GB2471999A

GB2471999A - Verifying the authenticity of an image

Info

Publication number: GB2471999A
Application number: GB0912476A
Authority: GB
Inventors: John Leslie Corry
Original assignee: Advanced Analysis and Integration Ltd
Current assignee: Advanced Analysis and Integration Ltd
Priority date: 2009-07-20
Filing date: 2009-07-20
Publication date: 2011-01-26
Also published as: GB0912476D0

Abstract

Verifying the authenticity of an image 10 on an image carrier 11, such as an identity card or passport, comprises securing the image by holding duplicate image information on a database and assigning at the database a set of image locations for sampling. On presentation the image is verified by measuring an image value at each of the assigned image locations; creating from the measured values an image signature function that is transmitted to the database; and comparing, at the database, the transmitted function with a like-computed function from the database image. The image locations can be re-assigned after verification and assigned by a random process or unpublished algorithm. Measured values can be compared the difference between adjacent values, include a threshold, and conveyed in two bits of data, include brightness and colour. Location coordinates and values assigned to them can be recorded on a memory device such as an RFID device 21 located on the carrier to allow off-line photograph verification.

Description

Image Verification Method and Apparatus This invention relates to methods and apparatus for image verification.

The need to verify that someone or something is who or what they claim to be is of considerable importance in many different circumstances. It can basically be approached by means of a passport or other form of identity document that comprises an image that can be compared with the bearer, such as a photograph of the bearer, or some feature of the bearer, such as a fingerprint or an iris scan, referred to as a biometric', or a signature.

As there is often considerable advantage to be derived from a false claim to identity, it is not surprising that passports and identity cards are forged. The skills of forgers in producing fake documentation for wartime agents and escapees are praised, at least by the side for which they forged, but, when exercised in favour of criminals and terrorists, are less well regarded. Anticounterfeiting measures of increasing complexity are deployed in the creation of the original documents, in the hope that the counterfeiters will not be able to match the original. Mostly, this is in vain. But even where the counterfeiter cannot produce an exact copy, detecting a fake usually requires resources beyond what may be immediately available to those first responsible for verification.

The simple fact is that anything that can be made can be copied, either precisely, or so precisely as to pass for genuine to any except highly trained and well-equipped experts.

Who are, in the ordinary course of events, not usually to hand when an identity document is presented for inspection.

A fake identity document can be produced by taking a real document, genuinely issued to one person, and substituting a photograph of another person, who wants to pass as the genuine bearer. Passports contain countermeasures against substituting a photograph, such as overlaying the page containing the photograph with a special film containing holographic images. But such measures can easily be defeated by a competent forger. A copy of the photograph is, of course, kept on a database, but unless the document is suspected, on presentation, to be a forgery, the photograph is not placed side by side with the copy.

One attempt to solve this problem is to include the image both as a visual image and as an electronic representation stored on an embedded RFID device. The device can be read to display the stored image, which can be checked to see that it corresponds to the visual image, and, of course, that both correspond, on presentation, to the appearance of the bearer, or to the iris scan, fingerprint or other biometric, or signature. In fact, this offers little more protection, since anyone with resources and determination to produce a fake in the first place will be able to reverse engineer the RFID device to contain an electronic image corresponding to the visual image.

Further protection is achieved, however, by storing information on a database that can be accessed on presentation of the document, for example, on entry to a country, against which the document can be checked. Now, the electronic image has to correspond with the image stored on the database. This presents a new order of difficulty to a forger, who would then need to be able to access and change information on the database. This approach is suggested in W02007/07203 1, where it was also suggested that, while comparison of the original representation, or a fresh image taken at the point of inspection, with the database image might appear to present a huge logistical problem, it was within the competence of systems engineers, in the context of modem information technology.

Nevertheless, it is impractical to insist that every location where a passport or ID card is checked should have a secure connection to the database, and equally impractical to suggest that a high quality image can be downloaded within a reasonable time -a second or two, perhaps -to every such location.

W02007/07203 1 does, in fact, suggest how this burden may be reduced to manageable proportions, namely by sampling the image and assigning values to the sample points and using only the sampled information for comparison with the database image, It was recognized, in W02007/07203 1, that image degradation over time could be a problem, and it was suggested that this problem was dealt with by the sampling, inasmuch as there was found to be a strong correlation between new values assigned when the document is checked and values for the same sample in a record made when the document was created, even though the image might have faded over time.

