S P E C I F I C A T I O N F O R
MULTI-DIMENSIONAL FINGERPRINT MINUTIA DATA CONSTELLATION
CROSS-REFERENCE TO RELATED APPLICATIONS
This application is related to U.S. Patent Application Serial No. 09/354,929, filed July 15, 1999, entitled, "METHOD AND SYSTEM FOR FINGERPRINT TEMPLATE MATCHING," and U.S. Patent Application Serial No. 09/501,355, filed February 9, 2000, entitled, "BIOMETRIC FALSE ACCEPT DETECTION," both of which are incorporated herein by reference in their entirety, and to which priority is claimed.
A portion of the disclosure of this patent document contains material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by any-one of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.
BACKGROUND
1. Field of the Invention: This application relates to biometric authentication systems, and more particularly to a data structure used to store fingerprint minutia information.
2. Background Information:
Biometric authentication systems are used to collect particular biological data of an individual and then compare the collected biological data to trusted values. Such systems are employed in environments where a memorized password or other data is subject to compromise, for instance theft, spoofing, or simply being forgotten. Typically, the system grants access to a resource, be it a physical lock, or selected reading and writing privileges in a computer data system.
The Federal Bureau of Investigation and other federal and state law enforcement agencies in the United States have long kept extensive files holding biometric data, usually fingerprint data (or fingerprint "minutia"), of individuals, friend or foe, that could be used to identify those individuals. In the not too distant past, this biometric data was collected
and stored on printed cards, often in the form of a microfiche, which would later be used by a technician to visually, or manually, compare the analog image with a collected image.
In recent years, these manual systems have been replaced by computers. Conversion from the manual system to the automated system meant that optical fingerprint minutiae collection system were employed. Light emitting diodes or lasers have been deployed to achieve this end. See, for example, U.S. Patent No. 5,138,468.
The approach taken in many such automated systems is described in U.S. Patent No 4,135,147, by Riginati et al. and issued to Rockwell International Corp. (the ' 147 patent). The ' 147 patent discloses a system that collects massive amounts of minutiae information and stores it in a data file. As is shown in figures 7, and 9 through 12 of the ' 147 patent, the Riginati system stores x, y, and theta coordinates for each and every minutiae of the fingerprint, where x and y correspond to rectangular coordinates on a sensor and theta corresponds to an angle of a ridge "tail." U.S. Patent No. 4,151,512, also by Riganiti et al. and issued to Rockwell, shows the data structure in figure 5. The Rockwell data structure is three independent collections of the x, y and theta information, which are later converted, at the time of comparison, to the information shown in figure 4C (or figure 1 of the ' 147 patent).
U.S. Patent No. 4,185,270, by Fischer II et al., issued to Fingermatrix, Inc., (the '270 patent) shows a very similar approach. Again, x, y and theta information is stored in a data structure. However, instead of three independent collection of the x, y and theta information, the '270 patent combines the information into a three-dimensional structure, which is shown in figure 9 of the '270 patent. Nevertheless, like the ' 147 patent, massive amounts of biometric information is stored in the structure, which is converted just prior to comparison of a sampled fingerprint. It may be noted, however, that the '270 patent differs from the ' 147 patent. While the ' 147 patent discloses a slide-convert-compare verification process for the information (see ' 147 patent, col. 13, line 5 through col. 15, line 25), the '270 patent focuses on clusters of information in the data structure that will be the basis of a later comparison (see '270 patent, col. 8, line 43, through col. 11, line 14). Thus, redundant and often unnecessary information is stored in the '270 patent structure. There are drawbacks to these data structures and comparison techniques. Both data structures require large amounts of fingerprint information to be stored. For instance, the '270 patent, recites that a 16,000 word memory might be sufficient. (See the '270 patent, col. 8, lines 59-63.) Storing such a large amount of fingerprint information creates
at least two problems. First, the size and cost of data storage increases when such a large structure is utilized. And second, the processing time for search and comparison may be prohibitively long. Moreover, the processing requirements of a microprocessor that must perform the data conversions, which may be mathematically intense, may also be prohibitive, especially given the tight physical constraints such a system might be required to operated under.
