Dialog-based voiceprint security for business transactions

Abstract

A system for biometrically securing business transactions uses speech recognition and voiceprint authentication to biometrically secure a transaction from a variety of client devices in a variety of media. A voiceprint authentication server receives a request from a third party requester to authenticate a previously enrolled end user of a client device. A signature collection applet presents the user a randomly generated signature string, prompting the user to speak the string, and recording the user's as he speaks. After transmittal to the authentication server, the signature string is recognized using voice recognition software, and compared with a stored voiceprint, using voiceprint authentication software. An authentication result is reported to both user and requestor. Voiceprints are stored in a repository along with the associated user data. Enrollment is by way of a separate enrollment applet, wherein the end user provides user information and records a voiceprint, which is subsequently stored.

1 . A system for securing a transaction, comprising: 
 an authentication server, wherein said server receives a request from a requestor over a network to authenticate an enrolled user of a client device, based on said user's voiceprint; and    a dialog-based signature collection component adapted to present said user a random signature string and record said signature string as the user speaks it,    said authentication server comprising: 
 a recognizer adapted to recognize the recorded signature string; and  
 a voiceprint authenticator adapted to compare said recorded signature string with a stored voiceprint of said user;  
   wherein said user is authenticated or rejected based on result of said comparison.    
     
     
         2 . The system of  claim 1 , wherein said requestor comprises a server running a business application.  
     
     
         3 . The system of  claim 1 , wherein said requestor comprises a telephony server.  
     
     
         4 . The system of  claim 1 , wherein said requestor communicates with said server over either a data network or a voice network.  
     
     
         5 . The system of  claim 1 , wherein said client device communicates with said server over either a data network or a voice network.  
     
     
         6 . The system of  claim 1 , wherein said transaction comprises a business transaction  
     
     
         7 . The system of  claim 1 , wherein authentication is requested by signaling said authentication server an identifier, network address and, optionally, a device signature associated with said user.  
     
     
         8 . The system of  claim 1 , wherein said signature collection component comprises an interactive signature collection applet instantiated on said client device.  
     
     
         9 . The system of  claim 8 , wherein said signature collection applet is adapted to: 
 present the user a randomly generated signature string sent from said server;    prompt the user to speak the randomly generated signature string;    record the said spoken signature string as an audio file, using device-specific recording objects;    gather device signature configuration by reading configuration of said client device; and    send said audio file and said device configuration to said authentication server.    
     
     
         10 . The system of  claim 8 , wherein said signature collection applet is adapted to report an authentication result to the user.  
     
     
         11 . The system of  claim 8 , wherein said signature collection applet is one of: 
 pre-installed on said client device; and    served up from said authentication server.    
     
     
         12 . The system of  claim 8 , wherein said signature collection applet is software and device-specific.  
     
     
         13 . The system of  claim 8 , wherein said client device includes: 
 a software environment capable of running said signature collection applet;    sufficient memory to run said applet;    audio recording capabilities;    readable device configuration data; and    capability to send said signature string and said device configuration data.    
     
     
         14 . The system of  claim 8 , wherein said client device comprises any of: 
 a personal computer;    a WAP (wireless access protocol) telephone;    a PDA (personal digital assistant); and    a conventional telephone.    
     
     
         15 . The system of  claim 1 , wherein said authentication server further comprises: 
 a dispatcher;    at least one authentication client;    an enrollment client; and    a voiceprint server.    
     
     
         16 . The system of  claim 15 , wherein said dispatcher comprises; 
 a load balancer, said load balancer adapted to receive authentication requests and direct said requests to available authentication clients;    a logger, said logger adapted to log system load data; and    a watcher, said watcher adapted to: 
 start and shut down authentication clients in response to system demand;  
 terminate unresponsive authentication clients;  
 restart authentication clients that terminate abnormally.  
   
     
     
         17 . The system of  claim 15 , wherein said authentication client comprises: 
 a transaction manager;    a logger;    a random signature generator;    an applet launcher;    an authentication requester; and    a dialog manager.    
     
     
         18 . The system of  claim 17 , wherein said transaction manager is adapted to: 
 receive an authentication request from said dispatcher;    respond to a progress query from a requestor; and    return an authentication result to a requestor.    
     
     
         19 . The system of  claim 17 , wherein said logger is adapted to: 
 log authentication transaction data.    
     
     
         20 . The system of  claim 17 , wherein said random signature generator is adapted to: 
 generate random signatures for use by signature collection applets.    
     
     
         21 . The system of  claim 17 , wherein said authentication requestor is adapted to: 
 pass an audio file to said voiceprint server along with identifier of associated user; and    identify best acoustic model for recognition and verification based on a client device signature.    
     
