WO2000060533A1

WO2000060533A1 - Method and device for user authentication

Info

Publication number: WO2000060533A1
Application number: PCT/DE2000/001020
Authority: WO
Inventors: Bernhard Raaf
Original assignee: Siemens Aktiengesellschaft
Priority date: 1999-04-06
Filing date: 2000-04-03
Publication date: 2000-10-12
Also published as: CN1346476A; HUP0200636A2; EP1173824A1

Abstract

The invention relates to a method and a device for user authentication on the basis of a biometric complex of characteristics which is detected in the form of a surface pattern. From said surface pattern a plurality of characteristic elements are extracted, quantized positional and/or directional relations of said characteristic elements in relation to each other and/or to defined reference points or reference directions are determined, a number is assigned to each characteristic element and an identification number is calculated from said numbers.

Description

description

Method and device for user authentication

The present invention relates to a method and a

User authentication device, i.e. to check a person's access authorization to an object, system or service in the most general sense.

With the explosive spread of new information and communication technologies, the testing of access and access rights to various types of devices, systems and services is becoming increasingly important and, on the one hand, with increasing emphasis requires user-friendly and, on the other hand, highly reliable solutions. The limits of the use of secret numbers (PIN) and passwords have been reached in an environment in which practically everyone has a multitude of access rights to different devices and systems and has to prove them on a daily basis, and in which, on the other hand, there are ever better opportunities for researching such access rights . For this reason, user authentication is becoming increasingly important due to the highly individual and unambiguous biometric features.

Authentication methods and devices based on such features, such as the papillary line or retinal pattern, are known and are already in practical use, for example, in access control systems for building objects or in ATMs. They are based on the fact that the individual papillary line or retinal pattern of an authorized user is stored in the access control system and that an access seeker registers his fingerprint or retina pattern using a suitable recording device and with the stored pattern of the

Authorized persons must be compared. With additional identifiers, such as name, personnel or customer number or PIN, the specification of a single potentially authorized person usually takes place, so that only the area pattern assigned to this authorized person has to be compared with the corresponding area pattern of the person currently seeking access. This considerably simplifies and speeds up the work of such systems, so that their use in devices of daily use, in which user authentication is necessary or expedient, is increasingly being considered.

As is well known, the use of a mobile phone is only possible after entering a four-digit PIN, which is assigned to the user when the contract is concluded and is stored on the SIM card. The access authorization to the network is granted (or refused) each time the mobile phone is switched on as a result of a comparison of the entered PIN with the saved PIN. In the interest of uncomplicated handling, no user authentication is required for every system access (call) in the conventional mobile radio systems; however, this has the disadvantage, as is known, that a switched-on mobile phone can easily be misused.

In addition, the usual PIN authentication, which is defined in the system protocols, has the above-mentioned fundamental disadvantages, in particular the disadvantage of the inconvenience of memorizing and the repeated use of an increasing number of PINs in daily life. In this context, it should also be pointed out that the PIN basically represents pure software, which in principle can also be copied or simulated using only software means, while user authentication due to biometric features in relation to the body of the accessing person is always "hardware""Mapping includes. In addition, the inconvenience of entering a PIN or password by a plurality of key presses repeatedly gives rise to workarounds. For example, with some cellular services the Deactivate users completely (at their own risk).

Finally, it should be pointed out that there is a clear trend, particularly in the case of mobile telephones, to make handling easier by largely dispensing with keystrokes. In many newer devices, at least the alphanumeric keys are covered in the standard use, and entering numbers is increasingly restricted to special cases. Keyboardless "Easyphones" are also under discussion. This trend is countered by user authentication by entering a PIN.

In view of the obvious advantages of biometric authentication, in particular the unforgeability and the extremely high expenditure for copying or forging a biometric feature complex, its use has therefore also been proposed for access control of mobile telephones.

