GB2391988A

GB2391988A - An identity verification system

Info

Publication number: GB2391988A
Application number: GB0228428A
Authority: GB
Inventors: Dominic Gavan Duffy; Aled Wynne Jones
Original assignee: Scientific Generics Ltd
Current assignee: Scientific Generics Ltd
Priority date: 2002-08-14
Filing date: 2002-12-05
Publication date: 2004-02-18
Also published as: GB0228428D0; GB0218898D0

Abstract

Identification data (eg a name) is combined with processed physical data (eg a photograph) and process information (eg image processing data). The combination is encrypted and stored together with the non-encrypted form of the identification data and the process information data. At a late date the Unprocessed physical data may be reprocessed according to the process information and then combined with the identification data and process information, and subsequently encrypted and compared to the prior encrypted value for verification of the physical data. In an embodiment the physical data is biometric data such as a passport phonograph (5) or a finger print/retina scan. Authentication information may be stored on a card caring a 2-D barcode (9) or a RFID or a chip. The invention detects the alteration of the identification data and/or the physical data (eg photograph).

Description

( 2391 988

IDENTIFICATION SYSTEM

This invention relates to an identification system which uses an identification device to verify the identity of 5 an associated living creature or inanimate object. The invention has particular, but not exclusive, relevance to a personal identification system for verifying the identity of a human being.

10 Personal identification devices typically include information, such as the name and the date of birth, of an associated person. In order to hinder fraudulent use of the personal identification device, biometric data which is effectively unique to the associated person is 15 also commonly stored on the personal identification device. For example, personal identification devices such as passports and, in many countries, driving licences include a picture of the associated person. As another example, credit cards generally have the 20 signature of the associated person written thereon.

A problem with existing personal identification devices which include biometric data is that after the issuance of the personal identification device, fraudulent use is 25 carried out by replacing the biometric data with biometric data for a different person. For example, if

the biometric data is a picture, then the picture of the associated person is replaced by the picture of someone else. 5 An object of the present invention is to provide a personal identification device which is less susceptible to fraudulent use.

According to an aspect of the invention, there is 10 provided an identification system in which an identification device associated with a living creature, for example a human being, or an inanimate object includes authentication data representative of a characteristic of the associated living creature or 15 inanimate object. An identification device interrogator is able to measure the representative characteristic of the associated living creature, either directly or indirectly, and compare the result with the authentication data included in the identification device 20 to assess the genuineness of the identification device.

If the identification device is a living creature, then the authentication data can be derived from biometric data corresponding to a unique feature of the living 25 creature. For example, the authentication data may be

derived from an iris pattern, a retinal pattern or a fingerprint. In an embodiment, the authentication data is derived from 5 a picture of the living creature or inanimate object associated with the identification device.

An embodiment of the invention will now be described with reference to the accompanying Figures, in which: 10 Figure 1 shows an identity card; Figure 2 schematically shows a card manufacturing system for manufacturing the identity card illustrated in Figure l; Figure 3 schematically shows the main functional 15 components of a processing system which forms part of the manufacturing system illustrated in Figure 2; Figure 4 shows the main components of a number generator and a process data generator which form part of the processing system illustrated in Figure 3; 20 Figure 5 schematically shows the main components of a feature template generator, an attribute value stabilizer and an ambiguity resolution vector generator which form part of the number generator and the process data generator illustrated in Figure 4; 25 Figure 6 is a flow chart showing operations

performed by a grid applier and a grid cell grey value normalizer which form part of the feature template generator illustrated in Figure 5; Figure 7 is a flow diagram showing operations 5 performed by the attribute value stabilizer illustrated in Figure 4; Figures 8A to 8C are schematic diagrams illustrating how the attribute value stabilizer illustrated in Figure 4 uses offset values to stabilize a number generated by 10 the number generator; Figure 9 is a flow chart showing operations performed by a picture value generator which is illustrated in Figure 4; Figure 10 is a schematic diagram showing the main 15 components of a card reader for reading the identity card illustrated in Figure 1; Figure 11 schematically shows the main functional components of a processing system forming part of the reader illustrated in Figure 10; 20 Figure 12 schematically shows the main components of a number generator which forms part of the processing system illustrated in Figure 11; Figure 13 schematically shows the main components of a feature template generator and a attribute value 25 stabilizer which form part of the number generator

illustrated in Figure 12; Figure 14 is a flow chart showing operations performed by a grid applier and grid cell grey value normaliser which form part of the feature template 5 generator illustrated in Figure 13; Figure 15 is a flow chart showing operations performed by a picture value generator which forms part of the number generator illustrated in Figure 12; and Figure 16 shows the main components of an identity 10 card verifier which form part of the processing system illustrated in Figure 11.

Figure 1 shows an identity card 1, which is used in an identification system according to the present invention.

15 The identity card 1 includes a picture 3, positioned within a frame 5, of an associated person and written personal details 7 (in this embodiment the name, address, date of birth and nationality) for that associated person. The identity card 1 also includes a barcode 9 20 which, as will be explained in more detail hereafter, contains authentication data enabling a card reader to verify that the written personal details 7 are for the person shown in the picture 3.

25 The identity card 1 is manufactured by a card issuer

( using a card manufacturing system. Once the identity card 1 has been issued, the associated person uses the identity card 1 to prove their identity or age to a third party. In particular, the third party uses a card reader 5 to: (a) verify that the identity card 1 was issued by the card issuer; 10 (b) check that the written personal details 7 on the identity card 1 have not been tampered with; and (c) verify that the picture 3 on the identity card 1 has not been tampered with.

The card manufacturing system and the card reader will now be described in detail.

