Automated adaptive method for identity verification with performance guarantees

Abstract

This invention provides an automated adaptive method for identity verification of claimants that attempt to get access into a resource by responding to a sequence of identifiers. The sequence has a specified maximal length and the identifiers are partitioned into multiple groups where identifiers in the same group are correlated and identifiers in different groups are not correlated. The method guarantees that an impostor will be accepted with a probability that does not exceed a specified parameter and that a legitimate claimant will be rejected with a probability that does not exceed a different specified parameter. The method also computes the probabilities that a legitimate claimant, or an impostor, will terminate an interrogation session with an inconclusive result, which would necessitate further manual interrogation. The method is adaptive as the conditional probabilities of an impostor's responses change throughout a session of interrogation.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a table illustrating the record stored in a trusted database for an identity.

FIG. 2 is a flow diagram of an identity verification session for a claimant.

FIG. 3 graphically illustrates a portion of a decision tree used to compute probabilities of inconclusive terminations.

DETAILED DESCRIPTION

Referring now to the figures and to FIG. 1 in particular, there is shown the record 100 stored for a single identity, referred to as identity r. The following notation for input parameters is used:

TABLE 1
Input Parameters for Identity r
Notation           Parameter Description
r                  Index for record r, where record r stores trusted identifiers for identity r.
k                  Index for identifiers.
g                  Index for a group of identifiers, g = 1, 2, . . . , G, where each identifier k is
                   uniquely mapped into one of the groups and G is the number of groups
idr(k)             The trusted information of identifier k in record r.
PLr(k = match)     The input estimate of the probability that a legitimate claimant for
                   identity r would respond with a match to identifier k.
PLr(k = no-match)  The input estimate of the probability that a legitimate claimant for
                   identity r would respond with a no-match to identifier k.
PI0r(k = match)    The input estimate of the probability that an ignorant impostor claiming
                   identity r would respond with a match to identifier k.
PI0r(k = no-match) The input estimate of the probability that an ignorant impostor claiming
                   identity r would respond with a no-match to identifier k.
cr(k)              “Cost” of identifier k for identity r. These parameters would help to vary
                   the probed identifiers in successive sessions for a claimant of identity r.
φg                 The input estimate of the probability that an impostor finds a “wallet”
                   with the trusted information of the identifiers in group g, which make the
                   responses as good as those of a legitimate claimant.

The record for identity r is partitioned into groups 101. The example in FIG. 1 includes 8 groups 102-109, where g is used as an index for the groups. Each group has one or more identifiers, where in this example the number of identifiers in a group is limited to no more than 3. Identifier 1 in any of the eight groups is denoted as 110, identifier 2 in any of the groups is denoted as 111 and identifier 3 in any of the groups is denoted as 112. An X in a cell of FIG. 1 indicates an identifier. Thus, for example, group 102 has only one identifier and group 104 has three identifiers. Each group g has also the input parameter φ_g. An identifier is indexed by k. The input available for each identifier k includes id_r(k), PL_r(k=match), PL_r(k=no-match), PI0_r(k=match), PI0_r(k=no-match), and c_r(k). The response to an identifier may be ambiguous. Although not required by the method, it is assumed that the probability of an ambiguous response, denoted as PV_r(k=ambiguous) is the same for a legitimate claimant and for an ignorant impostor as, typically, an ambiguous response is incurred due to noise in a communication line and other ambiguities due to accents, poor hearing, and so forth. The method can readily be changed to handle different probabilities of ambiguous responses by a legitimate claimant and by an ignorant impostor. Note that PL_r(k=match)+PL_r(k=no-match)+PV_r(k=ambiguous)=1 and PI0_r(k=match)+PI0_r(k=no-match)+PV_r(k=ambiguous)=1. The identifiers in different groups are regarded as being independent in the sense that if an impostor was able to obtain information of identifiers in one group, it does not change the probability that he/she was able to obtain information on identifiers in other groups. On the other hand, identifiers in the same group are correlated in the sense that a response by a claimant to one identifier in the group affects the probabilities of a match or no-match response by an impostor to other identifiers that have not yet been probed in the same group. The precise computation of these probabilities will be explained later.

