CN1208737C - Secure biometric identification method and device - Google Patents

Abstract

A method, apparatus/terminal for confidently identifying the identity of an individual is disclosed which is particularly suitable for securely shopping or servicing on visual media such as television, the Internet and EFTPOS systems. The terminal is a point-of-sale terminal (6) comprising a keypad (7), a screen (8), a fingerprint reader (9), a smart card reading assembly (10) and a printhead assembly housed within the card reading assembly (10). The operating software of the terminal (6) includes code for decrypting encrypted information read from the smart card (4). An individual wishing to conduct a secure financial transaction first needs to obtain a smart card (4) comprising encrypted biometric data and financial data of the individual. At the place where the purchase is to be made, the card (4) is placed in a reader set (10) of the terminal (6). Account details and encrypted biometric data are read by the terminal (6). The appropriate fingerprint of the individual is then extracted at the fingerprint reader (9) of the terminal (6), from which the encryption key is determined. The encrypted fingerprint data read from the card (4) is then decrypted using the encryption key just determined, and this decoded fingerprint data from the card (4) is compared with the fingerprint data obtained at the terminal (6). If the fingerprint data thus read is identical to the fingerprint data decoded from the card (4), the identity is considered correct and a financial transaction is carried out.

Description

Secure biometric identification method and device

technical field

The present invention relates to a secure method for confident identification of individuals, especially (but not exclusively) as a means of confirmation for purchases or services on telecommunication media or for cash withdrawals. The present invention finds particular (but not exclusive) use as a secure means of shopping or servicing on visual media such as television or other visual display media or the Internet or the EFTPOS (Electronic Funds Transfer at Point of Sale) system. part. However, the invention should not be considered limited to this use.

Background technique

Advertising of goods and services through media such as television and the Internet is now very common. With TV commercials, people can often buy the much-advertised good or service with a credit card over the phone. The Internet is now known as an electronic medium and a powerful communication tool. It is a seamless system (World Wide Web) of information linked on different computers. The public can easily access the Internet for various purposes, including online ordering. Various consumer goods and/or services. These goods and/or services are then usually paid for by credit card. Moreover, it is now common to use credit or debit cards (EFTPOS) to pay for goods at the time of sale in a mall.

An obvious disadvantage of telecom shopping is that individuals cannot be positively identified, which is important to prevent unauthorized access to bank account or credit card details by persons attempting to purchase or service fraudulently.

The most common method by which positive identification can be made prior to authorizing sales through the telecommunication medium is by the use of specific codes for specific accounts. These codes are usually numeric but can be alphanumeric or alphanumeric, such as a PIN number (Personal Identification Number), used to associate with a specific account number. But since PINs and account numbers have not undergone any cross-checks to ensure they are being used on telecom media by the true owner of that PIN number and associated credit card or bank account, it wouldn't be too difficult to circumvent this type of secure transaction. Disaster.

Specifically, in existing systems using magnetic stripe credit or debit cards, the user's account identity and PIN number are stored on the card. Although this data is encoded, it is also easy to copy the card, which can then be fraudulently done in at least two ways:

1. If a counterfeit user holds the card, the transaction can be completed without a signature or PIN number, through several methods including using the card number, card name and expiration date on the phone and on the Internet.

2. If the fake user knows the PIN number, then the proxy card can be used at ATMs, EFTPOS terminals, etc.

These fraudulent transactions create liabilities for the card issuing authority (which may be a bank or other financial institution) and the cardholder, which then creates a dispute between the two parties.

Confident identification of individuals is also important to prevent unauthorized entry into or passage through certain locations or facilities such as international destinations, bank vaults and security buildings, prisons , airport terminals and other restricted areas.

But when officials attempt to confirm an individual's identity by, for example, human interrogation, comparison of visual characteristics with a photograph in a passport, or comparison of a name to a list of restricted persons prohibited from entering or leaving a particular country, the correct identity of such an individual Identify potential delays to travel across national borders.

