EP1062641A1

EP1062641A1 - Method and device for verifying a biometric characteristic

Info

Publication number: EP1062641A1
Application number: EP99916819A
Authority: EP
Inventors: Gisela Meister; Albert MÖDL; Robert Müller; Bruno Struif; Dirk Scheuermann
Original assignee: Giesecke and Devrient GmbH
Current assignee: Giesecke and Devrient GmbH
Priority date: 1998-03-16
Filing date: 1999-03-15
Publication date: 2000-12-27
Also published as: WO1999048056A1; DE19811332A1; AU3517399A; US6798334B1

Abstract

The invention relates to a method and a device for verifying a biometric characteristic. A theoretical value of the biometric characteristic is stored in the form of one or more data records (refdata, refdata1 and refdata2) in a data carrier (1). To verify the biometric characteristic measurement values (sens) which represent an actual value of the biometric characteristic are determined and displayed in a terminal (9). The data carrier (1) transmits at least one subset of first reference values (refdata1), which depend on the data record(s) for the theoretical value, to the terminal (9). The terminal (9) links the data (verdata) derived from the measurement values with the subset of the first reference values (refdata1) and transmits the results of the linkage to the data carrier (1). The data carrier (1) checks the results of the linkage and determines whether the biometric characteristic is authentic, i.e. whether the actual value of the biometric characteristic corresponds to the theoretical value within a permitted tolerance range.

Description

Method and device for testing a biometric feature

The invention relates to a method and a device for testing a biometric feature.

Biometric features are used, among other things, to identify or verify authorized persons in connection with access or access controls and to carry out financial transactions. With the help of biometric features, for example, it can be ensured that a data carrier, such as a chip card, which is used as part of the above-mentioned controls or transactions, can only be used by the authorized person, i.e. only the authorized person will have access or access is released or only the authorized person can carry out the transaction. For this purpose, before the use of the data carrier is released, a biometric feature, such as a fingerprint, a voice test or the design of the fundus etc., is recorded using measurement technology, and access or access is only possible if the measured values are compared with reference values stored on the data carrier or the transaction of the data carrier is released. The use of the data carrier usually takes place in connection with a terminal with which the data carrier communicates. The comparison of the biometric data recorded by measurement technology with stored reference values can in principle take place both in the data carrier and in the terminal device. Since the biometric measurement data is often very extensive and the evaluation of this data also requires complex computing operations, this requires a high computing power and a lot of storage space. These requirements cannot or only to a limited extent be met by data carriers available today, so that the evaluation of the biometric measurement data is generally carried out in the terminal and the data carrier only serves as a memory for the reference values. Such a terminal is known from DE 4439 593 C2. In this document, a device for access and access control is disclosed, which has a microphone for voice detection and a reading device for chip cards. With the help of the microphone, a speech sample is recorded and reduced to typical language parameters in a speech analysis unit. The speech parameters are compared in an evaluation unit with reference values which are stored on the chip card and are transmitted from the chip card to the device for access control for the purpose of comparison. A disadvantage of this known device is that the reference values stored on the chip card are given to the outside, and there could therefore be a risk that unauthorized third parties will become aware of these reference values.

From DE 4439 593 C2 it is also known that the device for access control passes on the speech parameters determined from a speech sample to the chip card and the chip card compares the transmitted speech parameters with stored reference values. This procedure has the advantage that the stored reference values do not leave the chip card, and there is therefore no risk that they could be intercepted by unauthorized third parties. However, since instead of the reference values for the speech parameters, the measured values for the speech parameters have to be transmitted between the device and the chip card, there is a risk that the measured values will be listened to by an unauthorized third party instead of the reference values. A knowledge of the measured values of the authorized user by an unauthorized third party is just as explosive as a knowledge of the reference values. The invention is based on the object of specifying a method and a device for testing a biometric feature which offer the highest possible security standard and at the same time can be implemented with reasonable effort.

This object is achieved by claims 1 and 13.

In order to ensure the best possible protection against misuse, improper use of the data carrier, it is necessary that the biometric feature is checked by the data carrier itself and not by the end device with which the data carrier is used as part of its intended use communicates. However, there is a problem insofar as the sensor or sensors for detecting the biometric feature is or is usually attached to the terminal, and the measured values therefore have to be transmitted from the terminal to the data carrier. Another problem is that the computing and storage capacity of data carriers commonly used today, e.g. Chip cards are generally not sufficient to carry out a reliable comparison with reference values in an acceptable time based on the measured values of the biometric feature.