The groups may include identifiers that are required, identifiers obtained from readily available databases, and identifiers selected by the legitimate claimant when the record is established. For example, in FIG. 1, group 102 may include a voice sample and group 103 may include a password, wherein both identifiers are required. Group 104 may include dynamic personal information obtained from databases, such as last hotel stayed at, last flight taken, and last restaurant where a meal was eaten. These identifiers are in the same group as they are typically found in the same source of information, e.g., credit card reports. Group 105 may include information on personal documents such as driver license number, and some credit card numbers. Group 106 may include geographic information like, closest hardware store to the place of residency of the legitimate owner of the identity, and the street that crosses the legitimate owner's street to the right of his/her house, and so forth.

FIG. 2, is a flow diagram 200 illustrating a typical session for a claimant for identity r. A record for identity r with G groups of identifiers was previously established, as explained in conjunction with FIG. 1. At a start of a session, at step 201 a claimant requests access to a resource. At that time the system has knowledge of all the information in record r.

The generic notation outcome is used for the response to identifier k (match, no-match, or ambiguous). The input parameter φ_g, 0≦φ_g≦1, is the probability that an impostor finds a “wallet” with the information for all identifiers in group g. Consider identifier k ∈ g and suppose no other identifiers from group g have so far been probed. Let PI_r(k=outcome) be the probability that a random (ignorant or well-informed) impostor provides an outcome response for identifier k. This probability is a combination of PI0_r(k=outcome) and of PL_r(k=outcome). Specifically, it is:

PI _r(k=outcome)=(1−φ_g)PI0_r(k=outcome)+φ_gPL_r(k=outcome).   (1)

Note that when it is assumed that PI_r(k=ambiguous)=PL_r(k=ambiguous)=PV_r(k=ambiguous), Equation (1) can then rewritten as:

PI _r(k=match)=(1−φ_g)PI0_r(k=match)+φ_gPL_r(k=match),   (2.1)

PI _r(k=no-match)=1−PI_r(k=match)−PV_r(k=ambiguous).   (2.2)

The legitimate claimant probabilities PL_r(k=outcome) remain unchanged during the session; i.e.; they are independent of the claimant's responses. On the other hand, the response probabilities for a match or no-match of a random (ignorant or well-informed) impostor may change during a session, depending on the responses.

The set K={k₁, . . . , k_j, . . . , k_q} is defined as the ordered set of identifiers already probed during the session. Each of the elements in the set represents a probed identifier and the response (match, no-match, or ambiguous) provided by the claimant to that identifier. K is partitioned into G subsets, one for each group g. These subsets are denoted as K_g={k ∈ g & k ∈ K} for g=1, 2, . . . , G.

Select best identifier 202

The method next selects at each point in time during a session the best identifier in step 202. The following notation is introduced:

• • PI_r(k=outcome|K)=The conditional probability that a random (ignorant or well-informed) impostor claiming identity r responds with outcome to identifier k ∉ K, given that the session so far has produced the responses of K.
  • P0_r(K_g)=The joint probability that an ignorant impostor claiming identity r would provide responses as specified by the set K_g.
  • P_r(K_g)=The joint probability that a random (ignorant or well-informed) impostor claiming identity r would provide responses as specified by the set K_g.
  • Q_r(K_g)=The joint probability that a legitimate claimant of identity r would provide responses as specified by the set K_g.These joint probabilities are:

$\begin{array}{cc}P0_r\left(K_g\right)=\prod _{k_j\in K_g}{\mathrm{PIO}}_r\left(k_j={\mathrm{outcome}}_j\right),& \left(3.1\right)\\ Q_r\left(K_g\right)=\prod _{k_j\in K_g}{\mathrm{PL}}_r\left(k_j={\mathrm{outcome}}_j\right),& \left(3.2\right)\end{array}$ P _r(K_g)=(1−φ_g)P0_r(K_g)+φ_gQ_r(K_g),   (3.3)

where outcome_j is the response to identifier k_j. Equation (3.3) follows directly from (3.1), (3.2), and the conception of a random impostor as behaving either ignorantly or as a legitimate claimant, depending on whether a wallet for group g is in the possession of the impostor, which happens with probability φ_g.

