GB2237672A - Individual verification - Google Patents

Abstract

A method of obtaining a parameter to enable an assessment of the level of confidence to which an individual has been verified prior to permitting the individual to perform a secure operation comprises performing an analysis (4, 8, 12) on current and reference signatures of the individual to generate a "goodness of match" parameter relating to the result of the analysis; and generating a "confidence of match" parameter (15) by modifying the "goodness of match" parameter in accordance with the time interval between the previous and current submissions. <IMAGE>

Description

IMPROVEMENTS RELATING TO INDIVIDUAL VERIFICATION There are many applications in which it is necessary to secure an application against unauthorised use and where it is necessary to identify correctly an individual as being entitled to have access to the application.

Recently, biometric verification techniques have been developed in which a physical or behavioural characteristic of the individual is analysed and compared with a reference. Examples of biometric features are signature (dynamic and static), fingerprint, voice, hand geometry, eye retinal pattern, and key stroke dynamics.

In a typical biometric verification process, the subject is enrolled by presentation of the biometric concerned in order to generate a reference set of measurements. The subject is later verified by accessing the correct reference set, obtaining the current biometric features, determining the "distance" between the submission and reference features, and comparing that distance with a threshold to determine whether or not there is verification.

Biometric verification techniques can be categorized according to their vulnerability to fraudulent attack and their verification performance (in terms of true/false error rates). There are two distinct groups: 1 High-grade techniques which achieve very low false acceptance rates and are thus very reliable with limited deviation in false accept error rates across a population, and limited deviation in data capture times.

However, these tend to be expensive, obtrusive, and have significant false reject rates.

2 Lower-grade techniques which are generally unobtrusive (signature or voice), capable of reaching low cost given sufficient volume, and suitable for integration into systems. However, these have significant false accept and reject rates, large deviations in error rates across the population, and significant deviations in data capture times.

US-A-4054749 makes an attempt at recognising that there may be a problem where a long time has elapsed between the recording of a reference set and a current set of features. In that case, if the elapsed time exceeds a threshold the verification process does not take place.

In accordance with one aspect of the present invention, a method of obtaining a parameter to enable an assessment of the level of confidence to which an individual has been verified prior to permitting the individual to perform a secure operation comprises performing an analysis on current and reference biometric features of the individual to generate a "goodness of match" parameter relating to the result of the analysis; and generating a "confidence of match" parameter by modifying the "goodness of match" parameter in accordance with the time interval between the current and previous submissions.

In accordance with a second aspect of the present invention, apparatus for obtaining a parameter to enable an assessment of the level of confidence to which an individual has been verified prior to permitting the individual to perform a secure operation comprises biometric analysing means for performing an analysis on current and reference biometric features of the individual to generate a "goodness of match" parameter relating to the analysis; and means for generating a "confidence of match" parameter by modifying the "goodness of match" in accordance with the time interval between the current and previous submissions.

We have devised a new method and apparatus in which less reliance is placed upon the absolute result of the biometric analysis and use is made of the time which has elapsed between current and previous submissions. The "previous submission" will typically be the immediately preceding submission but could instead be the last submission used to generate the reference features.

The modification to the goodness of match parameter may leave the parameter unchanged if the time between these submissions-is a typical "average"; decrease the parameter if the time between the submissions is below that "average"; and increase the parameter if the time between the submissions is above that "average". The extent of the adjustment could be set by analysis of a large typical population of true submissions with varying interval times between submissions.

A typical biometric analysis involves generating a Syndrome which represents the relationship between the current submission and the reference features and is usually calculated by comparing each pair of features (submission and reference) individually to determine the difference between them and then summing those differences.

In one preferred arrangement, the modification to the goodness of match parameter comprises applying weights to the differences between current and reference features during calculation of the Syndrome, the weights relating to the variability of each feature between submissions by that individual.

Such a process may, for example, increase the weighting for those measurements or features which for the individual have lower variability than is "average" for all individuals within a large population, and decrease the weighting for those measurements of features which for the individual have higher variability than is "average" for the same population.

In one example, the biometric analysis comprises generating two or more Syndromes using different sets or subsets of biometric features and/or different functions and/or different weightings of the features and then combining the set of Syndromes to produce the goodness of match parameter.

In a further example, the method further comprises modifying the "confidence of match" parameter by a factor quantifying the variability of the submissions for a given individual.