The invention solves these problems in that, on the one hand, all security-relevant operations are carried out within the data carrier and computer-intensive operations are outsourced, as far as security is not impaired, and on the other hand in

As part of this outsourcing, the data carrier specifies which data are transmitted in what form from the terminal to the data carrier. Instead of sending the complete set of measured values to the data carrier each time, the terminal device pre-evaluates the measured values, in -.4.

the framework of which is also used to link intermediate results obtained from the measured values with data which have been transmitted to the terminal from the data carrier. Only the result of this link is then transmitted from the terminal to the data carrier, which can then use these link results to determine with relatively little effort whether the biomerric feature recorded by measurement originates from an authorized user.

The outsourcing of computation-intensive and non-security-relevant operations from the data carrier to the end device thus has the advantage that the greatest part of the computing effort is incurred in the end device, which can be equipped accordingly, and only a fraction of the data carrier itself has to be carried out without it there is a reduction in the safety standard. Furthermore, linking the measured values with data from the data carrier before the transfer from the terminal to the data carrier has the advantage that attempts at manipulation by means of intercepted data are made considerably more difficult. For example, the data carrier can systematically or randomly vary its specifications for the linkage and thereby prevent manipulation by replaying the interrogated linkage results. In particular, the data carrier can also be used to select a varying subset of the pre-evaluated measured values, so that a potential attacker could only ever get knowledge of some of the measured values, and may also not know which part was just selected by the data carrier.

To better illustrate the invention, it is explained below using the biometric feature “fingerprint” for a system consisting of a chip card and a terminal - 5 -

The exemplary embodiment represents only one of many implementation options. The invention can also be used for any other biometric features, such as language, fundus, etc. In addition, the details of the implementation, e.g. which characteristics of the biometric feature are selected and how these

Characteristics are presented and evaluated, vary within wide limits.

According to the method according to the invention, a fingerprint is first acquired by measurement technology, and the characteristics of the fingerprint are determined from the measured values by means of a suitable extraction function. The characteristics can consist, for example, of coordinates and the type of the minutiae of the fingerprint. The minutiae are characteristic points or shapes, etc. of the fingerprint lines, such as line branches or line end points. The chip card gives the terminal e.g. the coordinates of the minutiae determined from the measured values for which the minutiae types are to be evaluated. The terminal then links the specified coordinates with the data material for the minutiae determined from the measured values, determines the type of the minutiae determined at the specified coordinates, and forwards the result to the chip card. The chip card checks the transmitted minute data and determines whether the biometric feature comes from an authorized user. This check can be carried out, for example, by comparison with reference values previously stored on the chip card.

Advantageous refinements and developments of the inventions are described below with reference to the embodiments shown in the drawing. - 6 -

Show it

1 is a chip card in supervision,

2 shows a block diagram of the integrated circuit of the chip card from FIG. 1,

3 is a block diagram of a terminal,

4 shows a greatly enlarged detail from a fingerprint,

5 shows a data set for the characteristics of a fingerprint,

6 shows a representation of the sequence of the method according to the invention,

Fig. 7 shows the method according to the invention

Using vectors and matrices.

1 shows a chip card 1 as an example of a data carrier under supervision. The chip card 1 consists of a card body 2 and a chip module 3, which is arranged in a recess in the card body 2. The chip module 3 consists of a contact field 4 and an integrated circuit 5, which is arranged below the contact field 4. The dimensions of chip card 1 are defined by ISO standard 7810 and the

The functioning of the integrated circuit 5 is compatible with the ISO standard 7816. The chip card 1 can be provided, for example, as an ID for access control to a building or as an authorization card for access to an electrical device, for example a computer. - 7 -

ter. Furthermore, the chip card 1 can be a bank card, a credit card, a check card or the like, with the aid of which financial transactions can be carried out.

In addition to the standardized chip card 1 shown in FIG. 1, the invention can also be used in connection with other chip cards or any other data carriers which are capable of storing data.