For these specific problems, one solution proposed in the prior art is to use an approach that relies on the physical characteristics of the individual. Such methods, commonly referred to as biometric techniques, include fingerprint analysis, thermographic and DNA analysis. These methods are generally considered to be less prone to false identification.

One such method includes comparing the on-card biometric data provided by the individual to a pre-generated database of biometric data of permitted individuals. But someone who gets a biometric card from the right owner will still beat the system. Alternatively, a counterfeit user of such a card could partially duplicate the card, retaining any credit card information, but replacing the biometric data of the correct owner of the card with his/her own biometric data. Additionally, data obtained from individuals is often compared to large remote databases of such information that are difficult and/or slow to locate and access.

The current methods that can overcome the above-mentioned shortcomings can be summarized as: possession of a passport, knowledge of the password, possession of limited artifacts such as keys, and biometric techniques that compare the personal data on the card with a remote database of such information.

But these security methods are easy to break through, and cannot provide satisfactory correct and convenient personal identification methods.

Contents of the invention

It is therefore a general object of the present invention to overcome or at least to improve one or more of the above problems and/or disadvantages.

According to a first aspect of the present invention, there is provided a method for correctly identifying an individual, the method comprising:

providing a unique description for said individual comprising biometric data of said individual;

encrypting said unique representation using an encryption key determined from said biometric data;

providing an identification device for said individual to carry, the identification device including said unique token;

providing means for obtaining verification biometric data from said identification means submitted by an individual;

determining an encryption key from said verification biometric data;

decrypting said biometric data included in said unique representation using said encryption key obtained from said verifying biometric data;

comparing the verification biometric data with the decrypted biometric data;

Wherein the identity of the individual is considered correct when the verification biometric data from the individual is consistent with the biometric data of the individual included in the unique representation.

Preferably, said encryption key is determined from only part of said biometric data.

Preferably, said biometric data is fingerprint analysis.

Preferably, said identification means is a card of a type capable of storing information in machine-readable form.

Optionally, after said acquisition means has acquired said verification biometric data from said individual and has initially confidently identified the person, transmitting said verification biometric data to a remote database for further A comparison is made with the biometric data held in said database.

In one embodiment of the invention, the individual goes to an issuing point such as a bank to obtain the identification device, the bank or credit card institution having to perform formal identification procedures before issuing the identification device.

According to a second aspect of the present invention, there is provided a device for use in the method for correctly identifying an individual as described above, the device comprising:

A facility for obtaining said verification biometric data from the individual providing said identification device;

reading means for reading said identification means;

decoding means for obtaining biometric data from said identification means; and

comparing means for comparing said biometric data with said verification biometric data.

Preferably said facility is a fingerprint reader.

Preferably, said reading means is a smart card reader combination.

Preferably, said reading means is a computer, mobile phone, EFTPOS terminal, ATM or similar terminal, or is incorporated as part of them.

When the reading device is installed in the mobile phone, the identification device is installed in the SIM card of the mobile phone.

Optionally, said device will allow up to three consecutive attempts to obtain said verification biometric data and compare it with said biometric data included in said identification means. If a positive identification cannot be made within these three attempts, the identity is considered false.

According to a third aspect of the present invention there is provided a method for securely transferring data over a telecommunications medium, the method comprising:

providing a transfer means for transferring said data from an individual wishing to conduct a transaction to a party who needs to verify said data to validate said data before said transaction can be carried out; and

provide a means of verification to ensure that the person is authorized to carry out the transaction in question;

Wherein the transaction is allowed after the correct identity of the person is determined through the correct identification method described above.

Preferably said data is financial data of said individual.

Preferably, said transfer means comprises a terminal remote from said party whereby said individual can provide said data to said party, the means comprising a cellular telephone or a wireless data transfer link.

Therefore, according to a fourth aspect of the present invention, there is provided a terminal used in the above method for safely transferring data, the terminal comprising:

transmitting means for transmitting said individual's identity details to said party; and

A facility for said individual to provide that person's verification biometric data using identity details.

