Granted Patent B2

US 12,242,582 · App. 18/209,332 · Granted Mar 4, 2025

Inventor: Arun Vemury (North Bethesda, MD)

Assignee: The Government of the United States of America, as represented by the Secretary of Homeland Security

G06F21/32G06F21/602G06F21/6245G06V40/168G06V40/172G06V40/50H04L9/008H04L9/3231

Abstract

Claims (97)

1. A method for HE (homomorphic encrypted), privacy BGH(k)-protective, dynamically expandable, distributed resource biometrics identification and verification processing, with exception based local cleartext failover comprising:

an interface session logic of a biometric capture, EP HE ECDS (biometric capture, exception protective HE encryption and distribution) unit storing a correspondence (TID(k)↔BGH(k)), between captured biographic information BGH(k) and a temporary identifier TID(k);

the biometric capture, EP HE ECDS unit appending TID(k) to communications from the unit to a third-party computer resource of a k th user; k is a natural number;

the third-party computer resource appending TID(k) to processing results the third-party computer resource communicates back to the biometric capture, EP HE ECDS unit;

the biometric capture, EP HE ECDS unit including a biometric capture device; the biometric capture device capturing one or more types of biometric information BM(k) of the k th user;

the biometric capture, EP HE ECDS unit including biometric feature vector logic; the biometric feature vector (FV) logic computing from the biometric information BM(k), a biometric feature vector FV(BM(k));

the biometric capture, EP HE ECDS unit including HE encrypting logic; the HE encrypting logic HE encrypting FV(BM(k)) to generate HE{FV(BM(k))}; and

uploading the HE feature vector encrypted biometric information HE{FV(BM(k))} to a biometric reference gallery holding biometric information in memory;

generating HE encryption of a feature vector of a first user's biometric information (FV(BM(k 1 );

generating HE encryption of a feature vector of a second user's biometric information FV(BM(k 2 ));

wherein HE encryption of the feature vector of a first user's biometric information is identical to the HE encryption of the feature vector of a second user's biometric information, irrespective of the two feature vectors having different values; and

detecting a collision wherein the first user feature vector and the second user feature vector, k 1 not being equal to k 2 , and FV(BM(k 1 )) not being equal to FV(BM(k 2 )), there is an instance of HE{FV(BM(k 1 ))} being identical to HE{FV(BM(k 2 ))}.

2. The method of claim 1 comprising the step of the biometric capture device capturing a row-by-column pixel array of a facial image of the k th user.

3. The method of claim 1 wherein the biometric feature vector logic computes FV(BM(k)) using an orthogonal basis function transformation selected from the list consisting essentially of DWT, Walsh Transform, WHT, and combinations thereof.

4. The method of claim 1 wherein the step of providing failover biometric processing in response further comprises biometric classifying, relative to the biometric reference gallery, of:

a cleartext version of the feature vector FV(BM(k)) computed by the biometric feature vector logic; or

a cleartext version of the captured biometric information BM(k).

5. The method of claim 1 comprising:

receiving the third-party computer resource HE processing results including appended TID(k);

determining no match was found; and

performing system internal cleartext biometric processing, using a cleartext form of BM(k) or a cleartext form of FV(BM(k)).

6. The method of claim 1 comprising the steps of:

the exception detection and failover logic determining HE{FV(BM(k))} is not a collision with an earlier HE{FV(BM(k′))}; and

the HE encrypting logic uploading HE{FV(BM(k))} and TID(k) to FV similarity logic in the third-party computer resource; the third-party computer resource comprising a matching output logic;

the matching output logic sending a classification result and TID(k) to the biometric capture, EP HE ECDS unit or a third-party recipient; and

an HE domain classifier configuring logic configuring the third-party computer resource to perform non-decrypting HE domain classifying of the uploaded HE encrypted biometric information of the k th user.

7. The method of claim 6 wherein the step of configuring the third-party computer resource comprising the step of configuring for non-decrypting HE domain 1:N classifying of the user's HE encrypted biometric information against N verified reference identifies for which the biometric reference gallery stores reference biometric information.

8. The method of claim 7 wherein the biometric reference gallery stores a gallery of biometric reference images (RG(i), i=1 to N).

9. The method of claim 1 comprising the steps of

HE domain classifier configuring logic configuring the third-party computer resource to perform non-decrypting HE domain classifying of the uploaded HE encrypted biometric information of the k th user;

the third-party computer resource configuring non-decrypting HE domain 1:N classifying of the user's HE encrypted biometric information against N verified reference identifies for which the biometric reference gallery stores reference biometric information;

the biometric reference gallery storing a gallery of biometric reference images RG(i), (i=1 to N); the biographic reference images RG captured from a population of N different, verified individuals; and

the biometric reference gallery storing, for each of N identities, one or more biometric reference images RG, of one or more biometric types; wherein the biometric types are selected from the list consisting essentially of biometric reference images RG, eye scan images, facial images, fingerprint images, and combinations thereof, for each of N identities; and the biometric reference images (RG) are selected from the list consisting essentially of images at different capture angles, different lightings, different facial expressions and different fingers.