Because, however, the sampling information is kept on the document, so that the image can be compared with the sampling information without accessing the database, it would not be beyond the competence of a forger to doctor a photograph so that the pixels had the same values as the electronic record.

W02007/07203 I also suggests more than one set of sample points may be provided across a universe' of documents, and indeed multiple sets could be provided for each document, and that when a check is made against details kept on a central database, the sample set to be used for the next inspection might be changed.

These measures proved difficult to implement for a number of reasons, One was that the correlation was not as strong as had been supposed, because each time the image is scanned the numerical values of the pixels are different because of signal noise. Another was that providing multiple sample sets on a document does not add much to its security, inasmuch as the image could still be doctored, albeit with somewhat more difficulty.

As is pointed out in W02007/07203 1, if a forged or stolen document is used to enter a country for terrorist purposes, a single presentation may be all that is required of it.

The present invention provides improved methods and apparatus for image verification that take these problems into consideration.

The invention comprises, in one aspect, a method for verifying the authenticity of an image on an image carrier comprising: securing the image by holding duplicate image information on a database; assigning at the database a set of image locations for sampling; verifying the image on presentation by measuring an image value at each of the assigned image locations; creating from the measured values an image signature function and transmitting said function to the database; comparing, at the database, the transmitted function with a like-computed function from the database image.

The new set of coordinates may be assigned according to an unpublished algorithm or by a random process.

As it is not, until presentation for verification, known what set of points will be measured, it will not be possible to doctor a substituted photograph.

Comparison of the measured values to the values on the database may be made on the basis of assigning an order to the coordinates and comparing the differences between adjacent values.

To allow for noise, a threshold value T may be set, and a function F(n) defined thus: (11_d fl = T) 2-_i t-T where V is the value at coordinates x, v.

The possible values of F can be represented in just two bits of data. Four of these difference values can then be combined into a single byte, so that eight or twelve difference values can be compacted into two or three bytes to generate a signature that, assuming an appropriate choice of T, will be invariant over different scans of the image, under different lighting conditions and using different cameras.

The image capture may be subjected to image processing such for example as alignment, scaling, colour correction and histogram equalisation, before the values are measured.

The measured values may be colour or brightness.

A timestamp and/or location stamp may be added to the signature along with other relevant information particularly concerning the owner's identity in the case of a passport or ID card and other details such as the date of issue, the issuing office's ID and a serial number.

The information stored with the document may be held in registers of an RFJD chip, which allows the coordinates to be changed in an on-line transaction.

Not every presentation of a document comprising an image may, of course, be on-line.

An off-line reader, not connected to the database, can still check that the byte signature corresponds to the image, inasmuch as the memory device will have a set of locations and corresponding values that can be compared with values measured by the reader from the image. This enables a passport, for example, to be used as evidence of identity for a bank's money-laundering due diligence with a substantially greater degree of assurance than provided by mere visual inspection. The memory device can have a register that counts the number of times image comparison has been effected, and when the count exceeds a predetermined value, an alarm could be triggered, for example in an off-line reader, indicating that the image should be presented to an on-line reader that could Off-line readers could store information concerning the images they have verified and upload it to the database at intervals.

There may be more than one set of coordinates specified as sampling locations for each image. Several such sets might be used simultaneously, the system accepting the first to match. This can eliminate false negative indications arising out of dirt or official stamp contamination of, or small-scale damage to the image.

The invention also comprises apparatus for verifying the authenticity of an image on an image carrier comprising: a database holding duplicate image information; image location assigning means assigning a set of image locations for sampling; image verifying means comprising image value measurement means adapted to measure image values at each of the assigned image locations; image signature function creation means adapted to create an image signature function from the measured image values and to transmit said image signature function to the database; and comparison means at the database, adapted to compare the transmitted image signature function with a like-computed function from the database image.

The image verif,iing may means comprise a digital camera adapted to adapted to make an electronic image (the derived image) of the image to be verified and means to measure values of the derived image at the assigned set of image locations.

Said location assigning means may comprise software comprising an unpublished algorithm or software comprising a random function.

The image verifying means may comprise image processing means which may comprise alignment, scaling, colour correction and/or histogram equalisation means.

The apparatus may comprise value differencing means assigning an order to the locations and computing the difference between adjacent values.

The apparatus may comprise thresholding means comprising software in which a threshold value T is held and a function F(n) is defined thus: :ll-ç_I F)

T

- --A

where V is the value at locations having coordinates x, v, and the F(n) are evaluated for each n.

