Data processing apparatus and method

Abstract

There is described an apparatus for generating a cryptographic key using data representative of an analogue source. The apparatus has a number generator which processes the data representative of the analogue source to generate an intermediate key, the intermediate key being a number, and a data store for storing a mapping key, the mapping key being a number predetermined to combine with the intermediate key in accordance with a monotonic mapping function to generate a desired cryptographic key. Preferably, the number generator processes the data representative of an analogue source in accordance with stored process data, determined by a training process, which indicates attributes of the data whose values are to be measured and adjustment data for adjusting the values to improve the repeatability of generation of the intermediate key.

1 . An apparatus for generating a cryptographic key, the apparatus comprising: 
 a receiver operable to receive data representative of an analogue source;    a number generator operable to process the received data to generate an intermediate key representative of the received data, said intermediate key being a number;    a data store for storing a mapping key, said mapping key being a predetermined number; and    a key generator operable to combine the intermediate key and the stored mapping key in accordance with a monotonic mapping function to generate the cryptographic key.    
     
     
         2 . An apparatus according to  claim 1 , wherein the number generator is operable to generate the number from at least one attribute value of a feature within the data representative of the analogue source, and wherein the number generator comprises: 
 a process data store operable to store process data, determined by a training process, for controlling the processing of the data representative of the analogue source; and    a data processor operable to process the data representative of the analogue source, using the stored process data, to determine said at least attribute value.    
     
     
         3 . An apparatus according to  claim 2 , wherein the process data comprises feature information indicative of at least one feature within the data representative of the analogue source, and wherein the data processor is arranged to select the at least one feature for which said at least one attribute value is determined using the feature information of the process data.  
     
     
         4 . An apparatus according to  claim 3 , wherein the data processor is operable to exclude the or each feature identified by the feature information.  
     
     
         5 . An apparatus according to any of  claims 2  to  4 , wherein the process data comprises reference alignment data, and wherein the data processor is operable to vary the data representative of the analogue source in accordance with the stored reference alignment data.  
     
     
         6 . An apparatus according to any of  claims 2  to  5 , wherein the process data comprises segmentation data, and wherein the data processor is operable to segment the data representative of the analogue source in accordance with the stored segmentation data.  
     
     
         7 . An apparatus according to any of  claims 2  to  6 , wherein the process data identifies at least one basis function, and wherein the data processing apparatus is arranged to determine an attribute value by determining a transform co-efficient from the data representative of the analogue source using the stored basis function.  
     
     
         8 . An apparatus according to any of  claims 2  to  7 , wherein the said at least one attribute value comprises a measurement value corresponding to a measurement of an attribute of a feature, wherein the process data comprises value adjustment data, and wherein the data processor is arranged to adjust the measurement value using the value adjustment data.  
     
     
         9 . An apparatus according to  claim 8 , wherein the value adjustment data comprises offset data, and wherein the data processor is arranged to adjust the measurement value using the offset vector.  
     
     
         10 . An apparatus according to  claim 8  or  9 , wherein the value adjustment data comprises a scaling factor, and wherein the data processor is arranged to scale the measurement value using the scaling factor to generate a scaled attribute value.  
     
     
         11 . An apparatus according to  claim 10 , wherein the data processor is operable to apply a predetermined strategy to reduce the resolution of the scaled attribute value.  
     
     
         12 . An apparatus according to  claim 11 , wherein the scaling factor defines a plurality of quantisation levels, and wherein the data processor is operable to truncate the scaled attribute value.  
     
     
         13 . An apparatus according to  claim 11 , wherein the scaling factor defines a plurality of quantisation levels, wherein the data processor is operable to round the scaled attribute value up to the nearest quantisation level.  
     
     
         14 . An apparatus according to  claim 11 , wherein the scaling factor defines a plurality of quantisation levels, and wherein the data processor is operable to round the scaled attribute value to the nearest quantisation level.  
     
     
         15 . An apparatus according to any of  claims 2  to  14 , wherein the said at least one attribute value comprises a category value corresponding to a classification of an attribute of a feature, wherein the process data comprises category adjustment data, and wherein the data processor is arranged to adjust the category value using the category adjustment data.  
     
     
         16 . An apparatus according to any preceding claim, wherein the monotonic mapping function has a corresponding inverse function.  
     
     
         17 . An apparatus according to any preceding claim, wherein the number generator is operable to generate a number representative of the received data, and to combine the generated number with one or more additional numbers to generate the intermediate key.  
     
     
         18 . An apparatus according to  claim 17 , wherein at least one of the one or more additional numbers is data from a digital source.  
     
