Process and arrangement for authenticating a user of facilities, a service, a database or a data network
View Patent ↗A process for authenticating a user to control remote access to a service, data base or data network is provided, in which during an enrollment step, an initial voice sample provided by the user is analyzed to obtain an initial user-specific voice profile and, in a later verification step, a current voice sample of the user is analyzed and compared to the initial voice profile to generate an access control signal. An additional user-dedicated authentication is generated in a pre-enrollment period, and the additional authentication is used to authenticate the user in the enrollment step and/or in an access control step prior to and independent on the enrollment step, in a provisional or supplementary authentication procedure.
1. A process for authenticating a user, to control his remote access to a service, data base or data network using a computer system or electronic computing device, comprising: in an enrolment step, providing an identification and an initial voice sample by the user and analyzing the initial voice sample to obtain an initial user-specific voice profile and, in a later verification step, providing the identification and a current voice sample by the user and analyzing the current voice sample to obtain a current voice profile which is compared to the initial user-specific voice profile to generate an access control signal in response to a result of the comparison step, generating an additional user-dedicated authenticating means in a pre-enrolment period, using the additional user-dedicated authenticating means to authenticate the user in the enrolment step and/or in an access control step prior to and independent of the enrolment step, in a provisional or supplementary authentication procedure,
wherein the additional authenticating means comprises a system-specific ID card, with the system-specific ID card displaying a unique system specific PIN or similar code, and the method further comprises system-internally linking the PIN or the code to the user and corresponding data of the user, and shipping the system-specific ID card as a blank card and activating the blank card upon request of the user and in response to an input of the system-specific PIN or similar code at a data or telecommunication terminal of the user.
2. The process according to claim 1 , wherein the additional authentication means comprises (i) a PIN or similar code, and (ii) a user-specific set of information items, and the method further comprises the user initially inputting the user-specific set of information items in the pre-enrolment period.
3. The process according to claim 1 , further comprising in the enrolment step, as well as in the verification step, requesting at least data elements of the additional authentication means from the user as a voice sample and spoken by the user to be made subject of the analysis of the initial voice sample, without involving a speech recognition step.
4. The process according to claim 1 , further comprising in the enrolment step and/or an access control step prior to the enrolment step, requesting the user to input a PIN or similar code, optionally together with an additional user-specific information item, by speaking the PIN or similar code or via a data or telecommunication terminal keyboard, to identify and provisionally authenticate the user to obtain access to the enrolment step and/or the access control step.
5. The process according to claim 1 , wherein the pre-enrolment period and the enrolment step are timed close to each other and the additional authenticating means are generated immediately in advance of the enrolment step.
6. The process according to claim 1 , wherein the supplementary authentication procedure is connected to the enrolment step or the verification step, such that a combined authentication procedure with enhanced validity is created.
7. The process according to claim 1 , further comprising transmitting data and voice samples input by the user to an authentication server via a telecommunication network.
8. The process of claim 1 , further comprising informing the user of a result of the authentication steps only after the current voice sample is verified and the additional user-dedicated authenticating means is authenticated to limit feedback about success or failure of the authentication layers.
9. The process of claim 1 , further comprising the additional user-dedicated authenticating means being provided as shared secret information in the initial voice sample by the user.
10. An arrangement for authenticating a user and controlling his remote access to a service, data base or data network, the arrangement comprising
a user data and telecommunication terminal comprising a data input device and a speech input device for inputting a user's voice sample, an authentication server for processing data and voice samples input by the user and an at least temporary network connection of the user terminal to the authentication server, wherein the authentication server comprises a user identification recognition stage that recognizes a user identification, a voice profile generator, a voice processor to analyse user's voice samples to obtain a respective user-specific voice profile, a voice profile storage device for storing processed user's voice samples, and a voice profile comparator for comparing a current voice profile evaluated from a user's current voice sample with an initial voice profile stored in the voice profile storage device for obtaining a first authentication output based on a voice sample input by the user, and a user data processor, user data storage device for storing corresponding reference data of the user, and a user data comparator for comparing the referenced user data with data currently received from the user terminal for obtaining a second authentication output from data input by the user and an access control signal generator to generate an access control signal only after receiving the first and second authentication outputs,
an ID Card generator for generating a physical system-specific ID card comprising a system-specific ID or similar code being unambiguously assigned to a user-specific set of information items, the user-specific set of information items including at least one of a user ID or an ID storage device for storing the system-specific ID or similar code in unambiguous assignment to the user-specific set of information items, wherein the ID storage device acts as a user data storage device and is connected to an input of the user data comparator, and
a user card activating device for activating a previously generated and distributed system-specific ID card in response to an input of the system-specific ID or similar code via a data or telecommunication terminal.
11. The arrangement according to claim 10 , wherein the access control signal generator is connected to an output of the voice profile comparator, for outputting the access control signal in response to the output of the voice profile comparator, wherein the authentication server further comprises a user data receiver for receiving data input at the user terminal via the data input device, the output of the user data comparator being connected to an auxiliary input of the access control signal generator, to enable the access control signal generator to output the access control signal in response to an input from the user data comparator.
12. The arrangement according to claim 10 , further comprising:
a voice sample input instruction device for instructing the user to input a PIN or similar code or predetermined information items as the user's voice sample via the speech input device, and a text sample storage device for storing text samples which are subject of the user's voice sample input by the user, in response to instructions obtained from the authentication server, wherein the text sample storage device is connected to the voice processor to enable processing of the user's voice sample without an automatic speech recognition step.
13. The arrangement according to claim 12 , wherein the voice sample input instruction device is adapted to output the instructions to the user in a frame of a user ID card or system-specific ID card comprising the text samples stored in the text sample storage or unique identifiers of the text samples.
14. The arrangement according to claim 12 , wherein the voice sample input instruction device is adapted to output the instructions to the user in a frame of a system-user dialogue via a telecommunications or data network.