Patent Application
20060072793
The present invention is generally related to biometric systems. The present invention is also directed to methods of and systems related to biometric iris detection. More particularly, the present invention is related to methods enabling user manipulation of a biometric iris detection system through an iris scanner or reader.
Providing adequate security for electronic and mechanical systems has rapidly become an important issue in recent years. With the proliferation of computers, computer networks and other electronic device and networks into all aspects of business and daily life, the concern over secure file and transaction access has grown tremendously. The ability to secure data and transactions is particularly important for financial, medical, education, government, military, and communications endeavors.
Using passwords is a common method of providing security for electrical or mechanical systems. Password protection and/or combination type locks are employed for computer network security, automatic teller machines, telephone banking, calling cards, telephone answering services, buildings, factories, houses and safes. These systems generally require the knowledge of an entry code that has been selected by or provided to a user or has been configured in advance.
Pre-set codes are often forgotten, however, as users have no reliable method of remembering them. Writing down codes and storing them in close proximity to an access control device (e.g., a combination lock) results in an insecure access control system. Alternatively, the nuisance of trying several code variations generally renders the access control system more of a problem than a solution.
Password systems are known to suffer from other disadvantages. Usually, a user specifies passwords. Most users, being unsophisticated users of security systems, choose passwords that are relatively insecure. As such, many password systems are easily accessed through a simple trial and error process.
To secure access to particular areas, such as buildings, the most common building security system relied on traditionally has been a security guard. A security guard reviews identification cards and compares pictures thereon to a person carrying the card. The security guard provides access upon recognition or upon other criteria. Other building security systems use card access, password access, or another secure access approach. Unfortunately, passwords and cards have similar drawbacks when utilized for building security, particularly with computer security.
As an alternative to traditional security approaches, such as security guards, passwords or PIN numbers, biometric authentication systems have been developed to authorize accesses to various electronic and mechanical systems. Biometrics can generally be defined as the science of utilizing unique physical or behavioral personal characteristics to verify the identity of an individual. Biometric authentication systems are typically combined with hardware and software systems for automated biometric verification or identification. Biometric authentication systems receive a biometric input, such as a fingerprint or a voice sample, from a user. This biometric input is typically compared against a prerecorded template containing biometric data associated with the user to determine whether to grant the user access to a service on the host system.
A biometric security access system can thus provide substantially secure access and does not require a password or access code. A biometric identification system accepts unique biometric information from a user and identifies the user by matching the information against information belonging to registered users of the system. One such biometric system is an iris recognition system.
In an iris biometric system, a user's iris under investigation is usually scanned by an optical scanner integrated with an ergonomic housing designed to orient a user's face and, more particularly, eye area in front of the scanner. In order to capture an image of a fingerprint, a system will require that the user remain in place for a few moments while an image of the iris is captured by the scanner. The iris pattern is recorded and compared to biometric templates store in a database to determine whether there is a match with a user having access to the building, system or data being protected by the biometric system.
In evaluating security of biometric authorization systems, false acceptance and false rejections are sometimes evaluated as a fraction of a user population. A security system may be characterized as allowing 1 in 1,000 false acceptances or, alternatively, 1 in 1,000,000. Typically a probability distribution curve establishes a cut off for a given registration to determine what false acceptance rate this reflects. Curves of this type are exponential in nature and, therefore, for better false acceptance rates provide only nominal improvements to false acceptance rate for significant changes to a threshold value. Typically when using a biometric information sample, a low match score results in failure to authorize an individual.
A potential problem with biometrics is the potential that a foe may force an authorized user of biometric-protected systems, buildings and data to gain access to the protected systems, buildings or data. Once the user has been authenticated, the foe will have access to the protected system. A breach in security cannot be overcome without further warning once the breach has happened.
The present inventor believes it is important to have a method to set/control alarm conditions through biometric iris detection systems.
It is a feature of the present invention to enable a user to set alarm conditions using a biometric system through an iris scanner or reader.
It is another feature of the present invention to provide methods of manipulating biometric iris detection system by a user's eyeball/eyelid to cause setting of an alarm condition by the system.
It is yet another feature of the present invention that alarm conditions can be set in a biometric iris detection system following a predetermined blinking pattern by a user's eyelid.
It is yet another feature of the present invention that alarm conditions also can be set in a biometric iris detection system following closure of a user's eyelid for a predetermined time following user identification/acceptance by the system.