     
         19 . An apparatus according to any preceding claim, wherein the key generator is operable to add the intermediate key and the stored mapping key to generate the cryptographic key.  
     
     
         20 . An apparatus according to any of  claims 1  to  18 , wherein the key generator is operable to subtract the intermediate key and the stored mapping key to generate the cryptographic key.  
     
     
         21 . An apparatus according to any of  claims 1  to  18 , wherein the key generator is operable to perform a bit-wise exclusive-OR function on the intermediate key and the stored mapping key to generate the cryptographic key.  
     
     
         22 . An apparatus according to any preceding claim, wherein the data store is a first data store, the cryptographic key is a first cryptographic key, and wherein the apparatus further comprises: 
 a second data store for storing a secure key and a public key, wherein the secure key comprises one of a second cryptographic key and a number required to generate the second cryptographic key, and wherein the public key is associated with the first cryptographic key by an asymmetric encryption algorithm;    an access controller operable to allow access to the secure key stored in the second data store only to an access request accompanied by a digital signature generated using the first cryptographic key; and    an access request signal generator operable to generate a digital signature using the first cryptographic key and to transmit an access request, including the generated digital signature, to the access controller in order to retrieve the secure key.    
     
     
         23 . An apparatus according to  claim 22 , wherein the key generator is a first key generator, wherein the monotonic mapping function is a first monotonic mapping function, wherein the secure key comprises a number required to generate the second cryptographic key, and wherein the apparatus further comprises a second key generator operable to combine the intermediate key and the secure key in accordance with a second mapping function to generate the second cryptographic key.  
     
     
         24 . An apparatus according to  claim 23 , wherein the first monotonic mapping function and the second monotonic mapping function are the same function.  
     
     
         25 . An apparatus according to any of  claims 22  to  24 , wherein the access request signal generator is arranged to include in the access request a third cryptographic key for symmetric encrypted communication between the key generator and the second data store.  
     
     
         26 . An apparatus according to any of  claims 22  to  25 , wherein the apparatus is formed multiple devices connected to a computer network.  
     
     
         27 . An apparatus according to any preceding claim, further comprising a decrypter operable decrypt an encrypted message using the generated cryptographic key.  
     
     
         28 . An apparatus according to any preceding claim, further comprising a digital signature generator operable to generate a digital signature using the generated cryptographic key.  
     
     
         29 . An apparatus for generating a mapping key associating an intermediate key representative of data from an analogue source with a cryptographic key in accordance with a monotonic mapping function, the apparatus comprising: 
 a receiver operable to receive data representative of an analogue source;    a number generator operable to process the received data to generate an intermediate key representative of the received data, said intermediate key being a number;    a cryptographic key generator operable to generate a cryptographic key;    a data processor operable to process the intermediate key and the cryptographic key in accordance with a monotonic mapping function to generate a mapping key.    
     
     
         30 . An apparatus according to  claim 29 , wherein said number generator is operable to generate the intermediate key from at least one attribute value of at least one feature within the data representative of the analogue source.  
     
     
         31 . An apparatus according to  claim 30 , wherein the number generator comprises a process data generator operable to generate process data, using a training process, for controlling the processing of the data representative of the analogue source.  
     
     
         32 . An apparatus according to  claim 31 , wherein the process data generator is operable to generate feature information indicative of at least one feature within the data representative of the analogue source.  
     
     
         33 . An apparatus according to  claim 32 , wherein the process data generator is operable to generate the feature information based on the repeatability of features in a plurality of training data sets.  
     
     
         34 . An apparatus according to any of  claims 31  to  33 , wherein the process data generator is operable to generate reference alignment data base on the distribution of features in one or more training data sets.  
     
     
         35 . An apparatus according to any of  claims 31  to  34 , wherein the process data generator is operable to generate segmentation data for segmenting the data representative of the analogue source.  
     
     
         36 . An apparatus according to any of  claims 31  to  35 , wherein the process data generator is operable to identify and store at least one basis function using one or more training data sets.  
     
     
         37 . An apparatus according to any of  claims 31  to  36 , wherein the process data generator is operable to generate value adjustment data for adjusting an attribute value using one or more training data sets.  
     
     
         38 . An apparatus according to  claim 37 , wherein the value adjustment data comprises offset data corresponding to the difference between a measured attribute value and one of a plurality of predetermined values.  
     
     
         39 . An apparatus according to  claim 37  or  38 , wherein the value adjustment data comprises a scaling factor.  
     