     
         22 . The system of  claim 17 , wherein said dialog manager is adapted to: 
 supply dialog box content to applets;    evaluate recognition and verification results as compared to configured thresholds;    determine authentication result and potential need for retries; and    interact with other clients to manage data and decision flow.    
     
     
         23 . The system of  claim 17 , wherein said enrollment client comprises: 
 an enrollment manager;    a logger;    an identity manager;    an applet launcher;    an enrollment requestor; and    a dialog manager    
     
     
         24 . The system of  claim 23 , wherein said enrollment manager is adapted to: 
 receive enrollment request and device signature from a user;    manage enrollment dialog with a user; and    confirm completion of enrollment process.    
     
     
         25 . The system of  claim 23 , wherein said logger is adapted to: 
 log enrollment transaction data.    
     
     
         26 . The system of  claim 23 , wherein said identity manager is adapted to: 
 manage user-specific data necessary to confirm identity of a user during enrollment process.    
     
     
         27 . The system of  claim 23 , wherein said applet launcher is adapted to: 
 serve up a device appropriate enrollment applet to a client device based on device signature and network address;    receive signature files from said applet; and    send enrollment result to said applet for display.    
     
     
         28 . The system of  claim 23 , wherein said enrollment requestor is adapted to: 
 pass an audio file to said voiceprint server along with user identity information requesting recognition and verification results; and    use device signature to identify best acoustic models for recognition and verification.    
     
     
         29 . The system of  claim 28 , wherein said dialog manager is adapted to: 
 supply dialog box content to applets;    evaluate recognition and verification results as compared to configured thresholds;    determine authentication result and potential need for retries;    interact with other clients to manage data and decision flow; and    store a voiceprint in a repository.    
     
     
         30 . The system of  claim 15 , wherein said recognizer comprises at least one computer readable speech recognition program, wherein said speech recognition program recognizes said recorded signature string.  
     
     
         31 . The system of  claim 30 , wherein said voiceprint authenticator comprises at least one computer-readable program for voiceprint authentication.  
     
     
         32 . The system of  claim 31 , wherein said voiceprint server comprises: 
 means for receiving files from said authentication client for recognition and verification;    a software interface that integrates with API's to said speech recognition and voiceprint authentication programs to pass audio files and select appropriate grammars and acoustic models and to receive recognition and verification results; and    a voiceprint manager for managing storage and retrieval of voiceprints from a depository.    
     
     
         33 . The system of  claim 32 , wherein said server computes confidence values for recognition and authentication, wherein minimum and maximum thresholds are set for each confidence value.  
     
     
         34 . The system of  claim 33 , wherein: 
 if both confidence values exceed corresponding maximum thresholds, the user is authenticated;    if both confidence levels fall below corresponding minimum thresholds, the user is rejected as an imposter; and    if one or both confidence levels fall between thresholds, the user is prompted to re-record the signature string.    
     
     
         35 . The system of  claim 1 , further comprising means for: 
 secure transmission among said requestor, said authentication server and said client.    
     
     
         36 . A method for securing a transaction, comprising: 
 receiving a request over a network at an authentication server from a requestor to authenticate an enrolled user of a client device, based on said user's voiceprint;    instantiating a dialog-based signature collection component on said client device;    presenting a random signature string and recording said signature string as the user speaks it,    recognizing said recorded signature string by a recognizer at said authentication server;    comparing said recorded signature string with a stored voiceprint of said user by a voiceprint authenticator at said authentication server; and    authenticating or rejecting said user based on an authentication result.    
     
     
         37 . The method of  claim 36 , wherein said requestor comprises a server running a business application.  
     
     
         38 . The method of  claim 36 , wherein said requestor comprises a telephony server.  
     
     
         39 . The method of  claim 36 , wherein said requestor communicates with said server over either a data network or a voice network.  
     
     
         40 . The method of  claim 36 , wherein said client device communicates with said server over either a data network or a voice network.  
     
     
         41 . The method of  claim 36 , wherein said transaction comprises a business transaction.  
     
     
         42 . The method of  claim 36 , wherein authentication is requested by signaling said authentication server an identifier, network address and optionally, a device signature associated with said user.  
     
     
         43 . The method of  claim 36 , wherein said signature collection component comprises an interactive signature collection applet.  
     
     
         44 . The method of  claim 43 , wherein the step of presenting and recording comprises the steps of: 
 presenting the user a randomly generated signature string sent from said server;    prompting the user to speak the randomly generated signature string;    recording the spoken signature string as an audio file, using device-specific recording objects;    gathering a device signature by reading configuration of said client device; and    sending said audio file and said device configuration to said authentication server.    
     
     
         45 . The method of  claim 43 , further comprising the step of reporting the authentication result to the user through the signature collection applet.  
     