The method selects the next identifier as the one that would approximately yield the largest expected decrease in the ratio of the joint probabilities P_r(K)/Q_r(K) per unit cost. Specifically, for any identifier k that is still available for probing, the following expressions are computed:

$\begin{array}{cc}{G}_r\left(kK_g\right)={\mathrm{PL}}_r\left(k=\mathrm{match}\right)\log \left(\frac{{\mathrm{PL}}_r\left(k=\mathrm{match}\right)}{{\mathrm{PI}}_r\left(k=\mathrm{match}K_g\right)}\right)+{\mathrm{PL}}_r\left(k=\text{no-match}\right)\log \left(\frac{{\mathrm{PL}}_r\left(k=\text{no-match}\right)}{{\mathrm{PI}}_r\left(k=\text{no-match}K_g\right)}\right)\mathrm{and}& \left(4.1\right)\\ {\mathrm{Value}}_r\left(k\right)=\frac{G_r\left(kK_g\right)}{c_r\left(k\right)}.& \left(4.2\right)\end{array}$

The identifier that provides the largest ratio Value_r(k) is selected as the best identifier that will be used. Note that since PV_r(k=ambiguous) is assumed to be the same for an impostor or a legitimate claimant, the corresponding term (not shown in right-hand-side of equation (4.1)) is zero. For the first identifier (sets K_g are empty), the conditional probabilities are simply replaced by the prior probabilities at the beginning of the session. The conditional probabilities that will be used in subsequent iterations are computed later as will be described in conjunction with step 208. The identifier selection based on equations (4.1)-(4.2) is given as an example. Various other expressions that approximate the largest expected decrease in the ratio of the joint probabilities P_r(K)/Q_r(K) per unit cost can also be used.

The “cost” parameters c_r(k) can be set to one when the record for identity r is established. When identifier k is probed during a session c_r(k) is increased. This would reduce the likelihood that identifier k would be used repeatedly in successive sessions by a claimant for identity r. Alternatively, instead of using cost parameters, the method can select randomly one of the N best identifiers, where N is a specified input. Both of these schemes would lead to some diversity in the identifiers probed in successive sessions.

Probe Claimant and Receive Response 203

After the best identifier is selected, the claimant is probed, and a response from the claimant is received in step 203.

Compute Joint Probabilities of Responses 204

Let P0_r(K_g)=Q_r(K_g)=1 for K_g=Ø. Suppose k ∈ g is the most recent identifier probed and k ∈ K_g. The method can compute the joint probabilities of equation (3.1) and equation (3.2) either directly or by using the following recursive equations:

P0_r(K_g ␣ k)=P0_r(K_g)PI0_r(k=outcome),   (5.1)

Q _r(K_g ␣ k)=Q_r(K_g)PL_r(k=outcome).   (5.2)

Let

• • P_r(K)=The joint probability that a random (ignorant or well-informed) impostor claiming identity r would provide responses as specified by the set K.
  • Q_r(K)=The joint probability that a legitimate claimant of identity r would provide responses as specified by the set K.

Let P_r(K)=Q_r(K)=1 for K=Ø. Suppose k is the most recent identifier probed and thus added into K. The overall joint probabilities P_r(K) and Q_r(K) are the products, over the groups g, of the corresponding probabilities P_r(K_g) and Q_r(K_g) for the individual groups g, so the method can compute the overall joint probabilities, either directly by multiplying appropriately the individual joint probabilities determined by equations (3.1), (3.2), and (3.3), or by using the following recursive equations in step 204:

P _r(K␣k)=P_r(K)PI_r(k=outcome|K),   (6.1)

Q _r(K␣k)=Q_r(K)PL_r(k=outcome).   (6.2)

Test Whether the Claimant is Accepted 205

After the joint probabilities P_r(K) and Q_r(K) are recomputed with the latest response, the method computes the ratio of the joint probabilities. If