CARD MANUFACTURING SYSTEM

Figure 2 is a schematic perspective view of the card manufacturing system used by the card issuer. As shown, a photograph 21 is placed in a scanner 23 which scans the photograph to generate corresponding electronic image 25 data I(x,y). The scanner 23 is connected to a computer

( system 25 which includes a display 27, a keyboard 29, a mouse 31 and a computer tower 33 having a slot 35 for receiving a floppy disk 37. The computer system 25 is also connected to a card printer 39 which prints the 5 identity card 1.

Figure 3 schematically shows the main functional components of a processing system 51 included within the computer system 25. As shown, when the photograph 21 is 10 scanned by the scanner 23, the image data I(x,y) corresponding to the photograph 21 is input to an image converter 53 which transforms the image data into a coordinate system having an origin located at the bottom left hand corner (as shown in Figure 1) of the frame 5 15 and X and Y axes formed in horizontal and vertical directions respectively (as shown in Figure 1). The scanner 23 performs multiple scans of the photograph 21 and the transformed image data I'(x,y) for the multiple scans is input to a number generator 57 which, as will 20 be described in more detail hereafter, generates a picture value representative of the photograph 21.

In this embodiment, the image converter 53 also modifies / the transformed image data I'(x,y) for the first scan of 25 the photograph to superimpose a grid of cells, hereafter

called macro-cells, having ten rows and eight columns.

The image converter 53 sends the modified image data M(x,y) to a user interface S5 which causes the display 27 to show an image corresponding to the modified image 5 data M(x,y). The user interface 55 also enables an operator of the card manufacturing system to select, using the mouse 31, the sixteen macro-cells which appear most distinctive of the person shown in the photograph 21. Typically, these macro-cells contain characteristic 10 facial features (such as the mouth, nose, eyes and ears) of the person pictured in the photograph 21. The user interface 55 sends data identifying the selected macro cells to the number generator 57, which only uses the portions of the transformed image data corresponding to 15 the selected macro-cells to generate the picture number.

The number generator 57 is connected to a process data generator 59 which generates process data for inclusion in the barcode 9. The process data contains information 20 relating to how the picture value was calculated by the card manufacturing system which is used in subsequent card reading operations to increase the likelihood that the same picture value is determined. The reason why only selected parts of the image data (i.e. the parts 25 corresponding to selected macro-cells) are used to

generate the picture value is that, as will become apparent, this reduces the amount of data which is stored in the barcode 9. This is advantageous because the barcode 9 is only able to store a limited amount of data.

The operator of the card manufacturing system also inputs, using the keyboard 29, personal details relating to the person shown in the photograph 21 to the user interface 55, which forwards the personal details to a 10 personal data generator 61 which generates personal data containing the personal details. The personal data generated by the personal data generator 61, the picture value output by the number generator 57 and the process data output by the process data generator S9 are input 15 to an identification data generator 63, where they are combined to form identification data. In this embodiment, this combination consists of concatenating the personal data, the picture value and the process data. The identification data is input to a digital signature generator 65 which performs a secure hashing algorithm on the identification data to generate a one-way hash.

As those skilled in the art will appreciate, a secure 25 hashing algorithm has a deterministic output (i,e. the

same output data is always generated for the same input data), but the input data cannot be derived from the output data (hence it is a one-way algorithm). The one way hash is encrypted using a private encryption key Kpri, 5 generated using the RSA algorithm, associated with the card issuer to generate a digital signature.

The process data generated by the process data generator 59, the personal data generated by the personal data 10 generator 61 and the digital signature generated by the digital signature generator 65 are input to a barcode generator 67 which generates barcode data for the barcode 9. The picture value is not, however, input to the barcode in order to hinder counterfeiting of the identity 15 card 1. In this embodiment, the barcode generator 67 generates barcode data for a PDF417 two-dimensional barcode. The transformed image data I'(x,y) output by the image 20 converter 53, the personal data output by the personal data generator 61 and the barcode data output by the barcode generator 67 are input to an image processor 69 which generates image data for the identity card 1. The image processor 69 outputs the image data for the 25 identity card 1 to the card printer 39.

( The manner in which the number generator 57 generates the picture value will now be described in more detail with reference to Figures 4 to 9.

5 As shown in Figure 4, the number generator 57 includes a feature template generator 75, an attribute value stabiliser 77 and a picture value generator 79. The transformed image data I'(x,y) for each scan of the photograph 21 is input to the feature template generator 10 75 which generates a corresponding feature template corresponding to the transformed image data I'(x,y). A feature template is a collection of image artifacts within the image data, hereafter referred to as features, with each feature having a number of properties, 15 hereafter called attributes, which each have an associated attribute value.

The feature templates generated for multiple scans of the photograph 21 by the feature template generator 75 are 20 input to an attribute value stabilizer 77, which processes the attribute values of the feature templates and outputs a stabilized feature template. In this embodiment, the feature template generator 75 and the attribute value stabiliser 77 output data to an ambiguity 25 resolution vector generator 81 which forms part of the

process data generator 59. The ambiguity resolution vector generator 81 generates an ambiguity resolution vector which is used in a subsequent card reading operation to improve the likelihood of recovering the 5 same stabilised feature template.

The operation of the feature template generator 75, attribute value stabiliser 77 and ambiguity resolution vector generator 81 will now be described in more detail 10 with reference to Figures 5 to 8.

As shown in Figure 5, the feature template generator 75 includes an ROB to greyscale converter 91 which converts the transformed image data I'(x, y) for each scan of the 15 photograph 21 into greyscale data. The RGB to greyscale converter 91 sends the generated greyscale data to a grid applier 93, which applies a grid of cells, hereafter called grid cells, having forty rows and thirty-two columns to the transformed image data I'(x,y). The grid 20 applier 93 is connected to a grid cell grey value normaliser 95 which generates a normalised grey value for each grid cell. The grid applier 93 is also connected to the user interface 55, from which it receives data identifying the excluded macro-cells, and to an exclusion 25 vector generator 97, forming part of the ambiguity

resolution vector generator 81, which generates an exclusion vector identifying the excluded macro-cells.