According to a solution previously proposed by the applicant, a PIN can be calculated from the surface pattern of a fingerprint based on a predetermined coding algorithm. This is then compared in the usual way with the PIN stored on the SIM card. In this context, it was also proposed to use different authorization algorithms to calculate the same PIN from the fingerprints of several authorized users and thus to enable all authorized persons to use the mobile phone. This proposed solution is system-compliant to the GSM standard and combines increased user friendliness with greater security, but requires the storage and processing of very large amounts of data in the order of 1 GB and is therefore currently only practically feasible. The invention is therefore based on the object of specifying a method and a device for user authentication which requires relatively little storage and processing effort.

This object is achieved by a method with the features of claim 1 and a device with the features of claim 8.

The invention includes the essential idea of carrying out an extraction of characteristic elements after the image processing evaluation of an entire biometric feature complex present as a surface pattern, and the positional or directional relationships of the selected elements to one another or to predetermined reference points or directions according to one for a digital one Processing appropriate scheme to determine and code. An identification marking (PIN or password or the like) is then determined from the relatively small number of numbers thus determined, which is subjected to a comparison with a stored identification marking.

As characteristic elements of an individual surface pattern, line ends and branches of a line pattern contained in the detected surface pattern, especially the papillary lines of a fingerprint, are preferably evaluated with regard to their position or directional relationships. In addition, however, other characteristic features, such as the so-called "white lines", inclusions or delta areas, can be registered by assigning a binary code under position and / or direction information, likewise contained in a corresponding binary number. For other biometric feature complexes that can be represented as surface patterns, other characteristic elements or points can be found that enable an evaluation with a reduced memory requirement, for example local minima and maxima for a speech frequency or voice diagram. Since the solution according to the invention deliberately proceeds from a point-by-point comparison of the biometric pattern to be evaluated and its advantages with regard to the storage space requirement, in particular when the characteristic features are relatively roughly assigned, the choice is made of a suitable error-correcting one Calculation algorithm to ensure that detection and assignment errors remain to a limited extent without affecting the identification of the identification. Known error-correcting codes such as the convolutional codes, Reed-Solomon codes or block codes are only mentioned here by way of example. Established coding methods known to those skilled in the art from communications technology can be used analogously with a similar objective.

If the calculation rule includes predefined "scrambling", any given identification marking can nevertheless be generated from a given, individually stable complex of features. Conversely, the availability of several calculation rules specifically adapted to the individual feature complexes of the individual authorized users enables the derivation of one and the same identification marking from different biometric feature complexes, so that in such an embodiment an authentication of several users on the basis of a single stored identification Labeling is possible.

In an embodiment in which the identification marking is to be derived exclusively from the biometric feature complex, i.e. a parallel or auxiliary key entry is not provided, the identification (PIN or the like) does not even have to be known to the authorized user, but rather the storage sufficient in the device or system to be protected or, more precisely, the assigned access control system. This variant is special User-friendly, but there may be access problems due to the lack of the possibility to enter the label on the label in individual cases (e.g. with heavily soiled fingers). If, with a view to this problem, the system is designed for a key input parallel to the detection of the biometric feature complex, there is preferably the possibility of changing the identification, for which purpose one or more reserve calculation algorithms are available. Since each method calculates a different label for one and the same papillary line pattern, a number of reserve labels is available corresponding to the number of additional calculation methods.

By including error limit information when extracting the element numbers, it is possible to express the amount by which the position or direction of a feature would have to be shifted so that another element number (especially binary number or bit sequence) arises. On this basis, a so-called "soft decision" can be carried out in the subsequent coding.