In the software, the possible values of the Fn) may be represented as two bits of data and four difference values combined into a single byte.

The image sampling means may sample the image at at least eight locations, perhaps at at least twelve locations.

The image sampling means may assign comprise colour values and/or brightness levels to the locations.

The apparatus may comprise image processing means adapted to process image properties such as alignment, scaling, colour correction and histogram equalisation, before the values are measured.

The apparatus may comprise a memory device associated with the image adapted to record the values assigned to the locations, which may comprise off-line image verification means adapted to read the values on the memory device.

The apparatus may comprise a memory device associated with the image, said memory device comprising a register that holds a count of verification procedures. The register may be adapted to hold a count of off-line verification procedures and/or a count of off-line verification procedures since an on-line such procedure. The count may be used to warn of deteriorating reliability of off-line verification.

The apparatus may comprise means adapted to add a timestamp and/or location stamp to the information recorded, along with other relevant information particularly concerning the owner's identity in the case of a passport or ID card and other details such as the date of issue, the issuing office's ID and a serial number.

Methods and apparatus for image verification according to the invention will now be described with reference to thee accompanying drawings, in which: Figure 1 is a depiction of a facial image, with coordinate points identified; Figure 2 is a table showing values as may be measured on the image of Figure 1 and an evaluation of F(i) for each pair of coordinate points; Figure 3 is a bit stream representing the F(n) values from the table in Figure 2; Figure 4 is a view of an identity card including an RFID chip and the image of Figure 1; Figure 5 is a table of the register contents of the RFID chip of Figure 4; and Figure 6 is a diagrammatic illustration image verifying means in the form of a card reader.

The drawings illustrate a method and apparatus for verifying the authenticity of an image 10 on an image carrier 11, the apparatus comprising: a database 12 holding duplicate image information; the database 12 comprising image location assigning means 13 assigning a set of image locations x,, y for sampling; image verifying means 14 comprising image value measurement means 15 adapted to measure image values at each of the assigned image locations x, yn; image signature function creation means 16 adapted to create an image signature function from the measured image values and to transmit said image signature function to the database; and comparison means 18 at the database 12, adapted to compare the transmitted image signature function with a like-computed function from the database image.

Figure 1 shows a typical image 10 as might appear on an image carrier 11 such as a passport or an ID card as shown in Figure 4, and a set of location co-ordinates x, ,z assigned by the location assigning means 13, at which image values are to be measured.

The duplicate image information held on the database is an electronic version of the image 10.

The first check is by security personnel such as passport officials to see that the image on the carrier is an image of the presenter. The human eye is much better at this kind of check than any machine recognition system, and can take into account variations in lighting, tiredness, suntan, hairstyle and so forth. The verification carried out according to the present invention checks that the image on the image carrier corresponds to the image that was on the carrier when it was first created. This will prevent a forger getting hold of a genuine passport and substituting a photograph of a new bearer.

The image verifying means 14, Figure 6, comprise a digital imager 1 4a such as a digital camera, and value measurement means sampling the camera image at the location coordinates x, y and measuring colour values, brightness levels or convolved colour and brightness levels. The camera image is subjected to image processing by image processing means 17 for alignment, scaling, colour correction and histogram equalisation, before the values are measured.

When the image carrier 10 is first presented for verifying its image 11, the image verifying means 14 first makes contact with the database 12 -see Figure 6 -triggering location assigning means 13 to assign a set of location coordinates x, y and transmit them to the image verifying means 14. Image value measurement means 15 then measure values of the camera 1 4a image at those coordinates.

Comparison of the measured values to the values on the database 12 may be made on the basis of assigning an order to the coordinates and comparing the differences between adjacent values.

To allow for noise, a threshold value T is set, and a function Fn) defined thus: (1i_d fl = :fl.i4 2i4_i t-T where V is the value at coordinates x, y. Figure 2 illustrates the computation of the F'n). Values V are measured on a scale of 1 -10 and the F('n) calculated for T 1.5 The image may be sampled at at least eight, possibly at least twelve locations. Eight image values can give rise to eight difference values by computing the differences (V2-V1), (V3 -V2) (V1, -V8), as is done in Figure 2. One of these eight values is, of course, redundant, as (Fn+1) -Fn)), n ito 8, equals Ff8) F(]), but checking that this is the case is a useful error check.

The possible values ofF, namely 0, 1 and 2, can be represented in just two bits of data.