The operations performed by the grid applier 93 and the grid cell grey value normaliser are summarised in Figure 5 6. As shown in Figure 6, the grid applier 93 applies, in step S21, the grid to the transformed image data I'(x,y).

In this embodiment, the transformed image data is a 400 10 by 320 array of pixels so that each grid cell encompasses a ten-by-ten block of pixels. The grid applier g3 excludes, in step S23, grid cells which do not correspond to a selected macro-cell using the signal received from the user interface 55. The grid applier 93 then sends, 15 in step S25, exclusion data identifying the excluded macro-cells to the exclusion vector generator 97, which generates an exclusion vector having 80 bits (one for each macro-cell) of information.

20 The grid cell grey value normaliser 95 then calculates, in step S27, a total average grey level Gimge by calculating the mean grey level for all the pixels of the remaining grid cells (i.e. the grid cells corresponding to selected macro-cells) of the transformed image data 25 I'(t). The grid cell grey value normaliser 95 then

calculates, in step S29, an average grey level for each remaining grid cell by calculating the mean grey level GC.ll for the 100 pixels forming the grid cell, and normalizes, in step S31, the average grey level for each 5 remaining grid cell by dividing the mean grey level GC for the grid cell by the average grey level Gina for the image. The grid cell grey value normaliser 95 then replaces, in step S33, the one hundred individual pixel grey levels in each remaining grid cell by the normalised 10 average grey level for the grid cell. -

The feature template input to the attribute value stabilizer therefore comprises two hundred and fifty-six features (i.e. the remaining grid cells) each having an 15 attribute (i.e. the grey level) with an associated attribute value (i.e. the normalized average grey level value). Returning to Figure 5, the attribute value stabiliser 77 20 includes an attribute quantiser 99, which re-scales the normalized average grey level values, an attribute value adjuster 101, which adjusts each re-scaled normalized -

grey level value so that it is positioned in a region midway between two neighbouring integer values, and an 25 attribute value truncator 103, which truncates the

adjusted normalised grey level value to an integer value.

The attribute quantiser 99 is connected to a unit vector generator 105, forming part of the ambiguity resolution vector generator 81, which generates a unit vector 5 identifying the units for the re-scaled normalised average grey level values. The attribute value adjuster 101 is connected to an offset vector generator 107, forming part of the ambiguity resolution vector generator 81, which generates an offset vector indicating offset 10 values used to adjust the re-scaled normalized grey level values. The operations performed by the attribute value stabiliser 77 are summarised in Figure 7.

As shown in Figure 7, after receiving, in step S41, 15 multiple feature templates for respective different scans of the photograph 21, the attribute quantiser 99 calculates, in step S43, a mean feature template by calculating the mean normalised grey level value for each remaining grid cell. The attribute quantiser 99 then 20 calculates, in step S45, the median value of the normalised grey levels for the mean feature template, i.e. half the cells of the mean feature template have a normalised grey level above the median value and half the cells of the mean feature template have a normalized grey 25 level below the median value.

( The attribute quantiser 99 then calculates, in step S47, a unit value using the calculated median value. In this embodiment, the unit size is set to half the calculated median value. The attribute quantiser 99 then re-scales, 5 in step S49, the average grey level for each cell as a multiple of the unit value to form a quantised feature template, and sends the unit value to the unit vector generator 105. In this embodiment, the same unit value is applied to each normalised grey level.

The quantised feature template is then input to the attribute value adjuster 101. In this embodiment, the attribute value adjuster 101 calculates, in step S51, an offset amount for each grid cell which, when added to the 15 average grey level for the grid cell, moves the average grey level to a region midway between neighbouring integer multiples of the unit value. In this embodiment, the attribute value adjuster 101 selects one of three different offset amounts depending upon the value of the 20 average grey level, with each offset amount corresponding to a respective offset value as set out in Table 1.

OFFSET VALUE OFFSET AMOUNT

0 -0.33

2 0.33 -

5 Table 1: Equivalence between offset values and offset amounts.

In particular, if the average grey level for a grid cell falls between (N + 1/3), where N is any integer value, and (N + 2/3), as shown in Figure 8A for the value 121, 10 then the offset value is set to 1 and the normalized grey level value is not adjusted. If the normalized grey level value falls between N and (N + 1/3), as shown in Figure 8B for the value 123, then the offset value is set to 2 and the normalised grey level value is adjusted by 15 adding the offset amount of 0.33 to generate an adjusted value 125 having a value in the range from (N + 1/3) and the (N + 2/3). If the normalized grey level has a value between (N + 2/3) and (N + 1), as shown in Figure 8C for the value 127, then the offset value is set to 0 and the 20 normalised grey level value is adjusted by adding the offset amount of -0.33 to generate an adjusted normalized grey level value 129 falling in the range between (N + 1/3) and (N + 2/3).

25 The attribute value adjuster 101 then sends the offset values for each grid cell of the quantized feature

( template to the offset vector generator 57. In this way, an adjusted feature template is generated.

The attribute value adjuster 101 sends the adjusted 5 feature template to the attribute value truncator 103 which generates, in step S55, a stabilized feature template by truncating each adjusted average grey level to an integer value. Thus, if the value of the adjusted grey level is in the region (1 + 1/3) to (1 to 2/3), then 10 the adjusted grey level value is truncated to a value of Returning to Figure 4, the stabilised feature template is input to the picture value generator 79 which 15 processes the attribute values of the stabilised feature template to generate the picture value. In this embodiment, the picture value generator 79 also sends data to an error correction vector generator 83 which forms part of the process data generator and generates 20 an error correction vector which is used in a subsequent reading operation to improve the likelihood of generating the same picture value. The operations performed by the picture value generator 79 are sumarised in Figure 9.