FIG. 2 shows a block diagram of the integrated circuit 5 of the chip card 1 shown in FIG. 1. The integrated circuit 5 is a microprocessor which is capable of carrying out calculations independently. The integrated circuit 5 consists of a central processing unit 6, a memory 7 and an input / output unit 8. The central processing unit 6 is connected both to the memory 7 and to the input / output unit 8 for the purpose of data exchange. The central unit 6 controls the

Operation of the integrated circuit 5 and usually uses commands that are stored in the memory 7. The memory 7 can be designed as a non-volatile memory, as a rule ROM or EEPROM or as a volatile memory, RAM. As a rule, both volatile and non-volatile memory are available at the same time. The commands executed by the central unit 6 are usually stored in ROM, in some cases also in the EEPROM. The reference values for the PIN or for the biometric feature and other data required for the application are also stored in the EEPROM. The RAM serves as a working memory in which the data that is currently required is temporarily stored.

The data exchange between the integrated circuit 5 and the outside world takes place via the input / output unit 8, which represents, for example, a serial interface, and with that for the input / output of data provided contact of the contact field 4 is electrically conductively connected. For the method according to the invention, it is not absolutely necessary for the data exchange between the integrated circuit 5 and the outside world to be carried out via the contact field 4. Instead, a contactless chip card can also be used, in which the data exchange does not take place via the contact field 4, but instead, for example, via an antenna coil or via electrical coupling surfaces.

Although this is not explicitly shown in FIG. 1, the chip card 1 can have a fingerprint sensor for measuring the fingerprint. This sensor would then be attached to a suitable location on the card body 2. As a rule, however, the fingerprint sensor will be attached to the terminal, as shown in FIG. 3, since fingerprint sensors suitable for integration into chip cards 1 are currently not or only to a very limited extent available.

3 shows a block diagram of a terminal 9 with which the chip card 1 enters into data exchange. The terminal 9 has an integrated circuit 10 and a fingerprint sensor 11, a keyboard 12 and a display 13. The fingerprint sensor 11 can be omitted in the variant of the invention in which the chip card has its own fingerprint sensor. Analogous to the integrated circuit 5 of the chip card 1, the integrated circuit 10 of the terminal 9 has a central unit 14 which is connected to a memory 15 and an input / output unit 16. The central unit 14 is also connected to the fingerprint sensor 11, the keyboard 12 and the display 13.

With the help of the fingerprint sensor 11, a fingerprint of the user can be recorded by measurement. The data determined in this way can then be saved in - 9 -

of the central unit 14 can be processed further and the result of this processing can be transmitted via the input / output unit 16 to the corresponding input / output unit 8 of the integrated circuit 5 of the chip card 1. The central unit 14 can likewise receive data from the integrated circuit 5 of the chip card 1 via the two input / output units 8 and 16. The user can manually enter the data required for the respective application via the keyboard 12. Which data entry is required in each case can be shown on the display 13.

In order to prevent misuse of the chip card 1 by an unauthorized third party, for example if the chip card 1 is lost or stolen, the chip card 1 can only be used after positive identification or verification of a biometric feature of the user, in the following example the fingerprint , possible. Identification via a biometric feature replaces or supplements the user authentication that is customary with chip cards 1 by entering a secret personal identification number (PIN). A reference value for this identification number is stored in the memory 7 of the integrated circuit 5 inaccessible from the outside and is compared with the entered identification number. Analogously to this, reference values for the biometric feature are stored in the memory 7 of the integrated circuit 5 in the invention, which reference values are used when the measured values are checked. If the PIN comparison or the check of the biometric feature is positive, the chip card 1 is released for use. Otherwise, a certain number of further attempts are generally permitted and if these attempts are also unsuccessful, the chip card is blocked. - 10 -

4 shows a greatly enlarged detail from a fingerprint. The fingerprint is made up of a series of more or less strongly curved lines that run as a continuous line within the section shown, branch or have an end point. For the fingerprint check, for example, the coordinates of the branches and the end points can be used as characteristics to be checked, since such a data set represents an individual characteristic of the person from whom the fingerprint originates. In order to determine the coordinates of the characteristics of the fingerprint, the section of the fingerprint shown in FIG. 4 was provided with a coordinate system, and the coordinates xl and yl of a line branch 17 and the coordinates x2 and y2 of a line end point 18 were drawn in by way of example. A complete data set for a fingerprint consists of a whole series of such coordinate pairs, for which the type of characteristic (branching, end point, possibly further) is also given. The structure of such a data record is shown in FIG. 5.