     
         40 . An apparatus according to  claim 39 , wherein the process data generator is operable to determine the scaling factor in accordance with the variation of the measured attribute value in a plurality of training data sets.  
     
     
         41 . An apparatus according to  claim 40 , wherein the process data generator is operable to set the scaling factor to correspond to a theoretical confidence interval.  
     
     
         42 . An apparatus according to  claim 40  or  41  when dependent on  claim 37 , wherein the plurality of predetermined values corresponds to points midway between neighbouring quantisation levels, wherein the distance between neighbouring quantisation levels corresponds to the scaling factor.  
     
     
         43 . An apparatus according to any of  claims 31  to  42 , wherein the said at least one attribute value comprises a category value corresponding to a classification of an attribute of a feature, wherein the process data generator is operable to generate category adjustment data using a plurality of training data sets.  
     
     
         44 . An apparatus according to any of  claims 31  to  43 , wherein the data processor is operable to add the intermediate key and the cryptographic key to generate the stored mapping key.  
     
     
         45 . An apparatus according to any of  claims 31  to  43 , wherein the data processor is operable to subtract the intermediate key and the cryptographic key to generate the mapping key.  
     
     
         46 . An apparatus according to any of  claims 31  to  43 , wherein the key generator is operable to perform a bit-wise exclusive-OR function on the intermediate key and the cryptographic key to generate the mapping key.  
     
     
         47 . An apparatus according to any proceeding claim, further comprising a generator operable to generate said data representative of an analogue source.  
     
     
         48 . An apparatus according to  claim 47 , wherein the generator comprises an image sensor operable to generate said data representative of an analogue source by generating image data corresponding to an image of the analogue source.  
     
     
         49 . An apparatus according to  claim 48 , wherein the image sensor is adapted to generate image data corresponding to an image of a fingerprint.  
     
     
         50 . An apparatus according to  claim 48 , wherein the image sensor is adapted to generate image data corresponding to an image of an iris.  
     
     
         51 . An apparatus according to  claim 48 , wherein the image sensor is adapted to generate image data corresponding to an image of a retina.  
     
     
         52 . An apparatus according to preceding claim, wherein the data representative of an analogue source is biometric data representative of a feature of a human being.  
     
     
         53 . An apparatus for generating a number from data representative of an analogue source, the apparatus comprising: 
 a data store operable to store process data, determined by a training process, for controlling the processing of the data representative of the analogue source;    a data processor operable to process the data representative of the analogue source, using the stored process data, to identify at least one attribute value of at least one feature within the data; and    a number generator operable to generate said number from the or each determined attribute value.    
     
     
         54 . An apparatus according to  claim 53 , wherein the process data comprises feature information indicative of at least one feature within the data representative of the analogue source, and wherein the data processor is arranged to identify said at least one feature using the feature information of the process data.  
     
     
         55 . An apparatus according to  claim 54 , wherein the data processor is operable to exclude the or each feature identified by the feature information.  
     
     
         56 . An apparatus according to any of  claims 53  to  55 , wherein the process data comprises reference alignment data, and wherein the data processor is operable to vary the data representative of the analogue source in accordance with the stored reference alignment data.  
     
     
         57 . An apparatus according to any of  claims 53  to  56 , wherein the process data comprises segmentation data, and wherein the data processor is operable to segment the data representative of the analogue source in accordance with the stored segmentation data.  
     
     
         58 . An apparatus according to any of  claims 53  to  57 , wherein the process data identifies at least one basis function, and wherein the data processing apparatus is arranged to determine an attribute value by determining a transform co-efficient from the data representative of the analogue source using the stored basis function.  
     
     
         59 . An apparatus according to any of  claims 53  to  58 , wherein the said at least one attribute value comprises a measurement value corresponding to a measurement of an attribute of a feature, wherein the process data comprises value adjustment data, and wherein the data processor is arranged to adjust the measurement value using the value adjustment data.  
     
     
         60 . An apparatus according to  claim 59 , wherein the value adjustment data comprises offset data, and wherein the data processor is arranged to adjust the value of at the measurement value using the offset vector.  
     
     
         61 . An apparatus according to  claim 59  or  60 , wherein the value adjustment data comprises a scaling factor, and wherein the data processor is arranged to scale the measurement value using the scaling factor to generate a scaled attribute value.  
     
     
         62 . An apparatus according to  claim 61 , wherein the data processor is operable to apply a predetermined strategy to reduce the resolution of the scaled attribute value.  
     
     
         63 . An apparatus according to  claim 62 , wherein the scaling factor defines a plurality of quantisation levels, and wherein the data processor is operable to truncate the scaled attribute value.  
     