In a still further application, the method further comprises modifying the "confidence of match" parameter by a factor defining the vulnerability of the individual's biometric features to fraud. The vulnerability parameter may be expressed as a function of the expected goodness of match for a representative population of fraudulent submissions against the individual. The parameter could be derived by statistical analysis methods, from a large population of known fraudulent attempts against a large number of individuals; to derive correlations, between the reference features and the goodness of match, for fraudulent submissions. Such correlations are used to derive formulae and numerical constants fotr the estimation of vulnerability.

In the preferred process, the confidence of match parameter and the variance and vulnerability factors, (possibly with an estimate of the proportion of submissions that are fraudulent) are used to produce a parameter known as the Level of Confidence. This Level of Confidence parameter may be derived from; a) probability distributions of goodness of match for true and false distributions based upon the variance and vulnerability parameters; b) weighting such distributions by the supplied estimated proportions of submissions that are true and false; c) deriving a selected false distribution at the confidence of match for the current submission; d) deriving a selected true distribution at the confidence of match for the current submission; e) "combining" the values derived from the selected false and true distributions.

The invention is applicable to a wide variety of secure operations but is particularly suitable with transfer of value transactions, for example financial (payments) transactions.

Although the invention is applicable to various biometric features, it is particularly applicable to signature verification. Signatures are unique (amongst biometrics) in that false signatures will arise from deliberate attacks, rather than from accidental matches so that the verification procedure needs to protect against skilled, practiced forgeries. It is particularly important in this connection therefore to take account of the time lapse which has occured between current and previous signatures.

In view of the particular problem with fraudulent attacks, the modification of the "goodness of match" parameter to take account of vulnerability is particularly important. Furthermore, signature is particularly suitable when taking into account variances so that these can be analysed in relation to style characteristics at the time of the submission and can also be related to the time intervals between submissions.

The apparatus will preferably be implemented on a suitably programmed microcomputer although hardwired circuits may be used to form all or part of the apparatus.

An example of a transfer of value process incorporating a method according to the invention will now be described with reference to the accompanying drawings, in which: Figure 1 is a flow diagram of the transaction process; Figure 2 is a block diagram of the probability estimator shown in Figure 1; and, Figure 3 illustrates populations of combined Syndrome values.

In this transaction, an individual signature is obtained as the biometric from which two Syndromes are calculated, an analysis of those two Syndromes leading to a "goodness of match" parameter. This is adjusted temporally to achieve a "confidence of match" parameter which is then applied to a probability estimator together with vulnerability and variance parameters and also an estimated fraud rate parameter to generate a Level of Confidence parameter for use in a subsequent business decision process.

In step 1, the individual's signature is obtained and is captured in a conventional manner (step 2). This produces a series of positional (X,Y) co-ordinates as a function of time (3). A signature analysis process (4) operates upon this series of data to produce a series of parameter measures or features (5) which describe the static and dynamic characteristics of the signature.

If the signature has been submitted during enrolment, an enrolment process (6) is carried out which takes the individual values of each parameter measure over a set number of initial submissions and rejects any members of this set which are grossly atypical when compared with the rest of the set. Such a set of submissions may be taken at a single enrolment session, although other arrangements are possible. This set of values are used to generate a reference template (7).

The parameter measures for the signature analysis (4) are also applied to a measurement variance analyser (10) which stores the measurements and also compares the current set with the previously stored data to assess the degree of variation of each parameter measure for each individual as compared with such variation of the corresponding parameter measure for a typical population of individuals. From these comparisons, weight adjustment factors (11) are derived.

The current measurements (5) together with the weight adjustment factors (11) and the reference template (7) are fed to a Syndrome generator (8) which compares, parameter measure by measure, the reference template and current submission and produces two partially independent Syndromes. The generation of Syndromes is achieved by initially determining one or more Transgressions. Each transgression is a function of: 1) Difference values between the enrolled template and the submission, for that parameter; 2) The variability of that parameter, measured over a large population of true signers; and 3) a) The abilities of a population of forgers to achieve counterfeits of a population of true signers, for that parameter, b) The relative valuation of that parameter, within a set of parameters, for a large population of true signers.

Thus a Transgression T for a parameter n, may be specified as: Tn= fA(A)fB(B)fc(C)fD(D) (En-Xn) (1) where f, fB, fc, fDI are functions and (A), (B), (C), (D), are operators, which relate to the difference between an enrol Template value En and the Submission value Xn.

