a second data record is.