SUMMARY OF THE INVENTION A multi-dimensional fingerprint constellation is disclosed. The constellation comprises a header, for holding processing information used by a microprocessor executing an application program, and a body that is made up of multiple neighborhood constellations. Each neighborhood constellation includes a neighbor array, and each array element in the neighbor array includes a distance holder, an angle holder, and a relative angle holder that represent fingerprint minutiae information. The multiple values held in each neighbor array are closely related to a reference minutiae holder, from which the values stored in the respective holders are tied.
According to embodiments of the invention, the bit structure of each byte in the constellation is modified by an encrypter so that it is difficult to crack. For instance, a bit structure modifier can swap the third and fifth bits of each byte if the first bit is a one, and invert the second and sixth bits. Each byte can be further modified with an exclusive OR function and a secret key.
BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 shows a computer system with a biometric sensing device. FIGS. 2A-B are graphical representations of the minutiae represented in a data structure.
FIG. 3 is a perspective view of the data structure.
FIG. 4 is a flowchart depicting a method for encrypting the data structure. FIG. 5 is a diagram depicting transformation of the data structure into its encrypted form.
FIG. 6 is a flowchart depicting a typical application in which the invention is deployed.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A diagram of an exemplary multi-dimensional fingerprint minutiae data constellation ("constellation") is shown in FIG. 3. The constellation comprises a data dictionary, or header, which holds information about the data within the constellation, and the constellation comprises a body, which holds specific data that describes particular minutiae in the fingerprint. The constellation is compact and efficient. Relative information is stored in neighborhood constellations and there are many neighborhood constellations in the overall constellation or "data structure." A high degree of interrelationship between the constellation elements exists, thus searching, indexing and comparing sensed information to the data structure is more efficient than in past systems. Moreover, pre-calculated, and preferably normalized values are stored in the data structure. Thus, real-time conversion of stored values is not required for processing (or "matching") a sensed and stored values.
Table 1, below, shows a pseudo code representation of the data structure. The pseudo code representation can be implemented in virtually any programming language, although an object-oriented language such as C or C++ is preferred. However, the data structure can be represented in another language, such as assembly, or the data structure can be implemented by way of processing and storing blocks of fingerprint minutiae information in a manner equivalent to the functional layout that is described below. Moreover, while the preferred embodiment uses a constellation with sets of three reference value holders, one for each of the fifteen neighborhoods in a constellation, and up to one hundred neighborhood constellations in the data structure, more or less reference values, neighborhoods, or neighborhood constellations can be implemented in the data structure. According to one embodiment, an exemplary size for the data structure is 4,602 bytes, which is significantly more compressed than the 16,000 word length of prior structures.
Table 1 : Pseudo Code of Data Structure
/* Copyright 2000, Veridicom, Inc. */ typedef struct fastTemplateHdr_s { char version; char numMinu;
} FAST_TEMPLATE_HEADER; typedef struct fastTemplateEntry_s { short minulnfo; char neighlnfo [ 15 ] [3 ] ; } FAST_TEMPLATE_ENTRY; typedef struct fastTemplate_s {
FAST_TEMPLATE_HEADER header;
FAST TEMPLATEJENTRY constellation[l 00]; } FAST TEMPLATE;
A graphical, as opposed to a computer source code, representation of the data structure is shown in FIG. 3, but first we turn to a description of fingerprint minutiae data that is stored in the data structure.
An exemplary sensed fingerprint image 200 is shown in FIG. 2A. A series of fingerprint lines or "ridges" have endpoints and bifurcations, which are commonly described as "minutia" 204. Select minutiae from a sensed fingerprint are converted from their sensed form to a digital form as a data structure, one embodiment being the multidimensional fingerprint constellation.
When stored as a constellation, parameters are chosen to define the relationship between individual minutiae 204 in the fingerprint. Referring to FIG. 2B, a geometric representation 250 of two minutiae is shown. A first minutia 254 is selected as a reference minutia. A tangent 264 to the ridge of the first minutia 254 is determined and then extrapolated to intersect an x-axis 272 (for example, an x-axis of the sensor 116). An angle "alpha" is measured between the x-axis 272 and the tangent line 264. The x- and y- coordinates of the minutia 254 are also recorded. The first minutia 254 is then used a reference point to compare relative values with neighboring minutiae.
For example, a second minutia 258 is selected as a neighbor to minutia 254. X- and y-coordinates of the second minutia 258 are recorded, thus a distance 262 between the first minutia 254 and the second minutia 258 can be determined, as can an angle "beta" — formed between lines 272 and 268. The difference between angle alpha and angle beta, or angle "gamma" can be calculated by subtracting one angle from the other. Angle gamma can be represented as the angle formed between tangent line 264 (minutia 254) and tangent line 268 (minutia 258).