Four of these difference values can then be combined into a single byte, so that eight or twelve difference values can be compacted into two or three bytes to generate a signature that, assuming an appropriate choice of T, will be invariant over different scans of the image, under different lighting conditions and using different cameras. Figure 3 illustrates the binary signature corresponding to the Function values in Figure 2, This computation is done in a processor 16.

This signature is transmitted to the database 12, where the comparison means creates a like signature from its duplicate electronic image and compares it with the signature received from the image verifying means. Depending on the result of the comparison, a pass or a fail signal is transmitted to the verifying means 14.

A subsequent presentation of the image for verification will use a different set of locations, produced by the image location assigning means 13. As the sets are generated at the database, by a secret algorithm or in a random fashion, it is impossible for a forger to doctor' an image to give the correct image values, even for the first presentation.

It is not necessary for the database 12 to comprise a complete record of the image 10. It is sufficient that the database has values for a sufficient number of location coordinates to cater for an anticipated number of presentations. If the database had, say, a value for each of 24 locations, the number of different twelve value signatures available would be 12!/6!, or 665280, while the information held on the database would be very substantially less than if a complete image was stored.

The locations and values recorded on the memory device can be used in off-line image verification. A first on-line check involves downloading from the database a first set of locations, and this set is stored in a register of an RFID chip 21 on the image carrier 11, a digital signature, computed at the database, corresponding to those locations, being stored in another register of the chip 21. An off-line verification procedure can then be carried out by image verifying means similar to the means 14 of Figure 6, but without any connection to the database. The imager 14a forms a digital image of the image 10, which is processed by the image processor 17. Image value measurement means 15 then measure the image values at the locations stored in the chip register, and the image signature is computed in the processor 16. Instead of sending the signature to the database, however, the processor 16 compares the signature it computes with the signature downloaded from the database 12 in the first on-line verification, and indicates a pass or a fail.

Off-line verification can be used in sub-critical situations, such as claiming benefits or for proof of entitlement to services, where the benefit or entitlement would not warrant the cost of producing a counterfeit ID card. Nevertheless, multiple presentations to claim benefit or entitlement might well justify the cost, and the more off-line presentations, the less reliable will be the verification procedure. To militate against this, the number of presentations can be limited by a counter in one of the RFID chip registers that counts the number of off-line procedures and when this has reached a predetermined limit renders the card useless for further off-line procedures until another on-line verification has been carried out. The counter level can be displayed at the off-line reader as a warning of increasing unreliability so that a supervisor can exercise discretion and perhaps require an on-line scan.

Further security and an audit trail can be provided in other registers of the ID chip 21, which can hold ID details -name and address of bearer -a unique security code generated by a secret algorithm so that only one in a hundred numeric codes are valid, for example, details of times and locations of verification scans carried out, and a second counter that can, for example, count the number of on-line scans. Other security measures can be added to the carrier 11 such for example as a hologram 22.

Further security still can be provided by facilitating off-line readers storing and downloading information to the database on a batch basis. This avoids the need to have readers directly connected to the database -downloading can be done via an internet connection. This will at least facilitate early detection of spurious presentations, and will militate further against counterfeiting by providing data that can be investigated.