Preferably, the delivery means further includes a credit or debit card slot assembly.

Preferably, said facilities include:

obtaining means for obtaining said verification biometric data from the individual providing said identification means;

a reading device for reading the identification device;

decoding means for obtaining biometric data from said identification means;

comparing means for comparing said biometric data with said verification biometric data; and

authentication means, used to authenticate the transfer of the data.

Preferably, the acquisition device is a fingerprint reader.

Preferably, said reading means is a smart card slot assembly, wherein said smart card includes said biometric data.

More preferably, said facility further comprises printout means to produce a hard copy for recording said data transfer details.

In one embodiment of this aspect of the invention, said print output device is a printer, either integral to said facility or separate therefrom.

In another embodiment of this aspect of the invention, said printout means is located in a slot assembly of said smart card. The printhead assembly, which can be of the mechanical, thermal, laser, or inkjet type, prints receipts as they enter (or are removed) from the slot assembly after data transfer is complete and the smart card is ejected from the slot assembly. A sensor of the optical or magnetic type may be used to detect the presence or absence of the inserted blank receipt and activate the printing process.

Preferably, the receipt is a one-, two- or triple-page receipt in the form of a "tear-off sheet".

More preferably, the receipt is a multi-copy receipt comparable in size to a credit or debit card.

More preferably, said receipt is in triptych.

Description of drawings

Preferred embodiments of the invention will now be described with reference to the accompanying drawings, in which:

Figure 1 is a schematic simplified representation of a terminal embodying the invention for positive identification of individuals wishing to conduct financial transactions through the terminal.

Figure 2a is a top plan view schematically illustrating a terminal of the present invention.

Figure 2b is a top side view schematically showing the terminal of Figure 2a.

Detailed ways

Referring to Figure 1, a central processing unit (1) is connected to a cellular telecommunication network (2). The fingerprint reader (3) is connected to a smart card (4) issuing terminal (5), which can be connected to the network (2). Those skilled in the art will appreciate that all these means are known and that they can be interconnected by any means known in the art. The transaction terminal (6) placed in the trading place is also connected with the network (2). As shown in Figures 2a and 2b, the terminal (6) includes: a keyboard (7) for entering transaction details; a display screen (8) for displaying the details entered thereby; a fingerprint reader ( 9); a smart card reader assembly (10); and a print head assembly (not shown) housed in the card reader assembly (10). The operating software of the terminal (6) includes code to decrypt encrypted information read from the smart card (4). Those skilled in the art can understand that all devices of the terminal (6) are known, and known methods can be used to interconnect various devices.

When an individual wishes to utilize a machine-readable card for secure financial transactions, he first needs to acquire a card with his personal encrypted biometric and financial data. He or she can obtain such a card by going to an institution that issues machine-readable "smart" cards, such as a bank. When applying for a credit or debit card at such an institution, the individual must generally first provide proper identification to meet the needs of the institution before the card is issued. Once the smart card is issued, the institution extracts the individual's biometric data (especially fingerprint data) using any suitable fingerprint reader known in the art. Data may be extracted from both fingerprints, although this is not required, to reduce any false rejections that may occur when using the present invention in a trade business setting. Representing the scanned fingerprint image as a mathematical representation of the ridge pattern, it is compressed and encrypted using any suitable encryption algorithm known in the field of financial transactions to ensure that it can only be read or compared after first decrypting the data. Such encrypted biometric and financial details of the individual are stored in the memory of the smart card.