P _r(K)/Q_r(K)≦α,   (7)

then in step 205 the claimant is accepted as a legitimate claimant for identity r. Condition (7) guarantees that an impostor will be erroneously accepted with a probability that does not exceed α. Note that the ratio test includes joint probabilities for both the legitimate claimant and the impostor. The superficially tempting acceptance condition P_r(K)≦α is a necessary one for attaining the desired low probability for admitting an impostor, but it may not suffice. For instance, if K′ and K″ are two possible response histories that satisfy α/2<P_r(K′)≦α and α/2<P_r(K″)≦α, and if the access-control procedure were to specify granting access when encountering these histories, then the probability of an impostor gaining access would be at least as large as P_r(K′)+P_r(K″)>α, violating the design goal.

If condition (7) is satisfied, the claimant is accepted in step 205 and the session terminates as indicated by step 209.

Test Whether the Claimant is Rejected 206

After the joint probabilities P_r(K) and Q_r(K) are recomputed with the latest response, the method computes the ratio of the joint probabilities. If

Q _r(K)/P_r(K)≦β,   (8)

then the claimant is rejected as a legitimate claimant for identity r in step 206. Condition (8) guarantees that a legitimate claimant will be erroneously rejected with a probability that does not exceed β. Note that the ratio test includes joint probabilities for both the legitimate claimant and the impostor. The superficially tempting rejection condition Q_r(K)≦β is a necessary one for attaining the desired low probability for erroneously rejecting a legitimate claimant, but it may not suffice.

If condition (8) is satisfied, the claimant is rejected in step 206 and the session terminates as indicated by step 209.

Test Whether the Session Should Terminate with an Inconclusive Result 207

Suppose the session has not been terminated with an acceptance in step 205 or rejection in step 206 of the claimant. Then, if the number of identifiers probed reached a predetermined quantity S, the session terminates with an inconclusive result as indicated by step 207. If S identifiers were used, the session terminates as indicated by step 209. If less than S identifiers were used, the session continues with step 208.

Re-Compute Impostor's Conditional Probabilities 208

Suppose the latest identifier probed is in group g. In step 208 the method then re-computes the impostor's conditional probabilities for all identifiers in group g that have not yet been probed. Specifically, the method re-computes

$\begin{array}{cc}\begin{array}{c}{\mathrm{PI}}_r\left(k=\text{outcome}K_g\right)=\frac{{\mathrm{PI}}_r\left(K_g\bigcup k\right)}{{\mathrm{PI}}_r\left(K_g\right)}\\ =\frac{\begin{array}{c}\left(1-{\varphi }_g\right)P0_r\left(K_g\right){\mathrm{PIO}}_r\left(k=\text{outcome}\right)+\\ {\varphi }_gQ_r\left(K_g\right){\mathrm{PL}}_r\left(k=\text{outcome}\right)\end{array}}{\left(1-{\varphi }_g\right)P0_r\left(K_g\right)+{\varphi }_gQ_r\left(K_g\right)}.\end{array}& \left(9\right)\end{array}$

After the updates the session continues with a new iteration as indicated by the arrow 210 leading from step 208 to step 202 in FIG. 2.

The example below illustrates the changes in an impostor's conditional probabilities. Suppose PI0_r(k=match)=0.01, k ∈ g, φ_g=0.01, and PL_r(k=match)=0.9 for all identifiers in group g. The probability that an (ignorant or well-informed) impostor responds with a match to the first probed identifier from group g is by equation (1) PI_r(k=match)=0.019. Suppose the first probed identifier results in a match response. Using equation (9), the impostor's conditional probability for a match with a second identifier from group g is 0.434. Suppose the second identifier also results in a match response. The impostor's conditional probability for a match with a third identifier from group g is 0.889. Hence, after the first two matches, the impostor's conditional probability for responding with a match for the remaining identifiers in group g is almost the same as that of a legitimate claimant. Hence, there is hardly any value in probing more identifiers from group g. If the first two probes result in one match and one no-match, the impostor's conditional probability for a match with a third identifier from group g is 0.085.