25 The picture value generator 79 receives, in step S61, a

19! stabilised feature template including two hundred and fifty-six features (i.e. the grid cells), each having an attribute (truncated average grey level) with an associated value. For such a large number of values, 5 even with the described data stabilization the likelihood of exactly repeating all of the values may be too low for a reliable number generator. However, in this embodiment only sixty-four of these values are used to generate the picture value, with the remaining one hundred and ninety 10 two values being used to perform error correction. This significantly improves the reliability of the number generation. In particular, the picture value is generated using every 15 fourth truncated grey level value (i.e the first, fifth, ninth,... values). The values used to generate the picture value will hereafter be referred to as data values, whereas the remaining values will be referred to as redundant values. Each data value is associated with 20 the three redundant values which immediately follow the data value.

The picture value generator 79 generates, in step S63, error correction data by applying a bitwise exclusive-OR 25 operation between each redundant value and the

( corresponding data value to generate an error correction value. A typical sequence of data value followed by four redundant values would be as follows: 10;11;01;01. The corresponding three error correction values are: 5 01;11;11. It will be appreciated that these error correction values, on their own, give no information about the associated data value.

The picture value generator 79 sends, in step S65, the 10 error correction data to the error correction vector generator 83 and then generates, in step S67, the picture value by concatenating all the data values in a predetermined order.

15 AS described above, during the card manufacturing process an ambiguity resolution vector (including an exclusion vector, a unit vector and an offset vector) and an error correction vector, which together form process data, are generated and stored in the barcode 9. After the 20 enrolment process, if the same picture is scanned, then the stored process data increases the likelihood that the same picture value is generated.

CARD READING SYSTEM

A card reader 141 will now be described with reference to Figures 10 to 16.

As shown in Figure 10, the card reader 141 includes an image scanner 143, a barcode reader 145 and a display 147 which are connected to a processor 149. Also connected to the processor 149 are a read only memory (ROM) 151, 10 which stores processor-implementable instructions which are used during operation of the card reader 141, and a random access memory (RAM), which provides working memory for use during operation of the card reader 141.

IS In use, the image scanner 143 of the card reader 141 scans the picture 3 on the identity card 1 and the barcode reader 145 scans the barcode 9 on the identity card 1. The processor 149 processes both sets of scanned data to recover the personal details and to verify that 20 the picture 3 is associated with the personal details, and the display 147 displays the stored personal details together with an indication of whether or not the picture 3 is associated with the personal details. The user of the card reader 141 is therefore able to check that 2S neither the picture 3 nor the written personal details

( 7 on the identity card 1 have been tampered with after the card was issued.

The manner in which the processor 149 processes the 5 scanned image data from the image scanner 143 and the scanned barcode data from the barcode reader 145 will now be explained with reference to Figures 11 to 16.

Figure 11 is a schematic block diagram showing the 10 functional configuration of the processor 149. As shown, the scanned barcode image data is input to a conventional barcode data recoverer 161, which recovers the process data 163, the personal data 165 and the digital signature 167 stored within the barcode 9.

The scanned image data from the image scanner 143 is input to an image converter 169 which applies a conventional image processing operation to identify the frame 5, and then transforms the co-ordinate system for 20 the image data so that the origin is at the bottom lefthand corner of the frame 5 (as shown in Figure 1) and the X and Y axes are in horizontal and vertical directions respectively (as shown in Figure 1). The transformed image data is then input to a number 25 generator 171, which calculates the picture value using

the process data 163.

The picture value calculated by the number generator 171 is input, together with the personal data 165 and process 5 data 163 recovered from the barcode 9, into an identification data generator 173 which, in the same manner as in the card manufacturing system, combines the picture value, the personal details and the process data to generate the identification data for the identity card 10 1. The identification data generated by the identification data generator 173 is then input, together with the digital signature 167 recovered from the barcode 9, to 15 an identity card verifier 175. The identity card verifier 175 processes the identification data and the digital signature 167 and outputs a verification signal indicating if the issuer of the identity card l has been verified, and whether or not the photograph shown in the 20 identity card l is the original photograph used when the identity card 1 was issued. The personal data 165 recovered from the barcode 9 and the verification signal output by the identity card verifier 175 are input to a display data generator 177 which generates display data 25 which causes the display 147 to show the personal details

( together with an indication as to whether or not the identity card 1 has been verified.

The number generator 171 will now be described in more 5 detail with reference to Figures 12 to 15.

As shown in Figure 12, the number generator 171 comprises a feature template generator 181, an attribute value stabiliser 183 and an picture value generator 185. The 10 transformed image data output by the image converter 169 is input to the feature template generator 181, which generates a corresponding feature template using data from the ambiguity resolution vector 187, which forms part of the process data 163. The generated feature 15 template is input to the attribute value stabilizer 183 which generates a stabilised feature template by adjusting the attribute values of the feature template using data from the ambiguity resolution vector 187.

20 Figure 13 shows the main functional components of the feature template generator 181 and the attribute value stabiliser 183. As shown, the feature template generator 181 comprises an ROB to greyscale converter 201 which converts the colour image data to greyscale. The 25 greyscale image date is input to a grid applier 203 which

( applies a 40 by 32 grid and excludes the grid cells corresponding to the excluded macro-cells identified in the exclusion vector 207, which formspart of the ambiguity resolution vector 187. The data output by the 5 grid applier 203 is then input to a grid cell grey value normalizer 205 which calculates a normalised average grey level value for each of the non-excluded grid cells in order to generate a feature template.

10 As discussed above, the feature template output by the feature template generator 181 is input to the attribute value stabilizer 183, which as shown in Figure 13 comprises an attribute quantiser 209, an attribute value adjuster 211 and an attribute value truncater 213. The 15 operations performed by the attribute value stabiliser will now be described with reference to Figure 14.