In order to use this card (4) for safe shopping at the place where you want to shop, put the card (4) in the reader combination (10) of the terminal (6), and use the keyboard (7) to input the transaction value by the merchant. The purchase value is displayed on the visual display (8). Account details and encrypted biometric data are also read through the terminal (6). The fingerprint reader (9) at the terminal (6) then reads the individual's appropriate fingerprint, thereby determining its encryption key. Then use the encryption key just determined to decrypt the encrypted fingerprint data read from the card (4), and compare the thus decoded fingerprint data of the card (4) with the fingerprint data obtained at the terminal; When the fingerprint data of the user is consistent with the data decoded from the card (4), the identity is considered correct and the financial transaction is carried out. When the comparison result is negative, the consumer reinserts the finger, or replaces the finger [if two fingerprints are stored in the card (4)], scans for the second time, and repeats the above-mentioned comparison process. Although this process can be repeated several times, in practice it is desirable to configure the terminal (6) to only allow a maximum of three consecutive attempts to obtain the verification biometric data and match the biometric data stored in the smart card (4) Compare. When no confirmation occurs within these three attempts, the identity is considered wrong.

After a correct transaction, a receipt is inserted into the reader/printer slot (10) on which the transaction details are recorded. Details of the transaction are also transmitted to the central processing facility (1) for recording.

Although not particularly limited, this embodiment is applicable to all sales places for shopping or services in shopping malls. The terminal may be a self-contained stand-alone unit, or used in conjunction with a palm, laptop or desktop computer or any other unit including a visual display unit. Additionally, the terminal may utilize any suitable telecommunications network, and may be any combination of cellular, satellite, microwave or hardwired telephone or other communication networks, although the terminal preferably utilizes the functionality of a mobile cellular telephone and the convenience of wireless communication equipment.

The secure transfer feature of the present invention can be connected to existing ATM machines (Automated Teller Machines), which improves the security of withdrawing money from ATMs.

By utilizing the present invention, several advantages are obtained, including:

Because the identity of the person providing the identification device can be confirmed without accessing a remote database, this confirmation can be performed quickly, significantly reducing the time of 20-30 seconds compared with existing devices that must access a central database.

Fraudulent use of credit or debit cards can be avoided. While partial duplication of smart card data is possible to preserve credit data and replace the biometric data of the true owner of the card with that of the impostor, it is not sufficient to produce a valid card because the encryption key is The statistics get it differently.

Therefore, the present invention adopts the encryption key obtained according to the biometric data originally submitted by the individual when issuing a credit card or debit card or other machine-readable identification devices, which prevents card fraud or other wrong identification, and has high security. , easy to use and apply.

It will be appreciated that the above-described embodiments are only examples of aspects of the invention, and that various modifications and alterations may be made thereto without departing from the scope of the invention as defined by the following claims.

Claims (26)

1. method that is used for correctly discerning individual identity, this method comprises:

For described individuality provides exclusive sign, this exclusive sign comprises the biometric data of described individuality;

Utilizing encryption key is that described exclusive sign is encrypted, and described encryption key is determined by described biometric data;

Be provided for the identity recognition device that described individuality carries, this identity recognition device comprises described exclusive sign;

Deriving means is provided, obtains the verification biometric data with the described identity recognition device of submitting to from the individual;

Determine encryption key from described verification biometric data;

Utilization is deciphered the described biometric data that comprises the described exclusive sign from the described encryption key that described verification biometric data obtains;

The biometric data of described verification biometric data and above-mentioned deciphering is compared;

Wherein when when consistent, thinking that described individual's identity is correct from the biometric data of the described individuality that comprises in described individual's described verification biometric data and the described exclusive sign.

2. method as claimed in claim 1, wherein said encryption key are only to determine from the described biometric data of part.

3. as the method for claim 1 or 2, wherein said biometric data is the fingerprint analysis.

4. method as claimed in claim 1, wherein said identity recognition device are cards, and its type is for preserving the information of machine readable form.

5. method as claimed in claim 1, wherein described deriving means has obtained described verification biometric data and has discerned this people's identity tentatively assuredly from described individual after, with described verification biometric data be sent to remote data base further with described database in the biometric data preserved compare.

6. the used equipment of the method for a correct identification individual identity as claimed in claim 1, this equipment comprises:

Obtain the facility of described verification biometric data from the individual that described identity recognition device is provided;

Be used to read the reading device of described identity recognition device;

Be used for obtaining the decoding device of biometric data from described identity recognition device; And

Be used for comparison means that described biometric data and described verification biometric data are compared.