The Transgressions are "totalled", for a chosen set of parameters, to arrive at a "Distance", between the Submission and the Template profiles. This is a Syndrome (8): Syndrome

where N is the number of parameters within the chosen set.

Different parameter sets have different attributes, relative to the true/false signature verification performance. Thus one set may be better at discriminating between true and skilled forgeries of the true. Also since forgers vary in their abilities, relative to the target signatures, the parameter sets may be related to the skill of the forger and the vulnerability of the target. Also some individuals sign more consistently than others.

This approach leads to a choice of more than one parameter set and in consequence to the generation of more than one Syndrome. The choice of parameter sets is experimentally determined from signature data obtained from a large true/false population, paying due recognition to the signing characteristics (of the true signers) and the forgery abilities (of the false signers.) The two Syndromes (9) then enter a mapping process (12). This implements a function that inputs the two Syndromes to produce a "goodness of match" parameter (13).

This function can be envisaged as defined by a large number of contours on a graph of Syndrome 1 against Syndrome 2.

For each contour, the proportion of a representative population of true Submissions whose Syndromes will fall between that contour and the origin is known. The shape of the contours is chosen to maximise the separation between the distributions of the resulting parameter for true and false Submissions. The process determines the goodness of Match parameter by selecting the contour that passes nearest to the point defined by the two input Syndromes, and taking the corresponding proportion of the population of true Submissions whose Syndromes fall between that contour and the origin. The Napping process (12) implements a function, to relate the two Syndrome values, to a predefined series of contours on a graph of Syndrome 1 against Syndrome 2. The contours are determined by calculation, for a large population of true/false signature data, of the "proportion" of true Submissions whose Syndrome values fall between that contour and the origin (of the graph). The contours are plotted from the population data statistics by taking a series of the "proportion" values, e.g. 10%, 20%, 30% etc.

A goodness of Match is ascribed, by selection of the contour (value) that passes closest to the point representing the values of the two input Syndromes.

Although the method is described above as a comparison of a plotted point (on a graph) with pre-defined contours, which represent the goodness of Match values; the implementation of this Mapping Process (12) is achieved in practice by table look-up, derived from an algorithmic representation of the contours and utilising standard interpolation techniques.

It has been found that some subject's signatures "drift" over a period of time, such that over (say) 6 months the number of false rejects of true submissions (Type 1 errors) increases significantly. This is compensated for by allowing the reference Template to adapt, relative to the most recently (accepted) Submissions. Care is taken, in adaption, not to adapt too quickly to transient effects, therefore the reference Template (i.e. values of En) is gradually changed, that is changed relative to a factored proportion of the differences between En and Xn (for a successful Submission).

The use of Signature Verification, in a system with a memory means for storing transaction data (e.g. a smart card), allows for the Submission data from the most recent transactions to be stored, thereby permitting the adaption technique as described.

The measurement variance analyser (10) assesses the degree of variation of each parameter, by the calculation of the statistical standard deviation for the stored data of most recent Submissions. This variability is compared with the variability (standard deviation) of that parameter calculated for a large population (N.B. This population variability is part of the Transgression function). From these variability comparisons the weighting functions (11), within the formula are modified, by the use of weight adjustment factors, within the Syndrome Generator (8), to rescale the contribution of each parameter measurement, in the calculation of the Syndromes.Typically the adjustment to the weighting functions would be the equivalent of modifying the "built-in" variability value, by a proportion of the difference ratio between the parameter standard deviations of the most recent Submissions for the Subject, to the parameter standard deviations for a large population of True signers.

The method is applicable immediately following enrolment, since the enrol signature data is stored thereby permitting the calculation as described, the enrol signatures are signed in a single session however and they will therefore tend to be less variable than subsequent Submissions.

Account is now taken of the temporal variation which has been found to occur in some circumstances in genuine signatures. This adjustment is based on the following: (a) Individuals who frequently authorise transactions, by means of their signature, are likely to sign consistently - on a machine.

(b) Individuals who infrequently use their signature are unlikely to sign consistently.

Such signature variations are random, affect most of the features (of the signature), and occur over short time intervals (i.e. weeks). Otherwise signature variations are changes in "style" ie. the signer "drifts" from one signature style to another. This latter type of signature variation occurs over long time intervals (ie. months) and may be compensated for by adaption of the Reference Template.