Probabilities of an Inconclusive Termination, and Granting or Denying Access

An inconclusive termination of a session occurs when the number of identifiers probed reaches S and the claimant has neither been accepted nor rejected. Consider the case of a legitimate claimant. The probability of an inconclusive termination of a session for a legitimate claimant is derived by enumerating all possible sequences of responses in the session. An effective method of executing this enumeration is by building a tree, where each of the nodes of the tree would indicate a set of identifiers K that has already been probed and associated information.

FIG. 3 shows a portion of a decision tree 300 having one parent node 301 and its children nodes 305, 306, and 307. Node 301 is represented by the set of identifiers K that have already been probed. The node 301 also has the values of joint probabilities Q_r(K_g), P0_r(K_g) for all groups g, joint probabilities Q_r(K) and P_r(K), and all the impostor's conditional probabilities. It is assumed in this example that the session did not terminate at node 301. The node then selects the next identifier, denoted as k, to be probed as explained above in “select best identifier 202” in conjunction with FIG. 2. The method then generates three outgoing links 302, 303, and 304 from node 301. Link 302 represents a match for identifier k and generates a new node 305. Node 305 is represented by the set of identifiers K␣k when k is a match. Node 305 computes the new joint probabilities Q_r(K_g␣k), P0_r(K_g␣k) for group g that includes identifier k, joint probabilities Q_r(K␣k), P_r(K␣k), and all the impostor's new conditional probabilities. The method then checks whether the session should be terminated or not as explained in conjunction with steps 205-207 in FIG. 2. If the answer is yes, the node is marked as terminal and will not be selected for further branching in subsequent iterations. If the session ends with an inconclusive result, Q_r(K_g␣k) is added to a counter that accumulates probabilities of inconclusive terminations. If the node is not terminal, it would be selected in a future iteration for further branching. Link 303 represents a no-match for identifier k and generates a new node 306. Link 304 represents an ambiguous response for identifier k and generates a new node 307. The computations at nodes 306 and 307 are the same as those done at node 305.

The method for computing the probability of inconclusive terminations for a legitimate claimant generates a tree starting from a root node with K=Ø, which is initially treated as an unmarked node. At each iteration, the method selects an unmarked node with the set of identifiers K. The method selects the best identifier, say identifier k, as the next one to be probed and generates three links and three new nodes with a set of identifiers already probed K␣k, after which, the selected node is marked as having been handled. Note that each of the three nodes represented by the set K␣k have different responses to identifier k, one with a match, a second with a no-match, and a third with an ambiguous response. The computations done at each of the new nodes are as described in conjunction with the description of FIG. 2. Some of the new nodes may be marked as terminal, and if a node is marked as terminal due to inconclusive termination, the corresponding joint probability Q_r(K␣k) is added to a counter that accumulates probabilities of inconclusive terminations for a legitimate claimant. Otherwise, a new non-terminating node is treated as being unmarked, and is added to the set of unmarked nodes. The method then selects an unmarked node and generates three new links from that node, and so forth. The computations are completed when all nodes have been marked as either terminal or as having been handled.

The method can also compute the probability of accepting a legitimate claimant by summing all joint probabilities Q_r(K) at nodes marked as terminal when the claimant is accepted, and the probability of rejecting a legitimate claimant by summing all joint probabilities Q_r(K) at nodes marked as terminal when the claimant is rejected (the latter sum will not exceed β).

Likewise, the method can compute the probability of inconclusive terminations for an impostor by summing all joint probabilities P_r(K) at nodes marked as terminal with inconclusive termination. The method can also compute the probability of accepting an impostor by summing all joint probabilities P_r(K) at nodes marked as terminal when the claimant is accepted (the sum will not exceed α), and the probability of rejecting an impostor by summing all joint probabilities P_r(K) at nodes marked as terminal when the claimant is rejected.

The above described method can be practiced on any interactive system where a claimant can interact and provide responses to probes of identifiers. Typical systems include an automated telephone system coupled to a dedicated database containing information of multiple identifiers, an interactive computer connected to a dedicated database containing information of multiple identifiers for each identity, and the like as are known in the art.