10. The method of claim 9 wherein the HE domain classifier configuring logic includes:

HE encrypted reference gallery generating logic; the HE encrypted reference gallery generating logic generating a HE encrypted biometric reference gallery (HE{FV(RG(i))), i=1 to N); and

uploading logic uploading the HE encrypted biometric reference gallery to the third-party computer resource; the HE encrypted biometric reference gallery including HE encryptions of feature vectors (FV(RG(i))) of the reference gallery images RG(i).

11. The method of claim 10 wherein the HE encrypted reference gallery generating logic comprises:

feature vector generating logic generating logic generating FV(RG(i) for i=1 to N by applying an orthogonal basis transformation;

HE encryption logic generating HE{FV(RG(i))), for i=1 to N; and

uploading logic uploading the HE encrypted biometric reference gallery (HE{FV(RG(i))}, i=1 to N) to the third-party computer resource.

12. The method of claim 10 comprising the steps of:

the third-party computer resource receiving HE encrypted biometric reference gallery (HE{FV(RG(i))), i=1 to N); and

feature vector similarity logic (FV similarity logic, HE{FV(BM(k))} against reference HE{FV(RG(i))}, i=1, N) determining a level of similarity between a current HE encrypted feature vector of biometric information k against a reference list of HE encrypted feature vectors reference gallery information i through N.

13. A method for HE (homomorphic encrypted), privacy BGH(k)-protective, dynamically expandable, distributed resource biometrics identification and verification processing, with exception based local cleartext failover comprising:

an interface session logic of a biometric capture, EP HE ECDS (biometric capture, exception protective HE encryption and distribution) unit storing a correspondence (TID(k)↔BGH(k)), between captured biographic information BGH(k) and a temporary identifier TID(k);

the biometric capture, EP HE ECDS unit appending TID(k) to communications from the unit to a third-party computer resource of a k th user; k is a natural number;

the third-party computer resource appending TID(k) to processing results the third-party computer resource communicates back to the biometric capture, EP HE ECDS unit;

the biometric capture, EP HE ECDS unit including a biometric capture device; the biometric capture device capturing one or more types of biometric information BM(k) of the k th user;

the biometric capture, EP HE ECDS unit including biometric feature vector logic; the biometric feature vector (FV) logic computing from the biometric information BM(k), a biometric feature vector FV(BM(k));

the biometric capture, EP HE ECDS unit including HE encrypting logic; the HE encrypting logic HE encrypting FV(BM(k)) to generate HE{FV(BM(k))}; and

uploading the HE feature vector encrypted biometric information HE{FV(BM(k))} to a biometric reference gallery holding biometric information in memory;

the exception detection and failover logic comprises:

a holding memory storing temporarily a copy of the captured biometric information BM(k) and a copy of the biometric feature vector FV(BM(k));

an accumulated homomorphic encrypted feature vector memory (Accumulated HE{FV}MRY);

an exception detection and memory update logic; the exception detection and memory update logic connected to the HE encrypting logic of the biometric capture, EP HE ECDS unit; the HE encrypting logic is configured such that uploading of HE{FV(BM(k))} is conditioned on verification by the exception detection and memory update logic that the HE{FV(BM(k))} value is not a collision with an earlier HE{FV(BM(k′))}, FV(BM(k′)) being an earlier computed biometric feature vector FV(BM(k′)), for a biometric image BM(k′) captured from a k′ user; and

a local failover verification and identification logic (LCL FO VF-ID Logic); the local failover verification and identification controlling biometric classification relative to the biometric reference gallery of cleartext feature vector FV(BM(k)) or cleartext captured biometric image BM(k) held in the holding memory.