The process described above can be repeated comparing a third, fourth, fifth, etc. minutia to the first minutia 254. Finally, a multi-dimensional fingerprint constellation is created that represents the relative values of the selected minutiae in a particular neighborhood. FIG. 3 depicts such a data structure.
Now turning to FIG. 3, the multi-dimensional constellation 300 comprises a header 304, which can be used to identify the make and/or version of the multi-dimensional constellation 300, and a neighborhood constellation 308. The neighborhood constellation 308 comprises two parts. First, there is a reference identifier 312 that gives the x-, y- and alpha-values for the reference (or first) minutia that is the basis for relative values in the neighborhood constellation 308. Second, the neighborhood constellation 308 comprises a plurality of relative data values for the neighbors of the reference identifier 312 (that is, the second, third, fourth, etc. minutia). There can be as many neighborhoods 308 in a multi-dimensional fingerprint constellation 300 as are desired. According to one embodiment, there are one hundred neighborhood constellations 308 in a multidimensional fingerprint constellation 300. Each neighborhood constellation 308 can represent the same set of minutiae, but each neighborhood constellation 308 can arrange the neighborhood values in a different ordering and/or with a different minutiae selected as the reference minutiae or neighboring minutiae - for example, a particular minutia selection pattern can be used to determine each neighboring minutia.
Three columns represent the relative data values between the minutiae in each neighborhood constellation 308 to their reference identifier 312. They are columns 320, 324, and 328, which represent a relative distance, a relative angle (beta), and a relative angle difference (gamma), respectively, as is discussed above with reference to FIG. 2B. There are as many neighbors 316 in a neighborhood constellation 308 as are desired. According to one embodiment, there are fifteen neighbors 316 in a neighborhood constellation 308. According to one embodiment, the actual data stored in the multi-
dimensional fingerprint constellation 300 can be normalized so that the values have a uniform bit-size.
FIG. 4 is a flowchart depicting a method for encrypting a raw data structure 300 (with data values stored in it) according to an embodiment of the invention. The process is preferably performed on a byte-by-byte basis, but could be performed on other fixed or variable width blocks of data in the data structure 300. The method is performed by a microprocessor executing one or more sequences of instructions.
A byte of data is extracted from the data structure 300. In step 402, the first bit of the byte is tested to determine if it is a "1". If the first bit is a one, then in step 404 the third and fifth bits of the byte are swapped. After step 404, or step 402 (if the first bit was not a "1"), in step 406 the second bit is replaced by its complement. In step 408, the same step is performed, but this time on the sixth bit. (It is noted that steps 406 and 408 can be performed in a single operation too, as could the additional operation of step 402.) In step 410, the resultant byte is exclusive ORed with a secret key. The output is the transformed or encrypted byte, which now is substituted for the raw byte in the data structure.
It is worth noting that the secret key can be of a variable width. In a presently preferred embodiment, the secret key is five bytes long. However, according to another embodiment, the secret key is two bytes long. In the two byte embodiment, when the XOR is performed in step 410, the XOR is performed with only a portion of the secret key. For instance, the first time the XOR is performed, the first byte of the secret key is used in step 410. However, the second time the XOR is performed, the second byte of the secret key is used in step 410. When the XOR is performed a third time, the first byte is used again and so on. The process XOR process is the same when the key is of another length, except, of course, the number of XORs that comprise a complete XOR cycle of the secret key would correspond to the number of bytes in the secret key.
FIG. 5 depicts the transformation of the data structure 300 from its raw form to its encrypted form in accordance with the process described above, but shown here, conceptually, as an encrypter 500. For the purpose of the following explanation, the secret key shown is only two bytes long. Furthermore, a scan of a particular neighborhood minutia set is shown as being the input to the various rows of the data structure. The minutiae 204 that comprise the set is an electrical signal transformation of the electrically sensed minutiae of a finger.