5 shows a possible structure of a data record refdata, which represents the characteristics of a fingerprint. The first line of the number matrix shown in FIG. 5 indicates the sequential number of the individual coordinate pairs. The second and third lines list the x and y coordinates for determining the positions of the characteristics of the fingerprint. In the fourth line, a value z for the individual coordinate pairs indicates the type of the characteristics of the fingerprint, ie whether it is a branch or an end point, etc. The data record consists of a total of n entries, each entry comprising four values (sequential number, x coordinate, y coordinate, type of characteristic). - 11 -

6 shows the method according to the invention for checking a fingerprint. The method steps that are carried out in the terminal 9 are shown on the left-hand side of FIG. 6 and the processing steps that are carried out in the data carrier and thus in the chip card 1 in the present example are shown on the right-hand side. The arrows between the left and right side of FIG. 6 indicate a data transport between terminal 9 and chip card 1.

In the run-up to the test method according to the invention, for example in the personalization of the chip card 1 by the card issuer, a number of data and mathematical functions that are required for carrying out the method are stored in the chip card 1. As will be described in more detail below, it depends on the embodiment of the invention which data it is in detail. Process steps that are specific to one embodiment are identified in FIG. 6 by the letter A for a first embodiment and by the letter B for a second embodiment.

The actual checking process begins with the acquisition of the cardholder's fingerprint by the terminal device 9. For this purpose, it is necessary for the cardholder to place a finger, for example the index finger, on the fingerprint sensor 11 of the terminal device 9. The separation between the initialization and the test in the narrower sense is illustrated in FIG. 6 by a horizontal line. The measured values of the fingerprint determined as part of the fingerprint acquisition are represented by the data record sens. The format and exact appearance of this data set sens is irrelevant for further consideration. It is only important that the terminal 9 has a function calc, with which a data record verdata can be determined from the measurement data record sens, the structure of which - 12 -

corresponds to the dataset refdata, i.e. The coordinates and the type of characteristics of the fingerprint are noted in the data record verdata for the currently measured fingerprint.

In a next step, the chip card 1 transmits a data record refdatal to the terminal. The data record refdatal was previously determined, just like a data record ref data2, from the data record refdata by applying an extraction function extrl or extr2 to the data record refdata. Refdata 1 and refdata2, but in particular refdata, are usually stored in encrypted form. With regard to the details for determining the data records refdatal and refdata2, a distinction must be made between two embodiments of the invention.

According to a first embodiment (letter A), the data set ref data, the format of which is shown in FIG. 5, is completely stored in the chip card 1. This data record was generated, for example, in advance by the card-issuing body from measurement data of the fingerprint of the future cardholder and stored in the memory 7 of the chip card 1. The extraction functions extrl and extr2 are always applied to the data set refdata if the data set refdatal or ref data2 is required and is not already available. In the case of the example of a fingerprint check based on characteristics of the fingerprint described here, the data set refdatal describes the coordinates x and y of the characteristics of the fingerprint that are to be checked. The data set refdata2 describes the type of characteristics for the individual coordinates. In other words, the dataset refdatal has lines 1 to 3 of the dataset refdata shown in FIG. 5 and the dataset refdata2 lines 1 and 4. In particular, it should be pointed out that the dataset refdatal and as a result also the dataset refdata2 in the - 13 -

Usually do not include all serial numbers of the data record refdata, i.e. the data records refdatal and refdata2 each represent only a subset of the individual characteristics of the fingerprint provided with a serial number in the data record refdata. This is of great importance for the method according to the invention described below, since the data record refdatal can be used to select which characteristics of the fingerprint are to be checked.

In a second embodiment (letter B) of the invention, the data set refdata is not stored in the chip card 1. Instead, only the data records refdatal and refdata2 derived from it are stored in the memory 7 of the chip card 1. In this case, however, the stored data records refdatal and refdata2 will generally include all consecutive numbers of the data record refdata, and a subset of the complete data records refdatal and refdata2 is only selected for the check when the fingerprint is checked.

The data records refdatal and refdata2 can thus be provided both according to the first embodiment by extracting and forming subsets from the stored data record refdata and, according to the second embodiment, by forming subsets from the stored data records refdatal and refdata2. In any case, the datasets refdatal and refdata2 used for the further process are the subsets that resulted from the selection of certain serial numbers and are therefore generally no longer datasets that have all serial numbers.

For the present example, the transmission of the data record refdatal from the chip card 1 to the terminal 9 means that the chip card 1 - 14 -

device 9 reports for which coordinates the measured fingerprint should be checked for its characteristics.