Advantages and practicalities of the invention result from the subclaims and the following explanation of preferred embodiments with reference to the figures. Of these show

1 shows a papillary line pattern with various characteristic feature elements,

2 shows two examples of the binary coding of the direction or position of a feature element relative to one

Frame of reference,

3 shows an illustration to explain the evaluation of a predetermined set of features of a fingerprint for determining a PIN; and FIG. 4 shows a schematic functional block diagram of a device for user authentication on a mobile phone. 1 shows the papillary line pattern of a fingerprint as an example of a surface pattern representing a biometric feature complex. The numbers denote various characteristic features, namely number 1 the center, number 2 a fork, number 3 white lines, number 4 a so-called inclusion, number 5 a so-called right delta, number 6 an (abrupt) line end and number 7 a so-called left delta. The preferred embodiment of the proposed method is based on the binary coding of the position and / or orientation of such feature elements and the subsequent conversion of the n-tuple from the n binary numbers obtained into a PIN.

FIG. 2 is intended to illustrate how the encoding of the position or direction information associated with the features can be carried out in principle. In the left part of FIG. 2, an arrow is symbolically shown as a feature or surface pattern element in a Cartesian coordinate system, to which a reference direction (shown as a double arrow) is assigned. As shown in the figure, the direction of the feature in the binary representation is represented by two bits, a differentiation taking place according to the quadrant in which the arrow points. In the example shown, the direction of the arrow would have the binary representation "10".

The right part of FIG. 2 shows how the binary representation of the position of a feature (filled circle) takes place in the same Cartesian coordinate system with a stored reference direction. The filled circle shown here has the binary position label "11".

Generally speaking, one or more positions or directions can be stored, whereby in the simplest case one bit (1 or 0) is sufficient for a - very rough - identification: the feature closest to a defined position is in the defined direction with respect to this Position, for example a "1" is given, otherwise a "0". By using multi-valued symbols, an assignment to several positions / distances or directions is possible, which is in a certain analogy to an n-QPSK modulation in telecommunications.

The direction of a feature (for example a branch or a line end of a papillary line pattern) can also be expressed in the simplest case by a bit, for example by a "0" for an upward feature and a "1" for a backward feature. (Of course, data regarding the reference position (s) or direction (s) must also be carried.)

As with the identification of the positions, a more precise directional distinction is also possible through multi-valued symbols, for example with two bits the distinction between four directions, which is somewhat analogous to an n-PSK modulation in transmission technology. Basically, it is within the scope of the invention to use numerical (binary)

Representation of the feature location and direction with a relatively coarse resolution, which is just sufficient for sufficiently reliable authentication based on biometric feature complexes. This reduces the storage space requirement and the evaluation time required.

An identification of the feature type or the feature class is added to the position and / or direction information expressed in this or similar manner, for example using a coordinate grid (see further below). This can consist, for example, in a binary representation of the reference number used for the different feature types in FIG. 1. If, for example, in a simplified version only line branches and line ends are used, one bit (1 or 0) is sufficient to identify the type of feature. FIG. 3 shows how a coordinate grid is stored over the entire area of a fingerprint according to FIG. 1 (outlined in dashed lines) in order to be able to provide a sufficiently precise position and directional representation of selected features. In this figure, line branches in the form of a "Y" and line ends are symbolized as open circles; the binary representation would be - as already mentioned above - "1" or "0". In the example according to the figure, the coordinate grid has 6 x 9 = 54 reference fields, so that the location identification of a feature is possible with 7 bits. The direction of the branch points (feature type "1") is expediently expressed with two additional bits (oriented upwards, downwards, to the right or to the left), so that each element binary number has ten digits. In the example, the number of evaluated feature elements is 31, so that the papillary line pattern can be represented by an n-tuple with n = 31 and (idealized) a total of 310 bit word length. However, this is already a very detailed representation, and normally the evaluation of a smaller number of features with a coarser coordinate grid will be sufficient to generate a PIN for access control to a mobile radio network, which leads to a correspondingly reduced scope of the binary representation.

As already mentioned above, in order to obtain a PIN, the bit sequence representing the feature complex is subjected to a known redundant or error-correcting coding according to the Reed-Solomon or another known method. The PIN obtained in this way serves as a basis for comparison with a PIN stored on the SIM card during the actual authentication process.