When the attribute value stabiliser 183 receives, in step S71, a feature template from the feature template 20 generator 181, the attribute quantifier 209 obtains the unit value from the unit vector 215, which forms part of the ambiguity resolution vector 187. The attribute quantiser then scales, in step 573, the normalized average grey level values for each cell using the unit 25 value. The scaled feature template is then input to the

( attribute value adjuster 211 which obtains for each grid cell the corresponding offset value from the offset vector 217, which forms part of the ambiguity resolution vector 187. The attribute value adjuster 211 then 5 adjusts, in step S75, the quantised value for the normalised grey level of a grid cell by adding the offset amount corresponding to the stored offset value. The adjusted feature template is input to the attribute value truncator 213 which generates, in step S77, the 10 stabilised feature template by truncating the average grey level value for each grid cell to an integer value.

Returning to Figure 12, the stabilized feature template is input to the picture value generator 185 which IS generate the picture value using the error correction vector 189. The operations performed by the picture value generator 185 will now be described with reference to Figure 15.

20 As shown, upon receiving, in step Set, the stabilized feature template from the attribute value stabilizer 183, the picture value generator 185 corrects, in step Sea, the attribute values using the error correction data stored in the error correction vector 189 to generate a 25 corresponding correction value. In particular, each of

the data values (i.e. the average grey level values for the first, fifth, ninth, grid cells) is unchanged whereas a bitwise exclusive-OR operation is performed on each of the redundant values and the corresponding error 5 correction value stored in the error correction vector 189. In this way, each data value should be identical to the three corresponding redundant values. If this is not the case, then a voting operation is performed on the data value and the three associated correction values and 10 the data value is set to the average grey level value which appears most frequently.

Figure 25 shows in more detail the main components of the identification card verifier 175. As shown, the 15 identification data from the identification data generator 173 is input to a secure hashing algorithm unit 221 which applies the same secure hashing algorithm as applied in the card manufacturing system. The digital signature 167 recovered from the barcode 9 is input to 20 a decryption unit 223 which decrypts the digital signature 167 using the public key KpUb 225 for the card issuer. The one-way hash output by the secure hashing algorithm 25 unit 221 and the decrypted digital signature output by

( the decryption unit 223 are then input to a comparator 433 where they are compared. If the identity card 1 was produced by the card issuer and the picture 3 on the identity card 1 corresponds to the photograph 21 used by 5 the card issuer, then the one-way hash output by the secure hashing algorithm unit 221 is identical to the decrypted digital signature output by the decryption unit 223 and the comparator 227 outputs a TRUE logic level, otherwise the comparator 227 outputs a FALSE logic level.

As described above, the identification data includes the process data. Therefore, even if the picture value becomes known, a counterfeiter cannot simply store new process data causing a different picture to give the 15 picture value because the change in process data will be detected by the identification card verifier 175.

MODIFICATIONS AND FURTHER EMBODIMENTS

20 AS described above, by generating authentication data using the picture value, it is possible to allow detection of any tampering with the picture 3 on the identity card 1. Preferably, the process data is also used in the generation of the picture value because this 25 allows detection of any tampering with the process data

stored in the identity card 1. Preferably, the personal data is also used in the generation of the identification data because this allows detection of tampering with the personal details on the identity card 1.

Although in the described embodiment, the picture value, process data and personal data are concatenated to form the identification data, other forms of combination are possible. Further, only selected parts of the picture 10 value, process data and personal data need be used.

In the illustrated embodiment, a one-way hash derived from the identification data is encrypted using the RSA algorithm. It will be appreciated that other encryption 15 algorithms could be used, but it is preferred to use the private key of an asymmetric encryption algorithm because this helps prevent counterfeiting of the identity card 1. 20 In the above-described embodiment, biometric data for a user of the identity card, in the form of a picture, is stored on the identity card 1. An operator of the card reader 141 is then able to compare the face shown in the picture with the face of the user. Other forms of 25 biometric data can, however, be used. For example, a

fingerprint, an iris scan or a retina scan could be used.

For some forms of biometric data, the identity card 1 does not store the biometric data but rather the card 5 manufacturing system and card reader obtains the biometric data directly from the user of the identity card 1. For example, this will be the case if a fingerprint, an iris scan or a retina scan is used.

10 If a fingerprint is used for the biometric data, then the scanner 23 of the card manufacturing system is replaced by a fingerprint sensor, and the image scanner 143 of the card reader 141 is replaced by a fingerprint sensor.

Similarly, if an iris scan is used for the biometric data 15 the scanner 23 of the card manufacturing system and the image scanner 143 of the card reader 141 are replaced by iris scanners, and if a retina scan is used for the biometric data then the scanner 23 of the card manufacturing system and the image scanner 143 of the 20 card reader 141 are replaced by retina scanners.

International Patent Applications PCT/GB02/00626 and PCT/GB02/02512, whose contents are incorporated herein by reference, describe how to obtain a biometric value 25 representative of a fingerprint, and iris or a retina.

( The invention also has applicability to the

identification of living creatures other than human I beings. For example, the invention could be used for pet passports. Further, the invention could also be applied 5 to inanimate objects, such as gemstones, which have a unique characterizing physical feature which can be measured to determine physical data, and the physical data processed to determine a physical value representative of the inanimate object and process data 10 in the same manner as the biometric data in the illustrated embodiment.

In the illustrated embodiment, the repeatability of the picture value is improved by systematically adapting the 15 manner in which properties of the picture are measured in accordance with process data generated by a training process. The way in which the processing of the image data is performed to arrive at the picture value is fundamentally different from conventional measurement 20 systems. Conventionally, the manner in which a measurement is performed is constrained by the need for the resulting number to conform to a measurement standard. For 25 example, a distance is conventionally measured to conform

with the international system of units of measurement (the SI system) so that the distance value can be compared with other distance values. The focus of the conventional measurement system is to maximise the 5 accuracy of the measurement within the constraints of the measurement standard.