It is yet another feature of the present invention that alarm conditions can be set following a predetermined movement patter of a user's eyeball (e.g., a user looks at a particular area, or areas, within a biometric reader, e.g., upper left, upper right, lower left, lower right, during user identification and acceptance procedures.
It is another feature of the present invention that methods setting alarm conditions using a user's eyeball/eyelid can be carried out using biometric iris detection hardware and image processing/control software.
A first embodiment of the invention provides that an alarm condition can be set in a biometric iris detection system by looking into the system and blinking the eye for a number of times.
The novel features believed characteristic of this invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objects, and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
Thus, the present invention is not intended to be limited to the embodiments shown or described below, but is to be accorded the widest scope consistent with principles and features disclosed herein. Although preferred embodiments of the present invention are described herein, those skilled in the art can appreciate that a number of varying embodiments can be implemented in accordance with the present invention.
Electronic system 12 can, for example, communicate with a computer workstation 24. In such an example, electronic system 12 can be configured as a remote computer network (e.g., the Internet), or a dedicated computer network (e.g., Intranet, WLAN, LAN, etc.) operating within a particular organization, business or institution. Electronic system 12 can also be configured to communicate with electromechanical systems, such as entry hardware of a secure building 22. A user can access electronic system 12 to secure entry to secure building 22. In some applications, electronic system 12 can be configured as electronics associated with or resident within the user interface (e.g., typical of non-networked systems, such as secure entries).
Additionally, electronic system 12 can be configured to communicate with an Automatic Teller Machine (ATM) 20 and/or point of sale. A user attempting to retrieve cash through ATM 20 can be required to authentication his or her identification, based on previously stored biometric attributes contained within database 14 and/or user profile 15. Database 14 and user profile 15 can function as a biometric broker that communicates as a third-party service with various mechanical systems and other devices through electronic system 12. Electronic system 12 can also enable communication with a financial institution 18 and wireless device 16.
In order to communicate with wireless device 16, electronic system 12 can be configured as part of a wireless network. A wireless device 16 can be, for example, a wireless telephone or a wireless hand held device that can communicate with wireless networks to send and receive data. Wireless device 16 can be, for example, a Wireless Application Protocol (WAP), 3G, CDMA and WiFi enabled communications device configured to authenticate the identity of a user through a biometric scanner integrated with or attached to the wireless device.
Network 30 can also be implemented as a wireless network through which wireless devices, such as wireless device 16 of
Host systems 48, 40 and 42 can be coupled to biometric broker 44. Biometric broker 44 can be implemented as a centralized repository for storing biometric attributes (i.e., biometric data), such as iris matching data. Biometric broker 44 can also be configured as an entity that obtains biometric data form a variety of biometric databases operated by different entities and organizations, and utilizes such information for authentication purposes.
Biometric brokers 44 can be implemented in any number of forms. In one possible embodiment, biometric broker 44 can be implemented as a node on network 30, which communicates with host systems 48, 40, and 42 across network 30. In another possible embodiment, biometric broker 44 can be located on a host, such as host system 48.
The example illustrated in
Providing a centralized authentication service such as biometric broker 44 has a number of advantages. One advantage is generally that centralized revocation can be supported. For example, an employee in an organization typically has access to a number of different resources on a number of different host systems. When this employee leaves the organization, it often takes a long time to explicitly revoke the employee's access rights on all host systems. Under a centralized revocation scheme, such revocation only needs to take place once at the centralized revocation service since the disparate host systems always look to the centralized revocation service to authenticate a user. Further, the biometric broker 44 can serve as the central reporting station for recording attempted biometric entries resulting in alarm conditions.
Adapter 66 can communicate with sealed hardware unit 53, which can be utilized to perform biometric authentication functions. In the example illustrated in
Sealed hardware unit 53 can include a CPU 50, which can be any type of computational engine that can be used to perform the computational and logical operations involved in biometric authentication. Sealed hardware unit 53 can additionally include threshold storage 52 and key storage 54. Threshold storage 52 can be utilized as a memory location for storing threshold values indicating how closely a biometric attribute take as a biometric sample from a user must match a biometric attribute retrieved from a database through biometric broker 44, in order to allow the user to access the host system. Key storage 54 can store at least one encryption key that can be used to encrypt messages or computer checksums for communications across network 30.