     
         46 . The method of  claim 43 , wherein said signature collection applet is one of: 
 pre-installed on said client device; and    served up from said authentication server.    
     
     
         47 . The system of  claim 43 , wherein said signature collection applet is software and device-specific.  
     
     
         48 . The system of  claim 43 , wherein said client device comprises any of: 
 a personal computer;    a WAP (wireless access protocol) telephone; and    a PDA (personal digital assistant; and    a conventional telephone.    
     
     
         49 . The method of  claim 36 , further comprising the step of: 
 on said authentication server, providing any of: 
 a dispatcher;  
 at least one authentication client;  
 an enrollment client; and  
 voiceprint server.  
   
     
     
         50 . The method of  claim 49 , said step of providing a dispatcher comprising the steps of: 
 receiving an authentication request at said dispatcher; and    directing said request to an available authentication clients.    
     
     
         51 . The method of  claim 49 , said step of providing a dispatcher comprising the steps of: 
 logging system load data;    starting and shutting down authentication clients in response to system demand;    terminating unresponsive authentication clients; and    restarting authentication clients that terminate abnormally.    
     
     
         52 . The method of  claim 49 , said step of providing an authentication client comprising the steps of: 
 receiving an authentication request from said dispatcher;    responding to a progress query from a requestor; and    returning an authentication result to a requestor.    
     
     
         53 . The method of  claim 49 , said step of providing an authentication client comprising the step of: 
 logging authentication transaction data.    
     
     
         54 . The method of  claim 49 , said step of providing an authentication client comprising the step of: 
 generating random signatures for use by signature collection applets.    
     
     
         55 . The method of  claim 49 , said step of providing an authentication client comprising the steps of: 
 passing an audio file to said voiceprint server along with identifier of associated user; and    identifying best acoustic model for recognition and verification based on a client device signature.    
     
     
         56 . The method of  claim 49 , said step of providing an authentication client comprising the steps of: 
 supplying dialog box content to signature collection applets;    evaluating recognition and verification results as compared to configured thresholds;    determining authentication result and potential need for retries; and    interacting with other clients to manage data and decision flow.    
     
     
         57 . The method of  claim 49 , said step of providing an enrollment client comprising the steps of: 
 receiving enrollment request and device signature from a user;    managing enrollment dialog with a user; and    confirming completion of enrollment process.    
     
     
         58 . The method of  claim 49 , said step of providing an enrollment client comprising the step of: 
 logging enrollment transaction data.    
     
     
         59 . The method of  claim 49 , said step of providing an enrollment client comprising the step of: 
 managing user-specific data necessary to confirm identity of a user during enrollment process.    
     
     
         60 . The method of  claim 49 , said step of providing an enrollment client comprising the steps of: 
 serving up a device appropriate enrollment applet to a client device based on device signature and network address;    receiving signature files from said applet; and    sending enrollment result to said applet for display.    
     
     
         61 . The method of  claim 49 , said step of providing an enrollment client comprising the steps of: 
 passing an audio file to said voiceprint server along with user identity information requesting recognition and verification results; and    using device signature to identify best acoustic models for recognition and verification.    
     
     
         62 . The method of  claim 49 , said step of providing an enrollment client comprising the steps of: 
 supplying dialog box content to applets;    evaluating recognition and verification results as compared to configured thresholds;    determining authentication result and potential need for retries;    interacting with other clients to manage data and decision flow; and    storing a voiceprint in a repository.    
     
     
         63 . The method of  claim 49 , said recognizer comprising at least one computer readable speech recognition program.  
     
     
         64 . The method of  claim 63 , wherein said voiceprint authenticator comprises at least one computer-readable program for voiceprint authentication.  
     
     
         65 . The method of  claim 64 , the step of providing a voiceprint server comprising the steps of: 
 receiving files from said authentication client for recognition and verification;    providing a software interface that integrates with API's to said speech recognition and voiceprint authentication programs to pass audio files and select appropriate grammars and acoustic models and to receive recognition and verification results; and    providing a voiceprint manager for managing storage and retrieval of voiceprints from a depository.    
     
     
         66 . The method of  claim 65 , further comprising the step of: 
 computing confidence values for recognition and authentication, wherein minimum and maximum thresholds are set for each confidence value.    
     
     
         67 . The method of  claim 66 , further comprising one of the steps of: 
 if both confidence values exceed corresponding maximum thresholds, authenticating the user;    if both confidence levels fall below corresponding minimum thresholds, rejecting the user as an imposter; and    if one or both confidence levels fall between thresholds, prompting the user to re-record the signature string.    
     
     
         68 . The method of  claim 36 , further comprising the step of: 
 providing a secure transmission environment among said requestor, said authentication server and said client.