The encrypter 500 comprises an input register 502 and an output register 514. A bit structure modifier 504 manipulates the bits of the raw data byte that is loaded from data structure 300 into input register 502. A secret key 506 is shown next, which is used as an input to an XOR function 512. The XOR function 512 performs an exclusive OR operation on the output of the bit structure modifier 504 and one of the bytes in the secret key 506 (e.g., bytes 510 or 512, depending on, for instance, whether an even or odd byte from the data structure 300 is being encrypted). The output of the XOR function 512 is placed in output register 514, at which time it is ready for placement into the encrypted data structure 520. FIG. 5 shows two paths (1 and 2) for two exemplary, randomly selected data bytes as they are transformed from the raw data structure 300 to the encrypted data structure 520.
Although the data structure was described above with reference to FIG. 3, it is described again here with reference to FIG. 5. The data structure comprises two basic parts, a header 524 comprising a version number holder 525 and a number of minutiae holder 526, and a body that is formed from multiple neighborhood constellations 528. The header holds control information (or "control data") for an external microprocessor that will ultimately interpret the data structure, information such as a model number, the size of the data structure, a particular processing procedure used to encrypt or decrypt the data structure, if it is encrypted, and, possibly, an secret key index number that is used to identify the particular secret key used in the encryption. However, the body holds raw (or encrypted raw) data that is used to communicate the fingerprint minutia values that are sensed from, for example, an actual human finger by a capacitive fingerprint minutia sensor when the finger is interfaced with the sensor.
Each neighborhood constellation 528 includes a first reference minutia coordinate holder 532 and a multi-dimensional array of minutiae information holders 533. The multidimensional array of minutia information holders 533 comprises a neighbor array 534, each member (or array element) of the neighbor array 534 including a distance holder 536, an angle holder 538, and a relative angle holder 540, which were described above in FIGS. 2 A and 2B. While the data structure has been described above, it is understood that the data structure corresponds to a computer readable medium. That is, sequences of values that are created, stored and read by a computer or a microprocessor, or even a sequence of bits in a persistent or volatile memory, or a sequence of bits transmitted over a computer
communications network as, for example, a modulated electrical signal. An environment in which the data structure can be stored is in a smart card system. FIG. 1 depicts such an environment.
Turning to FIG. 1, it depicts a smartcard system comprising a smartcard 100, a smartcard reader 110, and a biometric data sensor 116. The smartcard 100 typically comprises a microprocessor 104 and a RAM 106, EEPROM 103 (or equivalent persistent yet programmable memory, such as "flash") and ROM 102, each communicatively coupled to the microprocessor 104. Executable software code resides in ROM 102. RAM 106 is used for storage of variables and other runtime data need by the microprocessor 104. The smartcard reader 110 includes a microprocessor 114 and RAM 112. The smartcard reader 110 may further comprise a ROM, in which executable software code resides, or the software code may be loaded over a bus 124 from an external storage device or computer. In operation, the smartcard 100 is inserted into the smartcard reader 110, wherein data is either transferred from the smartcard to the smartcard reader, or from the smartcard reader 110 to the smartcard 100
The smartcard system depicted in FIG. 1 further comprises a biometric sensor 116, which is preferably a fingerprint sensor. The sensor 116 is configured to receive a finger. When the finger is placed over the sensor 116, the sensor 116 scans the finger's print and creates a fingerprint image. (It is worth noting that the image can be an analog signal that is later converted into a digital representation or constellation.)
A presently preferred fingerprint sensor is the FPS110 available from Veridicom Corporation in Santa Clara, California "http://www.veridicom.com", or alternatively the Veridicom 5th Sense (TM) peripheral sensor, which are both capacitive fingerprint sensors. More detailed descriptions of such sensors are found in U.S. Patent No. 6,016,355, entitled "CAPACITIVE FINGERPRINT ACQUISITION SENSOR," and U.S. Patent No. 6,049,620, entitled, "CAPACITIVE FINGERPRINT SENSOR WITH ADJUSTABLE GAIN," which are both incorporated herein by reference in their entirety. The fingerprint sensor uses relative capacitance (or charge) values sensed by a series of capacitive sensors to populate the data holders within the constellation 300. According to one embodiment, the sensed values are normalized into eight-bit values prior to population of the constellation 300.
Improvements to the sensor technology described in the above referenced U.S. Patents are described in U.S. Patent Application Serial No. 09/560,702, filed April 27,
2000, entitled "AUTOMATIC GAIN AMPLIFIER FOR BIOMETRIC SENSING DEVICE" and Serial No. 09/561,174, filed April 27, 2000, entitled "METHOD AND APPARATUS FOR DETECTING THE PRESENCE OF A FINGER ON A FINGERPRINT MINUTIAE-SENSING DEVICE," both of which are incorporated herein by reference in their entirety. Moreover, the fingerprint sensor 116 can include anti- spoofing technology, such as that described in U.S. Provisional Application Serial No. 60/158,423, filed October 7, 1999, which is also incorporated herein by reference in its entirety.