4 shows a sketch of the functional components of a device for user authentication on a mobile phone 10 with a SIM card 20 which are essential in connection with the explanation of an embodiment of the invention. In a PIN memory area 21 of the SIM card is that of the car - Assigned PIN saved to the user. The mobile telephone 10 has a CCD sensor module assigned to a finger recess 11a for image-wise detection of the papillary line pattern of the fingertip of a user, to which an image processing stage 12 is arranged. Its output is connected to a feature extraction stage 13, which is followed by a feature encoder 14. Its output is connected to a PIN calculation stage 15, which accesses a non-volatile algorithm memory 16 and whose output is connected to an input of a PIN comparator unit 17, which in turn is implemented here (according to the GSM protocol) on the SIM card and whose other input is connected to the PIN memory area 21 of the SIM card is connected. At the output of the PIN comparator unit 17 there is an authentication signal obtained by comparing the pre-stored PIN with a PIN calculated from the papillary line pattern based on a pre-stored algorithm, with which - if they match - a network access and / or access to the SIM card stored data or - if they do not match - its refusal is controlled.

The embodiment of the invention is not limited to the described embodiments, but is also possible in a large number of modifications. A mobile phone is only one of many areas of application; others are computer, database, data service or media access control. The advantages of the proposed solution also enable it to be used in the private sector, for example in access control for television sets or Internet services. The assignment of the identification memory and the comparator means, especially in systems using fewer "intelligent" chip cards, can also - instead of being implemented on the chip card - to the actual device or to the network, i.e. to a central database or the like.

Claims

claims

1. A method for user authentication when accessing an object, system or service based on a biometric feature complex recorded as a surface pattern, a plurality of characteristic feature elements being extracted from the surface pattern, characterized in that quantized position and / or directional relationships of the feature elements to one another and / or are determined to predetermined reference points or directions and, as a result, an element number, in particular element binary number, is ascribed to each feature element and a numerical or alphanumeric identification identifier is calculated from the element numbers using a predetermined coding algorithm and these are also calculated with a pre-stored identification identifier is compared.

2. The method according to claim 1, characterized in that selected as characteristic feature elements line ends (6) and / or branches (2) of a line pattern contained in the surface pattern are extracted and in the number of elements in each case a position and one on the lines - History-related direction information, based on a reference direction, is included.

3. The method according to claim 1 or 2, characterized in that an error-correcting coding algorithm is used to calculate the identification marking from the element numbers.

4. The method according to any one of the preceding claims, characterized in that an error limit information is included in the formation of the element numbers, which the probability of Applying the position and / or directional relationship expressed in the respective number of elements quantified as a function of the resolution of the predetermined reference points or directions.

5. The method according to any one of the preceding claims, characterized in that from the extracted characteristic features of a partial area of the surface pattern or based on a subset of the extracted feature elements, position and position correction information, in particular in the form of a transformation binary number, which is derived in the step the determination of quantized location and / or directional relationships is applied.

6. The method according to any one of the preceding claims, characterized in that a predetermined amount of coding algorithms is provided, one of which can be selected by the user.

7. The method according to any one of the preceding claims, characterized by the application in a mobile radio terminal (10) each time it is switched on and / or before each connection is established.

8. Device for performing the method according to one of the preceding claims, with a surface pattern detection device (11), one of the surface pattern detection device at least indirectly subordinate feature extraction device (13), a binary feature encoder (14) downstream of the feature extraction device for formation element binary words for each of the characteristic features extracted in the feature extraction device, an identification marking calculation stage (15) for calculating an identification marking from the elements binary words on the basis of a calculation algorithm, in particular an error-correcting calculation algorithm stored in an algorithm memory (16), and an identification marking comparator unit (17) for comparing the identification marking derived from the area pattern with a pre-stored identification marking and for outputting an authentication signal reflecting the comparison result .

9. Mobile phone (10) with a device (11 to 17) after

Claim 8, characterized in that an identification identification memory (21) is provided on a SIM card (20) and is connected on the output side to the identification identification comparator unit (17).