The selection of the characteristics to be checked, which is affected by the chip card 1, can be carried out according to different criteria. In order to test as efficiently and reliably as possible, an attempt can be made to select particularly significant or clearly recognizable characteristics. Furthermore, the selection can be varied depending on the circumstances or according to a secret system in order to prevent misuse by listening to the transmitted data by unauthorized third parties, or at least to make it more difficult. Furthermore, the selection can also depend on the current application, so that, for example, in the case of an application in which only small amounts of money are transferred and therefore only a small amount of damage can be caused in the event of fraud, a smaller number of characteristics is selected than in one case where higher amounts are transferred. In this way, the effort involved can be very well adapted to the required security standard. In order to make an attack more difficult in general, it is of course also possible in all cases for the data record refdatal and also further data transmitted between the chip card 1 and the terminal 9 to be transmitted in encrypted form.

In the terminal 9, the transmitted data record refdatal is linked to the data record verdata with the aid of a function f and in this way a data record verdata2 is generated. To put it clearly, the type of characteristic of the fingerprint is determined for each of the coordinate pairs transmitted with the dataset refdatal. The data record verdata2 determined in this way thus specifies the type of characteristic found or a specific type of coding for the given coordinates. - 15 -

which states that no characteristic could be determined for specific predetermined coordinates, and thus has rows 1 and 4 of the matrix from FIG. 5. The calculation of the function f would not be possible in a chip card 1 due to memory and / or time complexity, or would only be possible with considerable additional effort, since the function f also includes a similarity method.

The data record verdata2 is then transmitted from the terminal 9 to the chip card 1. The chip card 1 checks the data record verdata2 and, depending on the result of this check, the fingerprint is accepted as an authentic biometric feature or not. The check can be, for example, a comparison of the data record verdata2 determined from the measurement with the reference data record ref data2. This comparison can be carried out in such a way that for each serial number of the reference data record refdata2 the type of the characteristic of the fingerprint is compared with the corresponding value of a data record verdata2 determined from the measured values. The measured fingerprint can then be accepted as authentic if, on the one hand, the number of characteristics found in the data record verdata2 either exceeds a predefinable threshold value in absolute or percentage terms and, on the other hand, the correspondence between the data records verdata2 and ref data2 exceeds a further predefinable threshold value. The comparison operations required for this can be carried out with relatively little computation and storage effort and can therefore be handled easily by the chip card 1. A large number of other evaluation methods can also be used. For example, the evaluation of the number of characteristics found can be completely omitted, and only the correspondence between the data records verdata2 and refdata2 can be checked. - 16 -

characteristics found insofar as a mismatch is found for each characteristic not found.

In addition to the described use in connection with a fingerprint check, the method according to the invention can also be used for other biometric features, for example for checking speech samples or measurements of the fundus etc.

The principle on which the method according to the invention is based can be described in a more general form with the aid of mathematical symbols. In this description, it is assumed that the biometric data, both measured values and reference values, are available in the form of vectors after a certain preprocessing. These vectors are referred to as x (measured values) and y (reference values). In the context of the method according to the invention, a comparison of the two vectors x and y is used to determine whether the measured biometric feature is very likely to be authentic. A relatively simple way of comparison is to calculate the Euclidean distance. As an alternative to this comparison method, the norm can also be formed using positively definite matrices, and in this way the vector x of the measured values can be compared with the vector y of the reference values. For this purpose, the difference vector z is first formed from the vectors x and y and then the norm of the vector z according to the formula

| z || ² = ₂ ^T A z

educated. The matrix A serves to weight the individual components of the difference vector z to different extents. - 17 -

So that a division of labor between the terminal and the data carrier can be carried out according to the inventive method, the matrix A is split into an orthogonal matrix T and a diagonal matrix D, so that:

A = π D T.

Thus the square of the norm is:

|| z || ² = _z τ π DT z = (Tz) ^τ D (Tz) = (Tx -Ty) τ D (Tx - Ty) = (Tx - Ty) ^τ D (Tx - Ty)

- Σ ι ^' = l dn ^(Tχ - ^T y ⁾

where .. represent the diagonal elements of matrix D.

Taking this splitting into account, the method according to the invention is carried out by specifying the matrix A for the weighting and the vector y for the reference values. From this, the orthogonal matrix T, the product of the orthogonal matrix T and the reference vector y and the diagonal matrix D are determined by suitable functions and stored in the data carrier 1.