While there has been described and illustrated an automated adaptive method for identity verification with quantified performance guarantees, it will be apparent to those skilled in the art that variations and modifications are possible without deviating from the broad scope and teachings of the present invention which shall be limited solely by the scope of the claims appended hereto.

Claims

1. A method for verifying the identity of a claimant attempting to access a resource comprising the steps of: providing a trusted database containing information of multiple identifiers for each identity where the identifiers are partitioned into multiple groups and identifiers in the same group are correlated and identifiers in different groups are not correlated;interrogating a claimant during a session so that an impostor will gain access to the resource with a probability that does not exceed a first specified parameter and that a legitimate claimant will be denied access to the resource with a probability that does not exceed a second specified parameter;calculating probabilities that the interrogation session of a legitimate claimant will grant access, deny access, or terminate inconclusively without acceptance or rejection of the claimant, andcalculating probabilities that the interrogation session of an impostor will grant access, deny access, or terminate inconclusively without acceptance or rejection of the claimant.

2. The method as set forth in claim 1, wherein the interrogation session of a claimant comprises adaptively selecting a sequence of identifiers, the quantity of identifiers in the sequence not exceeding a predetermined value, and each response by the claimant being characterized as matching the information in the database or as not matching the information in the database or as being ambiguous.

3. The method as set forth in claim 2, wherein each identifier in the sequence is selected as the identifier that approximately provides the largest expected decrease in the ratio of the joint probability of responses of an imposter to the joint probability of responses of a legitimate claimant per unit cost.

4. The method as set forth in claim 1, wherein for any specified group of identifiers an impostor may be either an ignorant impostor that has specified probabilities of providing a match, no-match, or an ambiguous response to an identifier or a knowledgeable impostor that has the same probabilities of providing a match, no-match, or an ambiguous response to an identifier in the specified group of identifiers as a legitimate claimant.

5. The method as set forth in claim 4, wherein the conditional probabilities of an impostor responding to identifiers not yet probed are recomputed based on the responses to previously probed identifiers.

6. The method as set forth in claim 1, further comprising the step of determining after each response whether access should be granted while guaranteeing that an impostor is granted access with a probability that does not exceed the first specified parameter.

7. The method as set forth in claim 1, further comprising the step of determining after each response whether access should be denied while guaranteeing that a legitimate claimant is denied access with a probability that does not exceed said second specified parameter.

8. A method for verifying the identity of a claimant attempting to access a resource comprising the steps of: providing a trusted database containing information of multiple identifiers for each identity where the identifiers are partitioned into multiple groups and identifiers in the same group are correlated and identifiers in different groups are not correlated;selecting one at a time the identifier that approximately provides the largest expected decrease in the ratio of the joint probability of responses of an impostor to the joint probability of responses of a legitimate claimant per unit cost; andcomputing joint probabilities of responses for a legitimate claimant and for an impostor using equations P0r(Kg)=Qr(Kg)=1 for Kg=Ø,P0r(Kg␣k)=P0(Kg)PI0r(k=outcome),Qr(Kg␣k)=Qr(Kg)PLr(k=outcome),Pr(K)=Qr(K)=1 for K=Ø,Pr(K␣k)=Pr(K)PIr(k=outcome|K), andQr(K␣k)=Qr(K)PLr(k=outcome),

9. The method as set forth in claim 8, wherein the approximation for the largest expected decrease in the ratio of the joint probability of an imposter of responses to the legitimate joint probability of a claimant of responses per unit cost is computed by the equations

10. The method as set forth in claim 8, wherein the claimant that cannot be accepted while guaranteeing that an impostor will be accepted with a probability that does not exceed a first specified parameter undergoes manual interrogation.

11. The method as set forth in claim 8, further comprising the step of calculating probabilities that the interrogation session of a legitimate claimant will grant access, deny access or terminate inconclusively without acceptance or rejection of the claimant.

12. The method as set forth in claim 8, further comprising the step of calculating probabilities that an interrogation session of an impostor will grant access, deny access, or terminate inconclusively without acceptance or rejection of the claimant.