For the identification system described in the illustrated embodiment, it has been recognised that when 10 generating a biometric value, the accuracy of the biometric value compared to a measurement standard is not important but instead the repeatability of the biometric value is important. Therefore, the conventional constraints associated with obtaining accurate 15 measurement values have been discarded and techniques have been developed to improve the repeatability of the biometric value instead.

In particular, in the illustrated embodiment, during the 20 card manufacturing process, a number of measurements are performed on the biometric data (the photograph 21), and then the sensitivity of the biometric value (the picture value) to variations in the measurement values is analyzed. The card manufacturing system then determines 25 process instructions (the ambiguity resolution vector)

which modify the measurement values to reduce the sensitivity of the biometric value to changes in the measurement values.

5 As described in the illustrated embodiment, a stable set of features can be obtained by applying an arbitrary (in the sense that it is not related to the analogue data) division of the analogue data into separate parts (i.e. a grid is applied to a two-dimensional array of image 10 data) . Instead of applying an arbitrary segregation of the analogue data, the data could be segregated in accordance with the information content of the data to generate features. For example, the grid cell sizes could be varied across a two-dimensional data array in 15 dependence upon the way the data varies across the two dimensional array. Alternatively, the features could inherently form part of the information content of the biometric data (for example, minutiae within a fingerprint). In the illustrated embodiment, the feature template generator applies the grid and excludes grid cells before normalization of the grid cell grey values.

Alternatively, the grey values could be normalised before 25 the grid is applied using grey level values for the

( entire picture.

In the illustrated embodiment, the attribute value is determined by performing a truncation of a measurement 5 value to an integer value. This means that the ambiguity in the attribute value will be greatest when the measurement value is close to an integer value, as the chance of the measurement value being less than the integer value in a subsequent measurement is 10 approximately equal to the chance of the measurement value being more than the measurement value. Therefore, in the illustrated embodiment the measurement value is offset to be approximately midway between two integer levels. In an alternative embodiment, the attribute 15 value is determined by rounding a measurement value to the nearest integer value. In this case, the greatest ambiguity occurs for measurement values approximately midway between neighbouring integer values, and therefore an offset vector is generated to shift the measurement 20 value towards an integer value. In general, the range of measurement values corresponding to an attribute value can be arbitrarily set.

In the illustrated embodiment, in order to reduce the 25 amount of data stored in the ambiguity resolution vector,

a sparse offset vector is used which stores an offset value, in the form of a base three number, for shifting a measurement value to be within a range of 0.33 units.

It will be appreciated that a base two number could be 5 used to shift the measurement value to be within a range of 0.5 units, a base four number could be used to shift the measurement value to be within a range of 0.25 units, etc. The higher the base used for the offset value, the greater the repeatability of the biometric value.

10 However, the higher the base used for the offset value, the greater the amount of data which is stored in the offset vector.

In an embodiment, the card manufacturing system can 15 calculate the amount of data required for the offset vector for different number bases, and then select the highest number base which can be stored. In this case, the number base used for the offset vector is preferably stored as part of the ambiguity resolution vector.

In the illustrated embodiment, each attribute value used for determining the number (each data value) is associated with three error correction values. However, the more significant bits of the data value are more 25 stable than the less significant bits and therefore the

use of the error correction data can be made more efficient. In an alternative embodiment, separate error correction data is used for each bit of a data value, with the amount of error correction bits per data bit 5 increasing from the most significant data bit to the least significant data bit.

An alternative to using the described error correction vector is to generate multiple batches of analogue data 10 to generate multiple stabilised feature templates, and then to employ a voting regime to identify the most 2 frequently occurring attribute values across the multiple stabilised feature templates.

15 In the described card manufacturing system, an operator selects which parts of the image are to be used to generate the picture value. Alternatively, conventional image processing operations could be performed to identify macro-cells including distinctive facial 20 features. It will be appreciated that the grid sizes for the macro cells and grid cells can be varied. Preferably, one macro-cell includes an exact number of grid cells because -

25 this simplifies the processing performed. However this

( is not essential as for example, the grid applier could exclude all grid cells which do not fall completely within a single macro-cell.

5 In the illustrated embodiment, the identity card 1 has written personal details 7 shown thereon, and also has the personal details stored in the barcode 9. It will be appreciated that the written personal details are not essential as the card reader l displays the personal 10 details. In the illustrated embodiment, an identification device in the form of an identity card is produced. It will be appreciated that in the same manner a passport, a driving 15 license, a library card or a credit card could be produced incorporating the features of the illustrated identity card.

In an embodiment, authentication data for an existing 20 identity card is produced. The authentication data can then be added or attached to the existing identity card, or stored on a separate carrier.

It is also possible for an identification device to be 25 associated with plural issuing authorities, with each

issuing authority generating and storing on the identity card respective different authentication data. For example, visa stamps for a passport could include a digital signature derived using the picture in the 5 passport. In this way, when a visa issuing authority is satisfied with the genuineness of a passport, the visa stamp helps detection of any tampering with the passport after the visa has been issued.

10 In the illustrated embodiment, the personal data, the process data and the digital signature are stored in a barcode on a card. Other forms of carrier could, however, be used. For example, the identification device could be in the form of a smart card or a radio frequency 15 ID (RFID) tag, in which case the personal data, the process data and the digital signature could be stored in an electronic memory.

In the card reader of the illustrated embodiment, a 20 dedicated barcode reader is used to read the barcode 9 on the identity card 1. In an alternative embodiment, the image scanner scans the entire identity card 1 and pattern recognition software retrieves the data stored in the barcode 9.

The processing of the biometric data can either be performed by a hardware device, software running on a computer, or the processing could be split between a hardware device and software running on a computer. As 5 many of the processing operations are suited to different sources of analogue data, the invention is well suited to being implemented in software using an object oriented programming language such as Java or C++ .