The procedure for checking the biometric feature is shown in FIG. 7. According to FIG. 6, the steps carried out in the terminal 9 are also shown in FIG. 7 on the left side of the image and the steps carried out in the data carrier on the right side of the image. requirement - 18 -

for the method according to the invention is that the matrices T and D and the product of the matrix T and the reference vector y were previously stored in the data carrier 1. The actual test procedure begins with the biometric feature being recorded by the terminal 9. The result of this data acquisition is the data record sens. The vector x of the measured values is determined from the data set sens with the aid of a suitable function calc. The data carrier 1 then transmits the orthogonal matrix T to the terminal 9. In the terminal 9, the product is formed from the matrix T and the vector x and transmitted to the data carrier 1. To calculate the norm of the difference vector z, only multiplications with a diagonal matrix are required in the data carrier 1, so that the data carrier 1 ultimately only has to carry out n multiplications or squarings in order to calculate the norm of the vector z with a square matrix of dimension n. If the norm of the vector z were calculated directly and without transmission of the orthogonal matrix T to the data terminal 9, ² multiplications would be required in the data carrier n, ie the method according to the invention can considerably reduce the computing effort in the data carrier 1. With this general procedure, too, all security-relevant operations are carried out in data carrier 1. The orthogonal matrix T transmitted to the data terminal 9 depends on the vector y of the reference data, but is not sufficient for the reconstruction of the vector y. The diagonal matrix D, which is critical with regard to security, remains in the data carrier 1.

Claims

19

1. Procedure for checking a biometric feature with the steps

Determining measured values (sens) which represent an actual value of the biometric feature and making these measured values available in a terminal 9,

Transmitting at least a subset of first reference values (refdatal), which depend on a predetermined target value of the biometric feature, from a data carrier to the terminal,

Linking data (verdata) derived from the measured values (sens) with the subset of the first reference values (refdatal) in the terminal (9),

Transmission of the result of the link (verdata2) from the terminal (9) to the data carrier (1) and

- Check the result of the link in the data carrier (1).

2. The method according to claim 1, characterized in that the measured values (sens) are determined using sensor means of the terminal (9).

3. The method according to claim 1, characterized in that the measured values (sens) are determined using sensor means of the data carrier (1).

4. The method according to any one of the preceding claims, characterized in that the first reference values (refdatal) and second reference values (ref data2) in the data carrier (1) from a stored reference data set 20th

(refdata), which represents the target value of the biometric feature.

5. The method according to any one of claims 1 to 3, characterized in that the first reference values (refdatal) and second reference values

(ref data2) are determined in advance from a reference data record (refdata), which represents the target value of the biometric feature, and are stored in the data carrier (1).

6. The method according to any one of the preceding claims, characterized in that the determination of the first reference values (refdatal) from the reference data set (refdata) is carried out in such a way that a back calculation from the first reference values (refdatal) to the reference data set (refadata) is not possible is.

7. The method according to any one of claims 1 to 6, characterized in that the subset of the first reference values (refdatal) is varied with the aid of a random variable.

8. The method according to any one of claims 1 to 6, characterized in that the subset of the first reference values (refdatal) is varied systematically according to a secret method.

9. The method according to any one of claims 1 to 6, characterized in that the subset of the first reference values (refdatal) depends on the transaction amount when using the data carrier for financial transactions.

10. The method according to any one of claims 1 to 6, characterized in that the subset of the first reference values (refdatal) depends on the predetermined target value of the biometric feature.

11. The method according to any one of the preceding claims, characterized in that the data (verdata) derived from the measured values (sens) represent characteristics of the biometric feature.

12. The method according to any one of the preceding claims, characterized in that the result (verdata2) of the linking of the data (verdata) derived from the measured values (sens) with the subset of the first reference values (refdatal) with the aid of in the data carrier (1st ) stored second reference values (refdata2) is checked.

13. System for checking a biometric feature, consisting of a data carrier (1) and a terminal (9), characterized in that

the terminal (9) provides measured values (sens), which represent an actual value of the biometric feature,

that the data carrier (1) transmits at least a subset of first reference values (refdatal), which depend on a predetermined target value of the biometric feature, to the terminal (9),

the terminal (9) links data (verdata) derived from the measured values (sens) with the subset of the first reference values (refdatal), 22

that the terminal (9) transmits the result of the link to the data carrier (1) and

that the data carrier (1) checks the result of the link.

14. System according to claim 13, characterized in that the data carrier (1) is a chip card.