13. A system for verifying the identity of a claimant attempting to access a resource comprising: means for providing a trusted database containing information of multiple identifiers for each identity where the identifiers are partitioned into multiple groups and identifiers in the same group are correlated and identifiers in different groups are not correlated;means for interrogating a claimant during a session so that an impostor will gain access to the resource with a probability that does not exceed a first specified parameter and that a legitimate claimant will be denied access to the resource with a probability that does not exceed a second specified parameter; andmeans for calculating probabilities that the interrogation session of a legitimate claimant will grant access, deny access, or terminate inconclusively without acceptance or rejection of the claimant, andmeans for calculating probabilities that the interrogation session of an impostor will grant access, deny access, or terminate inconclusively without acceptance or rejection of the claimant.

14. The system as set forth in claim 13, further comprising means for determining after each response whether access should be granted while guaranteeing that an impostor is granted access with a probability that does not exceed the first specified parameter.

15. The system as set forth in claim 13, further comprising means for determining after each response whether access should be denied while guaranteeing that a legitimate claimant is denied access with a probability that does not exceed the second specified parameter.

16. A system for verifying the identity of a claimant attempting to access a resource comprising: a trusted database containing information of multiple identifiers for each identity where the identifiers are partitioned into multiple groups and identifiers in the same group are correlated and identifiers in different groups are not correlated;means for selecting one at a time the identifier that approximately provides the largest expected decrease in the ratio of the joint probability of responses of an impostor to the joint probability of responses of a legitimate claimant per unit cost,means for computing joint probabilities of responses for a legitimate claimant and for an impostor using equations P0r(Kg)=Qr(Kg)=1 for Kg=Ø,P0r(Kg␣k)=P0r(Kg)PI0r(k=outcome),Qr(Kg␣k)=Qr(Kg)PLr(k=outcome),Pr(K)=Qr(K)=1 for K=Ø,Pr(K␣k)=Pr(K)PIr(k=outcome|K), andQr(K␣k)=Qr(K)PLr(k=outcome),

17. The system as set forth in claim 16, further comprising means for calculating probabilities that an interrogation session of a legitimate claimant will grant access, deny access or terminate inconclusively without acceptance or rejection of the claimant.

18. The system as set forth in claim 16, further comprising means for calculating probabilities that an interrogation session of an impostor will grant access, deny access, or terminate inconclusively without acceptance or rejection of the claimant.

19. A program storage device, readable by machine, tangibly embodying a program of instructions executable by the machine to cause the machine to perform a method for verifying the identity of a claimant attempting to access a resource comprising the steps of: providing a trusted database containing information of multiple identifiers for each identity where the identifiers are partitioned into multiple groups and identifiers in the same group are correlated and identifiers in different groups are not correlated;interrogating a claimant during a session so that an impostor will gain access to the resource with a probability that does not exceed a first specified parameter and that a legitimate claimant will be denied access to the resource with a probability that does not exceed a second specified parameter;calculating probabilities that the interrogation session of a legitimate claimant will grant access, deny access, or terminate inconclusively without acceptance or rejection of the claimant, andcalculating probabilities that the interrogation session of an impostor will grant access, deny access, or terminate inconclusively without acceptance or rejection of the claimant.

20. A program storage device, readable by machine, tangibly embodying a program of instructions executable by the machine to cause the machine to perform a method for verifying the identity of a claimant attempting to access a resource comprising the steps of: providing a trusted database containing information of multiple identifiers for each identity where the identifiers are partitioned into multiple groups and identifiers in the same group are correlated and identifiers in different groups are not correlated;selecting one at a time the identifier that approximately provides the largest expected decrease in the ratio of the joint probability of responses of an impostor to the joint probability of responses of a legitimate claimant per unit cost;computing joint probabilities of responses for a legitimate claimant and for an impostor using equations P0r(Kg)=Qr(Kg)=1 for Kg=Ø,P0r(Kg␣k)=P0r(Kg )PI0r(k=outcome),Qr(Kg␣k)=Qr(Kg )PLr(k=outcome),Pr(K)=Qr(K)=1 for K=Ø,Pr(K␣k)=Pr(K)PIr(k=outcome|K), andQr(K␣k)=Qr(K)PLr(k=outcome),