Claims

Claims: 1 A method for verifying the authenticity of an image on an image carrier comprising: securing the image by holding duplicate image information on a database; assigning at the database a set of image locations (XE, y for sampling; verifying the image on presentation by measuring an image value at each of the assigned image locations; creating from the measured values an image signature function and transmitting said function to the database; comparing, at the database, the transmitted function with a like-computed function from the database image.
2 A method according to claim 1, comprising, after the image has been verified, assigning, at the database, a new set of' image locations and re-securing the image using the new set of locations.
3 A method according to claim 2, in which the new set of locations is assigned according to an unpublished algorithm.
4 A method according to claim 2, in which the new set of locations is assigned by a random process.
A method according to any one of claims 1 to 4, in which comparison of the measured values to the values on the database is made on the basis of assigning an order to the locations and comparing the differences between adjacent values.
6 A method according to any one of claims 1 to 5, in which a threshold value T is set, and a function F(n) defined thus: t'I1. : 7)I -. (*r. \where yE is the value at locations XE, Yn.
7 A method according to claim 6, in which the possible values ofF are represented in two bits of data.
8 A method according to claim 7, in which four difference values are combined into a single byte.
9 A method according to any one of claims 1 to 8, in which the image is sampled at at least eight locations.
10 A method according to claim 9, in which the image is sampled at at least twelve locations.
11 A method according to any one of claims ito 10, in which the values comprise colour values.
12 A method according to any one of claims 1 to 11, in which the values comprise brightness levels.
13 A method according to any one of claims 1 to 12, in which the image is subjected to image processing such for example as alignment, scaling, colour correction and histogram equalisation, before the values are measured.
14 A method according to any one of claims 1 to 13, in which when the image is secured or re-secured the coordinates of the locations and the values assigned to them are recorded on a memory device associated with the image.
A method according to claim 14, in which the locations and values recorded on the memory device are used in off-line image verification.
16 A method according to any one of claims 1 to 15, in which a memory device associated with the image comprises a register that holds a count of verification procedures.
17 A method according to claim 16, in which the register holds a count of off-line verification procedures.
18 A method according to claim 17, in which the register holds a count of off-line verification procedures since an on-line such procedure.
19 A method according to claim 18, in which the count is used to warn of deteriorating reliability of off-line verification.
A method according to any one of claims 1 to 19, in which a timestamp and/or location stamp is added to the information recorded along with other relevant information particularly concerning the owner's identity in the case of a passport or ID card and other details such as the date of issue, the issuing office's ID and a serial number.
21 Apparatus for verifying the authenticity of an image on an image carrier comprising: a database holding duplicate image information; the database comprising image location assigning means assigning a set of image locations for sampling; image verifying means comprising image value measurement means adapted to measure image values at each of the assigned image locations; image signature function creation means adapted to create an image signature function from the measured image values and to transmit said image signature function to the database; and comparison means at the database, adapted to compare the transmitted image signature function with a like-computed function from the database image.
22 Apparatus according to claim 21, in which the image verif,ing means comprise a digital camera adapted to adapted to make an electronic image (the derived image) of the image to be verified and means to measure values of the derived image at the assigned set of image locations.
23 Apparatus according to claim 21 or claim 22, in which said location assigning means comprise software comprising an unpublished algorithm.
24 Apparatus according to claim 21 or claim 22, in which said location assigning means comprise software comprising a random function.
Apparatus according to any one of claims 21 to 24, in which the image verifying means comprise image processing means.
26 Apparatus according to claim 25, in which the image processing means comprise alignment, scaling, colour correction and/or histogram equalisation means.
27 Apparatus according to any on of claims 21 to 26, comprising value differencing means assigning an order to the locations and computing the difference between adjacent values, 28 Apparatus according to claim 27, comprising thresholding means comprising software in which a threshold value T is held and a function F(n) is defined thus: ii 1 i., -F:n:'= .i-*i_>T) 2 -where V is the value at locations having coordinates Xn, Yn, and the F(n) are evaluated for each n.29 Apparatus according to claim 28, in which, in the software, the possible values of the F(n) are represented as two bits of data and four difference values are combined into a single byte.30 Apparatus according to any one o claims 21 to 29, in which the image sampling means sample the image at at least eight locations.31 Apparatus according to claim 30, in which the image sampling means samples the image at at least twelve locations.32 Apparatus according to any one of claims 21 to 31, in which the image sampling means assigns comprise colour values to the locations.33 Apparatus according to any one of claims 21 to 32, in which the image sampling means assign brightness level values to the locations.34 Apparatus according to any one of claims 21 to 33, comprising image processing means adapted to process image properties such as alignment, scaling, colour correction and histogram equalisation, before the values are measured.Apparatus according to any one of claims 21 to 34, comprising a memory device associated with the image adapted to record the values assigned to the locations 36 Apparatus according to claim 35, comprising off-line image verification means adapted to read the values on the memory device.37 Apparatus according to any one of claims 21 to 36, comprising a memory device associated with the image, said memory device comprising a register that holds a count of verification procedures.38 Apparatus according to claim 37, in which the register is adapted to hold a count of off-line verification procedures.39 Apparatus according to claim 37 or claim 38, in which the register is adapted to hold a count of off-line verification procedures since an on-line such procedure.Apparatus according to claim 39, in which the count is used to warn of deteriorating reliability of off-line verification.41 Apparatus according to any one of claims 21 to 40, comprising means adapted to add a timestamp and/or location stamp to the information recorded, along with other relevant information particularly concerning the owner's identity in the case of a passport or ID card and other details such as the date of issue, the issuing office's ID and a serial number.