10 As described, as well as computer apparatus and processes performed in the computer apparatus, the invention also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the invention into practice. The computer program may be in IS the form of source code, object code, a code intermediate source and object code such as in partially compiled form, or in any other form suitable for use in the implementation of the processes according to the invention. The carrier may be any entity or device capable of carrying the program. For example, the carrier may comprise a storage medium such as a ROM, for example a CD ROM or a semiconductor ROM, or a magnetic recording 25 medium, for example a floppy disk or hard disk. Further,

the carrier may be a transmissible carrier such as an electrical or optical signal which may be conveyed via electrical or optical cable or by radio or other means.

5 When the program is embodied in a signal which may be conveyed directly by a cable or other device or means, the carrier may be constituted by such cable or other device or means. Alternatively, the carrier may be an integrated circuit in which the program is embedded, the 10 integrated circuit being adapted for performing, or for use in the performance of, the relevant processes.

Claims

_ 41 CLAIMS

1. An apparatus for interrogating an identification device storing authentication data associated with a 5 living creature, the apparatus comprising: means for retrieving said authentication data from the identification device; means for receiving biometric data associated with the living creative; and 10 means for processing the biometric data and the authentication data in order to verify the identification device. 2. An apparatus according to claim 1, wherein the said 15 retrieving means comprises an image scanner operable to read a barcode provided on the identification device, said barcode storing said authentication data.

3. An apparatus according to claim 1 or 2, wherein said 20 retrieving means comprises an image scanner operable to scan an image of said associated living creature provided on the identification device.

4. An apparatus according to claim 1 or 2, wherein said 25 retrieving means comprises an iris scanner operable to

the - 42 scan the iris of said associated living creature.

5. An apparatus according to claim 1 or 2, wherein said retrieving means comprises a retina scanner operable to 5 scan the retina of said associated living creature.

6. An apparatus according to claim 1 or 2, wherein said retrieving means comprises a fingerprint scanner operable to scan the fingerprint of said associated living 10 creature. 7. An apparatus according to any preceding claim, wherein said processing means comprises: means for determining a biometric value 15 representative of the biometric data received by said receiving means; means for generating test data using the biometric value; and means for comparing said test data and said 20 authentication data to verify the identification device.

8. An apparatus according to claim 7, further comprising means for retrieving process information containing process instructions, 25 wherein said determining means is operable to

- 43 -

determine said biometric value by processing said biometric data in accordance with said process instructions. 5 9. An apparatus according to claim 8, wherein said generating means is operable to generate said test data using said process information.

10. An apparatus according to any of claims 7 to 9, 10 further comprising means for receiving assigned identification information associated with the living creature, wherein said generating means is operable to generate said test data using said assigned identification information.

11. An apparatus according to any of claims 7 to TO, wherein said generating means is operable to apply a one-way encryption algorithm to generate said test data.

20 12. An apparatus according to claim 11, wherein said generating means is operable to apply a secure hashing algorithm to generate said test data.

13. An apparatus according to any of claims 7 to 12, 25 wherein said comparing means comprises means for

( - 44 decrypting said authentication data using a cryptographic key, 14. An apparatus according to claim 13, wherein said 5 comparing means is operable to compare the decrypted authentication data with said test data.

15. An apparatus according to claim 13 or 14, wherein said decryption means is operable to decrypt in 10 accordance with an asymmetric algorithm.

16. An apparatus according to claim 15, wherein said decryption means is operable to decrypt in accordance with the RSA algorithm.

17. A system for manufacturing an identification device associated with a living creature, the system comprising: means for receiving biometric data associated with the living creature; 20 means for generating authentication data using the received biometric data; and means for storing said authentication data on a carrier to produce said identification device.

25 18. A system according to claim 17, wherein said

( - 45 receiving means comprises an image scanner.

19. A system according to claim 18, wherein said image scanner is operable to scan a photograph. i 20. A system according to claim 18, wherein said image scanner is operable to scan an iris.

21. A system according to claim 18, wherein said image lO scanner is operable to scan a retina.

22. A system according to claim 18, wherein said image scanner is operable to scan a fingerprint.

15 23. A system according to any of claims 17 to 22, wherein said generating means comprises means for processing the biometric data received by the receiving means to determine a biometric value representative of! the received biometric data.

24. A system according to claim 23, wherein said processing means comprises means for determining process data comprising processing instructions for processing received biometric data to generate the biometric value.

- 46 25. A system according to claim 23, wherein said determining means comprises: a receiver operable to receive at least one training set of biometric data; 5 means for performing a set of measurements on each of the at least one training set of biometric data to obtain for each training set a corresponding set of measurement values; an analyser operable to analyse, for at least one 10 of the set of measurement values, the sensitivity of the generated biometric value to change in the measurement value, and to determine at least one process instruction operable to modify the processing of the measurement value to reduce the sensitivity of the biometric value 15 to change in the measurement value; and means for generating process data indicative of the determined processing instructions.

26. A system according to claim 25, further comprising 20 means for storing said process information on said carrier. 27. A system according to any of claims 23 to 26, wherein said generating means further comprises: 2S means for determining identification data

( - 47 representative of the living creature using the biometric value determined by said processing means; and means for encrypting said identification data to generate said authentication data.

28. A system according to claim 27, wherein said identification data determining means is operable to determine the identification data using the process data.

10 29. A system according to claim 27 or 28, wherein said determining means is operable to determine the identification data using assigned identification information associated with the living creature.

15 30. A system according to any of claims 27 to 29, wherein said encryption means is operable to apply a one-way encryption algorithm.

31. A system according to claim 30, wherein said 20 encryption means is operable to apply a secure hashing algorithm. 32. A system according to any of claims 27 to 31, wherein said encryption means is operable to apply an 25 asymmetric encryption algorithm.