     
         64 . An apparatus according to  claim 62 , wherein the scaling factor defines a plurality of quantisation levels, and wherein the processor is operable to round the scaled attribute value up to the nearest quantisation level.  
     
     
         65 . An apparatus according to  claim 62 , wherein the scaling factor defines a plurality of quantisation levels, and wherein the data processor is operable to round the scaled attribute value to the nearest quantisation level.  
     
     
         66 . An apparatus according to any of  claims 53  to  65 , wherein the said at least one attribute value comprises a category value corresponding to a classification of an attribute of a feature, wherein the process data comprises category adjustment data, and wherein the data processor is arranged to adjust the category value using the category adjustment data.  
     
     
         67 . A data processing apparatus comprising: 
 a receiver operable to receive one or more training data sets, each training data set representative of the analogue source;    a data processor operable to process the or each received training data set to identify at least one attribute of at least one feature; and    a process data generator operable to generate process data indicative of the identified at least one attribute.    
     
     
         68 . An apparatus according to  claim 67 , wherein the process data generator is operable to generate feature information indicative of at least one feature within the data representative of the analogue source.  
     
     
         69 . An apparatus according to  claim 68 , wherein the process data generator is operable to generate the feature information based on the repeatability of features in a plurality of training data sets.  
     
     
         70 . An apparatus according to any of  claims 67  to  69 , wherein the process data generator is operable to generate reference alignment data base on the distribution of features in one or more training data sets.  
     
     
         71 . An apparatus according to any of  claims 67  to  70 , wherein the process data generator is operable to generate segmentation data for segmenting the data representative of the analogue source.  
     
     
         72 . An apparatus according to any of  claims 67  to  71 , wherein the process data generator is operable to identify and store at least one basis function using one or more training data sets.  
     
     
         73 . An apparatus according to any of  claims 67  to  72 , wherein the process data generator is operable to generate value adjustment data for adjusting an attribute value using one or more training data sets.  
     
     
         74 . An apparatus according to  claim 73 , wherein the value adjustment data comprises offset data corresponding to the difference between a measured attribute value and one of a plurality of predetermined values.  
     
     
         75 . An apparatus according to  claim 73  or  74 , wherein the value adjustment data comprises a scaling factor.  
     
     
         76 . An apparatus according to  claim 75 , wherein the process data generator is operable to determine the scaling factor in accordance with the variation of the measured attribute value in a plurality of training data sets.  
     
     
         77 . An apparatus according to  claim 76 , wherein the process data generator is operable to set the scaling factor to correspond to a theoretical confidence interval.  
     
     
         78 . An apparatus according to  claim 74  or  75  when dependent on  claim 71 , wherein the plurality of predetermined values corresponds to points midway between neighbouring quantisation levels, wherein the distance between neighbouring quantisation levels corresponds to the scaling factor.  
     
     
         79 . An apparatus according to any of  claims 67  to  78 , wherein the said at least one attribute value comprises a category value corresponding to a classification of an attribute of a feature, wherein the process data generator is operable to generate category adjustment data using a plurality of training data sets.  
     
     
         80 . An apparatus for generating a number from data representative of an analogue source, the apparatus comprising: 
 means for processing the data to determine at least one attribute value of at least one feature within the data;    means for storing value adjustment data;    means for modifying the at least one attribute value using said stored value adjustment data; and    means for generating said number from the modified at least one attribute value.    
     
     
         81 . An apparatus for generating a number from data representative of an analogue source, the apparatus comprising: 
 means for storing process data indicative of at least one attribute of at least one feature within the data;    means for processing the data, using the stored process data, to identify the at least one attribute of the at least one feature within the data;    means for determining an attribute value for the or each identified attribute; and    means for generating said number from the or each determined attribute value.    
     
     
         82 . A system for generating a number from data representative of an analogue source, the system comprising a training apparatus and a number generating apparatus, 
 the training apparatus comprising: i) means for receiving a plurality of training data sets, each training data set representative of the analogue source; ii) means for processing the received training data sets to identify at least one attribute value of at least one feature; iii) means for generating process data indicative of the identified at least one attribute value of at least one feature,    and the number generating apparatus comprising: i) means for storing the process data generated by the training apparatus; ii) means for receiving data representative of the analogue source; iii) means for processing the data, using the stored process data, to identify the at least one attribute of the at least one feature within the data; iv) means for determining an attribute value for the or each identified attribute; and v) means for generating said number from the or each determined attribute value.    
     