7. equipment as claimed in claim 6, wherein said facility are the fingerprint reading machines.

8. equipment as claimed in claim 6, wherein said reading device are smart card reading machine assemblies.

9. equipment as claimed in claim 6, wherein said reading device merge in computing machine, phone, EFTPOS terminal or the ATM terminal.

10. equipment as claimed in claim 9, wherein said reading device merges in the mobile phone.

11. as the equipment of claim 10, wherein said identity recognition device is contained in the SIM card of described mobile phone.

12. a method that is used for safe transfer data on telecommunication media, this method comprises:

A kind of conveyer is provided, is used for the individual that described data are concluded the business from hope is sent to and needs the described data of verification before can carrying out described transaction, to confirm a side of described data; And

A kind of confirmation device is provided, has the right to carry out described transaction to guarantee this people;

Wherein after having determined described people's correct identification, allow to carry out described transaction by the method that comprises the steps:

For described individuality provides exclusive sign, this exclusive sign comprises the biometric data of described individuality;

Utilizing encryption key is that described exclusive sign is encrypted, and described encryption key is determined by described biometric data;

Be provided for the identity recognition device that described individuality carries, this identity recognition device comprises described exclusive sign;

Reading device is provided, obtains the verification biometric data with the described identity recognition device of submitting to from the individual;

Determine encryption key from described verification biometric data;

Utilization is deciphered the described biometric data that comprises the described exclusive sign from the described encryption key that described verification biometric data obtains;

The biometric data of described verification biometric data and above-mentioned deciphering is compared;

Wherein when when consistent, thinking that described individual's identity is correct from the biometric data of the described individuality that comprises in described individual's described verification biometric data and the described exclusive sign.

13. as the method for claim 12, wherein said data are financial datas of this people.

14. as the method for claim 12 or 13, wherein said conveyer comprises the terminal away from a described side, described thus individual can provide described data to a described side, and this device comprises cellular phone or wireless data transmission lines.

15. a terminal of using in the method for the safe transfer data of claim 12, described terminal comprises:

Conveyer is sent to a described side with described individual's identity particulars; And

Being used for described individual utilizes the identity particulars that the facility of described individual's verification biometric data is provided.

16. as the terminal of claim 15, wherein said conveyer also comprises credit card or signs account draw-in groove assembly.

17. as the terminal of claim 15, wherein said facility comprises:

Deriving means is used for obtaining described verification biometric data from the individuality that described identity recognition device is provided;

Reading device is used to read described identity recognition device;

Decoding device is used for obtaining biometric data from described identity recognition device;

Comparison means is used for described biometric data and described verification biometric data are compared; And

Authenticate device is used to authenticate the transfer of described data.

18. as the terminal of claim 17, wherein said deriving means is the fingerprint reading machine.

19. as the terminal of claim 17, wherein said reading device is the draw-in groove assembly that is used for smart card, wherein said smart card comprises described biometric data.

20. as the terminal of claim 19, wherein said facility also comprises print-out device, is used to write down the hard copy that described data shift particulars with generation.

21. as the terminal of claim 20, wherein said print-out device is a printer, it and described facility become one or are separated.

22. as the terminal of claim 20, wherein said print-out device is arranged in the described draw-in groove assembly that is used for described smart card.

23. as the terminal of claim 22, wherein after finishing that data shift and take out described smart card from described draw-in groove assembly, when receipt entered described draw-in groove assembly, described print-out device was printed receipt.

24. as the terminal of claim 22, wherein after finishing that data shift and take out described smart card from described draw-in groove assembly, when described draw-in groove assembly takes out receipt, print head assembly is printed receipt.

25. as the terminal of claim 23 or 24, wherein said receipt be " scraps of paper of can tearing " form one, bigeminy or three receipts.

26. as the terminal of claim 23, the size of the size of wherein said receipt and credit card or label account card is suitable.

Images