Tests have shown that the signature variations referred to are slight, as regards any one signature feature, but the sum of the variations (for all features) can be significant. Thus any adjustment for this effect has to be relative to the Syndromes rather than to the individual feature Transgressions.

Tests have also shown that the population distributions of the combined Syndrome Values (for true signers) are as illustrated in Figure 3 where: 40 represents the histogram for "frequent" signers habitually signing (i.e. authorising transactions) at intervals of less than one week.

41 represents the histogram for signers offering signatures at intervals from 1 to 4 weeks.

42 represents the histogram for signers offering signatures at intervals greater than 4 weeks.

The Temporal Adjustment (14) is made by adjustment of the Goodness of Match parameter (13). The Goodness of Match is expressed in terms of the distance value of the Submission to the Reference Template; which, in turn, is expressed in terms of the combined Syndrome values relative to the contour graphs of Syndrome 1 against Syndrome 2.

The Temporal Adjustment factor is derived by determining the difference between the Syndrome Contour of the Submission and the Mean Value of a particular series of Syndrome Contours, that is the Syndrome Contour (series) relative to the distribution curves 40, 41 or 42.

That is to derive a variance factor (F) of the form:

for those cases where X > X, and where X is the value of the Syndrome Contour, for the Submission, X is the mean value of the Syndrome Contour, series related to the time between Submissions, a is the value of the standard deviation for the Syndrome Contour series related to the time between Submissions and, K is a constant, the value of which is dependent on whether X is greater or less than |al.

A Confidence of Match parameter (15) is the result of modifying the Goodness of Match (13) by the Temporal Adjustment (14) factor (F) derived as above. Note the Goodness of Match parameter is unchanged for those cases where X < X.

The adjustment to the Goodness of match parameter leaves: (a) The Goodness of Match parameter (13) unchanged if the time interval to the last submission (16) lies between 1 to 4 weeks; (b) Decreases this parameter (by the factor F), if the time interval is less than one week; and (c) Increases this parameter (by the factor F), if the time interval is greater than 4 weeks.

The Confidence of Match parameter (15) is fed to a probability estimator (22) and also to a business decision processor (26).

The probability estimator (22) also receives variance data (18) from a variance analyser to which is fed previously stored confidence of match parameters. The variance analyser (17) determines the mean value of the confidence of match parameters from the stored input to constitute the variance parameter (18).

Further input to the probability estimator (22) is a vulnerability parameter (20). This is generated by a vulnerability estimator (19) which takes inputs from the Enrolment Process (6), which: (a) Describe the style in which the signature is written. N.B. A signature in clear cursive script is easier to forge than a contrived signature.

(b) Describe the Threshold function ascribed to the individual's signature. N.B. The "looser" the Threshold function the easier the forger's task.

(c) Describe the amount of data content within the signature. N.B. The less the data content the easier the forger's task.

These inputs are (partially) derived from: (a) Measurements of the enrolment specimen signatures, e.g. the Threshold function.

(b) Computer interrogation of the enrolment supervisor.

The value of the Threshold function is part of the reference Template (7).

The Vulnerability is expressed in "Confidence of Match" terms.

An "estimated fraud rate" parameter (23) is generated by the business decision processor (26) and is the probability for fraudulent service user. In other words, it is an estimate of the proportion of submissions that are fraudulent and will generally vary depending upon the biometric features being analysed.

The probability estimator (22) is shown in more detail in Figure 2.

There are two series of histograms related to the Confidence of Match for a submission and derived from true/false submissions over a large population. The histograms represent the probability of a true/false verification and have a mean value and shape which for true submissions is dependent on the vulnerability of the population of true signatures, and which for false submissions is dependant on the vulnerability of the population of target signatures.

For each submission, a pair of these curves is selected. The variance parameter (18) is applied to a selector (27) from which the appropriate curve defining the distribution of true submissions is selected, while the vulnerability parameter (20) is applied to another selector (28) from which the appropriate curve representing the distribution for fraudulent submissions is selected. In practice, the selection of true curve submissions (27) takes the variance parameter (18), which is the mean of the stored values of the Confidence of Match parameters, and allocates that curve whose mean value lies closest to the variance value.The selection of curve of false (fraudulent) submissions (28) takes the vulnerability parameter (20), which is a value (expressed in terms of a Confidence of Match) derived from the current submission, and allocates that curve whose mean value lies closest to the vulnerability value.