- 4B -

33. A system according to claim 32, wherein said encryption means is operable to apply the RSA encryption algorithm. 5 34. A system according to any of claims 17 to 33, further comprising means for storing said biometric data on said carrier.

35. An identification device associated with a living 10 creature, the identification device comprising a carrier storing authentication data generated using a biometric value associated with an inherent characteristic of the living creature, assigned identification information associated with the living creature, and process data 15 comprising process instructions for processing biometric data representative of said inherent characteristic feature to generate said biometric value.

36. A method of interrogating an identification device 20 storing authentication data associated with a living creature, the method comprising the steps of: retrieving said authentication data from the identification device; receiving biometric data associated with the living 25 creative; and

( _ 49 processing the biometric data and the authentication data in order to verify the identification device.

37. A method according to claim 36, wherein the said 5 retrieving step comprises reading a barcode provided on the identification device, said barcode storing said authentication data.

38. A method according to claim 36 or 37, wherein said 10 retrieving step comprises scanning an image of said associated living creature provided on the identification device. 39. A method according to claim 36 or 37, wherein said 15 retrieving step comprises scanning the iris of said associated living creature.

40. A method according to claim 36 or 37, wherein said retrieving step comprises scanning the retina of said 20 associated living creature.

41. A method according to claim 36 or 37, wherein said retrieving step comprises scanning the fingerprint of said associated living creature.

( - so -

42, A method according to any of claims 36 to 41, wherein said processing step comprises: determining a biometric value representative of the biometric data received in said receiving step; 5 generating test data using the biometric value; and comparing said test data and said authentication data to verify the identification device.

43. A method according to claim 42, further comprising 10 the step of retrieving process information containing process instructions, wherein said determining step is operable to determine said biometric value by processing said biometric data in accordance with said process 15 instructions. I 44. A method according to claim 43, wherein said generating step comprises generating said test data using said process information.

45. A method according to any of claims 42 to 44, further comprising the step of receiving assigned identification information associated with the living creature, wherein said generating step comprises 25 generating said test data using said assigned

identification information.

46. A method according to any of claims 42 to 45, wherein said generating step comprises applying a one-way 5 encryption algorithm to generate said test data.

47. A method according to claim 46, wherein said generating step comprises applying a secure hashing algorithm to generate said test data.

48. A method according to any of claims 42 to 47, wherein said comparing step comprises decrypting said authentication data using a cryptographic key.

15 49. A method according to claim 48, wherein said comparing step comprises comparing the decrypted authentication data with said test data.

50. A method according to claim 48 ox 49, wherein said 20 decryption step comprises decrypting the authentication data in accordance with an asymmetric algorithm.

51. A method according to claim SO, wherein said decryption step comprises decrypting the authentication 25 data in accordance with the RSA algorithm.

- 52 52. A method of manufacturing an identification device associated with a living creature, the method comprising the steps of: receiving biometric data associated with the living 5 creature; generating authentication data using the received biometric data; and storing said authentication data on a carrier to produce said identification device.

53. A method according to claim 52, wherein said receiving step comprises scanning a photograph of the associated living creature.

IS 54. A method according to claim 52, wherein receiving step comprises scanning an iris.

55. A method according to claim 52, wherein said receiving step comprises scanning a retina.

56. A method according to claim 52, wherein said receiving step comprises scanning a fingerprint.

57. A method according to any of claims 52 to 56, 25 wherein said generating step comprises processing the

- 53 -

biometric data received in the receiving step to determine a biometric value representative of the received biometric data.

5 58. A method according to claim 57, wherein said processing step comprises determining process data including processing instructions for processing received biometric data to generate the biometric value.

10 59. A method according to claim 57, wherein said determining step comprises: receiving at least one training set of biometric data; performing a set of measurements on each of the at 15 least one training set of biometric data to obtain for each training set a corresponding set of measurement values; analysing for at least one of the set of measurement values, the sensitivity of the generated biometric value 20 to change in the measurement value, and determining at least one process instruction operable to modify the processing of the measurement value to reduce the sensitivity of the biometric value to change in the measurement value; and 25 generating process data indicative of the determined

- 54 processing instructions.

60. A method according to claim 59, further comprising the step of storing said process information on said 5 carrier. 61. A method according to any of claims 57 to 60, wherein said generating step further comprises: determining identification data representative of 10 the living creature using the biometric value determined in said processing step; and encrypting said identification data to generate said authentication data.

15 62. A method according to claim 61, wherein said identification data determining step comprises determining the identification data using the process data. 20 63. A method according to claim 61 or 62, wherein said determining step comprises determining the identification data using assigned identification information associated with the living creature.

25 64. A method according to any of claims 61 to 63,

wherein said encrypting comprises applying a one-way encryption algorithm.

65. A method according to claim 64, wherein said 5 encrypting step comprises applying a secure hashing algorithm. 66, A method according to any of claims 61 to 65, wherein said encrypting step comprises applying an 10 asymmetric encryption algorithm.

67. A method according to claim 66, wherein said encrypting step comprises applying the RSA encryption algorithm. 68. A method according to any of claims 52 to 67, further comprising storing said biometric data on said carrier. 20 69. A method of manufacturing an identification device associated with an inanimate object, the method . comprlslng: receiving physical data associated with a physical characteristic of the inanimate object; 25 generating authentication data using the received

- 56 -

physical data; and storing said authentication data on a carrier to produce said identification device.

5 70. A method of manufacturing an identification device associated with either a living creature or an inanimate object, the method comprising the steps of: receiving physical data associated with a physical characteristic of the living creature or inanimate 10 object; processing the physical data to generate a physical value representative of the living creature or inanimate object and process data indicating process instructions relating to the generation of the physical value; 15 receiving assigned data for the living creature of inanimate object; combining the physical value, process data and assigned data to generate identification data; encrypting said identification data; and 20 storing said encrypted identification data on a carrier to produce said identification device.