14. A method for HE (homomorphic encrypted), privacy BGH(k)-protective, dynamically expandable, distributed resource biometrics identification and verification processing, with exception based local cleartext failover comprising:

an interface session logic of a biometric capture, EP HE ECDS (biometric capture, exception protective HE encryption and distribution) unit storing a correspondence (TID(k)↔BGH(k)), between captured biographic information BGH(k) and a temporary identifier TID(k);

the biometric capture, EP HE ECDS unit appending TID(k) to communications from the unit to a third-party computer resource of a k th user; k is a natural number;

the third-party computer resource appending TID(k) to processing results the third-party computer resource communicates back to the biometric capture, EP HE ECDS unit;

the biometric capture, EP HE ECDS unit including a biometric capture device; the biometric capture device capturing one or more types of biometric information BM(k) of the k th user;

the biometric capture, EP HE ECDS unit including biometric feature vector logic; the biometric feature vector (FV) logic computing from the biometric information BM(k), a biometric feature vector FV(BM(k));

the biometric capture, EP HE ECDS unit including HE encrypting logic; the HE encrypting logic HE encrypting FV(BM(k)) to generate HE{FV(BM(k))}; and

uploading the HE feature vector encrypted biometric information HE{FV(BM(k))} to a biometric reference gallery holding biometric information in memory;

for exception failover augmented, homomorphic encrypted (HE) distributing, and end-to-endpoint persistent encryption, and distributed HE domain non-decrypting, privacy-protective biometric processing, comprising:

capturing a biometric information of an individual as a biometric record;

computing a biometric feature data based at least in part on the biometric record;

generating HE biometric feature data based at least in part on homomorphic encrypting the biometric feature data;

determining an exception status of the HE biometric feature data, between exception and non-exception;

responsive to the non-exception status:

HE distributing the HE biometric feature data to an external computer processing resource;

performing, by the external computer processing resource, a HE domain, non-decrypting biometric classifying of the HE biometric feature data, and sending from the external computer processing resource to a designated destination a result of the HE domain, non-decrypting biometric classifying; and

responsive to the exception status: performing a non-distributed classifying of the biometric feature data, or the biometric record.

15. The method of claim 14 for exception failover augmented, HE encryption and persistent HE, privacy-protective distributed non-decrypting HE domain biometric processing, further comprising:

receiving a biographical information of a user;

generating a temporary identifier;

storing a correspondence between the temporary identifier and at least a portion of the biographical information;

communicating, in association with communicating the biometric information to the external computer processing resource, the temporary identifier to the external computer processing resource; and

communicating, by the external computer processing resource, the temporary identifier in association with the result of the HE domain, non-decrypting biometric classifying.

16. The method of claim 14 for exception failover augmented, HE encryption and persistent HE, privacy-protective distributed non-decrypting HE domain biometric processing, further comprising configuring the external computer processing resource to perform the HE domain, non-decrypting biometric classifying of the homomorphic encrypted biometric feature data.

17. The method of claim 16 for exception failover augmented, HE encryption and persistent HE, privacy-protective distributed non-decrypting HE domain biometric processing, further comprising:

generating a HE biometric reference gallery, including a HE biometric reference data for each of N identities; and

the configuring the external computer processing resource to perform the HE domain, non-decrypting biometric classifying of the HE biometric feature data to include:

communicating the HE biometric reference gallery to the external computer processing resource; and

configuring the external computer processing resource to perform the classifying the HE biometric feature data based at least in part on computing a respective similarity between the HE biometric feature data and the HE biometric reference data for each of the N identities.

18. The method of claim 14 for exception failover augmented, HE encryption and persistent HE, privacy-protective distributed non-decrypting HE domain biometric processing, wherein the determining the exception status of the HE biometric feature data, between exception and non-exception comprises:

determining whether the HE biometric feature data differs from all stored generated HE biometric feature data in an accumulated HE biometric feature data database;

responsive to determining the HE biometric feature data differs from all stored generated HE biometric feature data in the accumulated HE biometric feature data database; determining the exception status as non-exception and storing the HE biometric feature data in the accumulated database of generated HE biometric feature data; and

based at least in part on determining the HE biometric feature data is not different from all stored generated HE biometric data in the accumulated database of generated HE biometric feature data, determining the exception status as exception.

19. The method of claim 18 for exception failover augmented, HE encryption and persistent HE, privacy-protective distributed non-decrypting HE domain biometric processing, further comprising:

receiving a biographical information of a user; and

storing the HE biometric feature data in the accumulated database of generated HE biometric feature data to include storing, in association with the generated HE biometric feature data, at least a portion of the biographic information of the user as a stored biographic information.

20. The method of claim 19 for exception failover augmented, HE encryption and persistent HE, privacy-protective distributed non-decrypting HE domain biometric processing, further comprising:

responsive to determining the HE biometric feature data is stored in the accumulated database, comparing the biographic information of the user to the stored biographic information associated with the stored HE biometric feature data;

storing the HE biometric feature data in the accumulated database of generated HE biometric feature data to include storing, in association with the generated HE biometric feature data, at least a portion of the biographic information in the accumulated database of generated HE biometric feature data;

generating a temporary identifier; and

storing a correspondence between the temporary identifier and at least a portion of the biographical information.

Continuity (3)

References Cited (65)