The selected curves (29,30) are applied to a scaling processor (31) together with an estimated fraud rate parameter (23) (pf). This results in the two curves being combined to generate a probability function stored within a Probability Computation Unit (33). The current Confidence of Match parameter (15) is applied to this Computation unit (33) which selects values T,F from the true curve and the false curve respectively. From these values a probability of fraud parameter can be calculated as F/(T+F) and a Level of Confidence parameter T/(T+F).

This Level of Confidence parameter together with the Confidence of Match, variance and probability parameters (15,18,20) are then all fed to the business decision processor (26), usually after having been scaled in the range 0-100. The business decision processor (26) applies a business risk assessment from which a decision can be taken as to whether to allow the individual to complete the transaction of value.

Claims (16)

1. A method of obtaining a parameter to enable an assessment of the level of confidence to which an individual has been verified prior to permitting the individual -to perform a secure operation, the method comprising performing an analysis on current and reference biometric features of the individual to generate a "goodness of match parameter relating to the result of the analysis; and generating a "confidence of match" parameter by modifying the "goodness of match" parameter in accordance with the time interval between the current and previous submissions.

2. A method according to claim 1, wherein the biometric analysis comprises generating at least one Syndrome representing the relationship between the current and reference features, the Syndrome being calculated by determining the difference between respective pairs of current and reference features and then summing weighted versions of the differences, the weights representing the relationship of the variation in each feature for the individual compared with the variation for a population.

3. A method according to claim 2, wherein the "goodness of match parameter is determined by generating two syndromes based on different groups of features; and selecting from a set of graphs plotting the two syndromes for a population, and selecting the plotted value nearest to the position on the graph defined by the two syndromes for the individual.

4. A method according to any of the preceding claims, further comprising modifying the "confidence of match" parameter by a factor quantifying the variability of the submissions for a given individual.

5. A method according to any of the preceding claims, further comprising modifying the "confidence of match" parameter by a factor defining the vulnerability of the individual's biometric features to fraud.

6. A method according to claims 4 and 5, further comprising generating a resultant Level of Confidence parameter from the confidence of match parameter and the variance and vulnerability factors

7. A method according to any of the preceding claims, wherein the biometric features are signature features.

8. A method according to any of the preceding claims, wherein the "goodness of match" parameter is modified in accordance with the time interval between the current and immediately preceding submissions.

9. Apparatus for obtaining a parameter to enable an assessment of the level- of confidence to which an individual has been verified prior to permitting the individual to perform a secure operation, the apparatus comprising biometric analysing means for performing an analysis on current and reference biometric features of the individual to generate a "goodness of match" parameter relating to the analysis; and means for generating a "confidence of match" parameter by modifying the "goodness of match" in accordance with the time interval between the previous and current submissions.

10. Apparatus according to claim 9, wherein the biometric analysing means carries out an analysis which comprises generating at least one Syndrome representing the relationship between the current and reference features, the Syndrome being calculated by determining the difference between respective pairs of current and reference features and then summing weighted versions of the differences, the weights representing the relationship of the variation in each feature for the individual compared with the variation for a population.

11. Apparatus according to claim 9 or claim 10, wherein the "confidence of match" generating means modifies the "good of match" parameter by a factor quantifying the variability of the submissions for a given individual.

12. Apparatus according to any of claims 9 to 11, wherein the "confidence of match" generating means modifies the "goodness of match" parameter by a factor defining the vulnerability of the individual's biometric features to fraud.

13. Apparatus according to claim 11 and claim 12, further comprising means for generating a resultant Level of Confidence parameter from the confidence of match parameter and the variance and vulnerability factors.

14. Apparatus according to any of claims 9 to 13, wherein the biometric analysing means operates on a signature.

15. A method of obtaining a parameter to enable an assessment of the level of confidence to which an individual has been verified prior to permitting the individual to perform a secure operation substantially as hereinbefore described with reference to the accompanying drawings.

16. Apparatus for obtaining a parameter to enable an assessment of the level of confidence to which an individual has been verified prior to permitting the individual to perform a secure operation substantially as hereinbefore described with reference to the accompanying drawings.