Sealed hardware unit 53 can communicate with scanner 60, which can be utilized to take a biometric sample (i.e., iris scan) from user 33. This biometric attribute can be any type of biometric measurement of user 33. This includes, but is not limited to, fingerprint data, iris scan, retinal scan, handwriting data, voice data (e.g., a voice print), and facial data (e.g., a face scan). Note that the biometric attributes stored as data within a database, such as biometric database 14 and/or user profile 15 of
The components illustrated in
Typical biometric measurements, which can be utilized to authenticate identity, include iris scanning and verification. Referring to
Iris scanning and identification is generally well known in the biometric arts and is widely used in government agencies to safeguard sensitive assets and information that is vital to national security. Iris scanning does not rely on the iris's color. Iris scanning is generally based on the fact that the color portion of the eye that surrounds the pupil contains patterns that are unique to each individual. An individual's physical signature is another important biometric attribute that can be utilized to verify the identity of an individual. Signature verification can be readily utilized with the other biometric measuring techniques utilized above.
As depicted next at block 92 of the flow diagram, the user is requested by the electronic system to allow the system to scan the user's iris. Thereafter, as illustrated at block 93, the electronic system scans the user's iris. As described next at block 94, a comparison is made between the biometric attribute (iris scan) captured by the electronic system to a biometric template wherein a matching biometric attribute should be stored. If a match does not occur, then the process can be repeated, for example, beginning with the operation depicted at block 92. Alternatively, if the match is a success, then user access to the electronic system can begin, as indicated at block 95. The user session is thereafter terminated as shown in block 96.
Assuming a match occurs, then as depicted at block 95, the user is permitted to perform a user-desired activity such as, for example, performing financial transactions, accessing sensitive information, entry into a secured building. If a biometric attribute input by the user to the electronic system matches, but the match was accomplished under force or duress by a third party, then the user and the third party will still be granted access. Unfortunately, with present biometric systems, it is possible for a user to gain access to secured systems when forced by a thief at an ATM, or opposing government forces wanting access to sensitive information or building entry.
The present invention provides methods that an authorized person can use to trigger an alarm condition when biometric initiated access is forced. In a first embodiment of the invention, an alarm condition can be set in a biometric iris detection system if the user looking into the system and blinking the eye for a number of times. A second embodiment of the invention provides that a biometric iris detection system is used to set an alarm condition when a user looks at a particular area within the biometric reader (e.g., upper left, upper right, lower left, lower right). In a third embodiment, a user sets an alarm condition by looking into the in a biometric iris detection system and closing the eye for a period of time after acceptance has occurred. The embodiments of the present invention can be carried out using biometric iris detection hardware and image processing/control software.
Referring to
Referring to the flow diagram in
Movement as shown in block 107 can continue through the iris matching process shown in block 104, and also as the user is being accepted and permission is being granted for privileges as shown in block 105. Eye and/or eyelid movement assessment is being observed during the biometric process so that the system can determine whether a predetermined alarm condition is being signaled by the user during biometric authentication. If a predetermined alarm condition, which would be known by the user, is captured by the scanner, the biometric system can trigger an alarm as shown in block 108. Predetermined conditions that can trigger an alarm include any of the following:
Even where an alarm condition is determined by the biometric system to exist following action by the user, the user can still be granted access to privileges. Such a scenario would be desired where life or limb is threatened and a silent alarm may spare the user's life. Another reason for allowing access, but triggering a false alarm, would be where it is more desirable to catch perpetrators in the act of gaining access to secured material or facilities. Once the biometric assessment and alarm condition assessments are completed the process terminates as shown in block 106.
The embodiments and examples set forth herein are presented to best explain the present invention and its practical application and to thereby enable those skilled in the art to make and utilize the invention. Those skilled in the art, however, will recognize that the foregoing description and examples have been presented for the purpose of illustration and example only. Other variations and modifications of the present invention will be apparent to those of skill in the art, and it is the intent of the appended claims that such variations and modifications be covered.
The description as set forth is not intended to be exhaustive or to limit the scope of the invention. Many modifications and variations are possible in light of the above teaching without departing from the scope of the following claims. It is contemplated that the use of the present invention can involve components having different characteristics. It is intended that the scope of the present invention be defined by the claims appended hereto, giving full cognizance to equivalents in all respects.