In an alternative embodiment, however, the fingerprint sensor 116 can be an optical fingerprint sensor that uses a light emitting source of virtually any frequency to detect the fingerprint. In still another embodiment, the fingerprint sensor can comprise one or more arrays of thermal sensing elements that detect the various ridges and valleys of a finger surface, or even one or more arrays of radio frequency antennas.
For example, the sensor 116 may apply a low voltage alternating current signal through a conductive epoxy ring (at the sensor perimeter) to the finger surface and then measure the resultant electric field at an array of small antennas (within the sensor perimeter). The resultant electric field, which is established between a reference plane on the sensor and, for instance, the conductive saline layer between the external skin cells and the living skin cells in the finger, provides a relative means to measure the ridges and valleys of the finger surface and thereby detect the fingerprint minutiae.
In all of the embodiments, the individual sensing elements of the sensor can be arranged in such a manner such that either the finger is disposed in a stationary manner and the fingerprint image is scanned, or the finger can be disposed over the sensor and swiped across the sensing elements such that multiple images of the fingerprint are created and then pieced together later for a complete fingerprint image, for example by matching ridges and valleys from subsequent scanned images and taking into account the rate at which the finger is being swept over the sensing elements. Such a system is disclosed in co-pending U.S. Patent Application Serial No. 09/363,938, filed July 29, 1999, entitled "A METHOD FOR COMBINING FINGERPRINT TEMPLATES REPRESENTING VARIOUS SENSING AREAS OF A FINGPERINT TO DERIVE ONE", which is incorporated herein by reference in its entirety.
Returning to FIG. 1 , as used with the smartcard system, the fingerprint image measured by sensor 116 is transferred to RAM 112 as the multi-dimensional fingerprint
constellation 300. For purposes of explanation, the sensed multi-dimensional fingerprint constellation will be referred to hereinafter as "template B", while a valid multidimensional fingerprint constellation will be referred to hereinafter as "template A".
When the smartcard 100 is inserted into the smartcard reader 110, the constellation is exchanged over a communication channel 120, be it physical or wireless, between the smartcard 100 and the smartcard reader 110. According to an embodiment, sensed template B is serially transferred, one neighborhood (or subset of template B) at a time, to RAM 106, where it can be compared by microprocessor 104 to the valid template A that is stored in the smartcard 100, for example in EEPROM 103. FIG. 6 is a flowchart depicting a typical environment or application in which the multi-dimensional fingerprint constellation 300 (or 520) is used. In step 604, a fingerprint image is captured, for example using one of the fingerprint sensors referenced above, although preferably the capacitive fingerprint sensor. In step 606, the fingerprint image is digitized, for instance from an analog signal into a digital format. The digitization process can involve combining multiple scanned fingerprint images into a single image, rather than digitizing a single scanned fingerprint image. In step 608, the digital values are normalized (optionally, the normalization can occur with the digitization step 606). In step 610, the constellation 300 is populated, that is actual digitized values are placed in their respective holders in the constellation 300. The constellation may not be encrypted at all if it is used in a secure environment, in which case constellation 520 is no different from constellation 300. However, according to one embodiment, the constellation 300 is encrypted, in step 612, one byte at a time within each neighborhood constellation 308, and sent, in step 614, to a recipient (for example, it is communicated over link 120 between the reader 110 and the smartcard 100). However, in other embodiments, the entire constellation 300 may be encrypted and sent to the recipient all at once, or in a byte-by-byte, or multi-byte fashion.
Once the encrypted data structure is received by the receiver, the data structure can be decrypted in the same manner in which it was encrypted. Of course, the encryption is performed in a reverse order vis-a-vis the order the encryption was originally performed. Advantages of the present multi-dimensional fingerprint constellation include its compressed size and efficient layout for data I/O. The small footprint of the constellation also permits deployment of biometric systems in a much broader market than the law enforcement or other high security applications. Instead, biometric system can be
employed in a wide variety of applications such as wireless telephones, personal digital assistants, and ATM cards.