     
         83 . A system for generating a cryptographic key using a received external key, the system comprising: 
 a first data store for storing an authorisation key;    a second data store for storing a secure key and a public key, wherein the secure key comprises one of the cryptographic key and a number required to generate the cryptographic key, and wherein the public key is associated with an associated private key by an asymmetric encryption algorithm;    an access controller operable to allow access to the secure key stored in the second data store only to an access request accompanied by a digital signature generated using the private key corresponding to the stored public key;    a key generator operable to generate the private key using the received external key and the stored authorisation key using a mapping function; and    an access request signal generator operable to generate a digital signature using the private key and to transmit an access request, including the generated digital signature, to the access controller in order to retrieve the secure key.    
     
     
         84 . A system according to  claim 83 , wherein the key generator is a first key generator, wherein the mapping function is a first mapping function, wherein the secure key comprises a number required to generate the cryptographic key, and wherein the apparatus further comprises a second key generator operable to combine the intermediate key and the secure key in accordance with a second mapping function to generate the second cryptographic key.  
     
     
         85 . A system according to  claim 83 , wherein the first mapping function and the second mapping function are the same function.  
     
     
         86 . A system according to any of  claims 83  to  85 , wherein the access controller is operable to log unsuccessful access requests and to deny all further access requests if the logged unsuccessful access requests satisfy a predetermined criterion.  
     
     
         87 . A system according to any of  claims 83  to  86 , wherein the access request signal generator is arranged to include in the access request a third cryptographic key for symmetric encrypted communication between the key generator and the second data store.  
     
     
         88 . A system according to any of  claims 83  to  87 , wherein the apparatus is formed multiple devices connected to a computer network.  
     
     
         89 . A system according to any of  claims 83  to  88 , further comprising a decrypter operable decrypt an encrypted message using the generated cryptographic key.  
     
     
         90 . A system according to any of  claims 83  to  89 , further comprising a digital signature generator operable to generate a digital signature using the generated cryptographic key.  
     
     
         91 . A system according to any of  claims 83  to  90 , further comprising a key generator operable to generate the external key from data representative of an analogue source.  
     
     
         92 . A system according to  claim 91 , wherein the data representative of the analogue source is biometric data representative of a feature of a human being.  
     
     
         93 . An apparatus for generating a cryptographic key, the apparatus comprising: 
 means for receiving data representative of an analogue source;    means for processing the received data to generate an intermediate key representative of the received data, said intermediate key being a number;    means for storing a mapping key, said mapping key being a number; and    means for combining the intermediate key and the mapping key in accordance with a monotonic mapping function to generate the cryptographic key.    
     
     
         94 . A method of generating a cryptographic key, the method comprising: 
 receiving data representative of an analogue source;    processing the received data to generate an intermediate key representative of the received data, said intermediate key being a number;    retrieving a stored mapping key, said mapping key being a number; and    combining the intermediate key and the mapping key in accordance with a monotonic mapping function to generate the cryptographic key.    
     
     
         95 . An apparatus for generating a mapping key associating an intermediate key representative of data from an analogue source with a cryptographic key in accordance with a monotonic mapping function, the apparatus comprising: 
 means for receiving data representative of an analogue source;    means for processing the received data to generate an intermediate key representative of the received data, said intermediate key being a number;    means for generating a cryptographic key;    means for combining the intermediate key and the cryptographic key in accordance with a monotonic mapping function to generate a mapping key.    
     
     
         96 . A method of generating a mapping key associating an intermediate key representative of data from an analogue source with a cryptographic key in accordance with a monotonic mapping function, the method comprising: 
 receiving data representative of an analogue source;    processing the received data to generate an intermediate key representative of the received data, said intermediate key being a number;    generating a cryptographic key;    combining the intermediate key and the cryptographic key in accordance with a monotonic mapping function to generate a mapping key.    
     
     
         97 . An apparatus for generating a number from data representative of an analogue source, the apparatus comprising: 
 means for storing process data, determined by a training routine, operable to control the processing of the data representative of the analogue source;    means for processing the data representative of the analogue source, using the stored process data, to identify at least one attribute value of at least one feature within the data; and    means for generating said number from the or each determined attribute value.    
     
     
         98 . A method of generating a number from data representative of an analogue source, the apparatus comprising: 
 storing process data, determined by a training routine, operable to control the processing of the data representative of the analogue source;    processing the data representative of the analogue source, using the stored process data, to identify at least one attribute value of at least one feature within the data; and    generating said number from the or each determined attribute value.    
     
     
         99 . A data processing apparatus comprising: 
 means for receiving one or more training data sets, each training data set representative of the analogue source;    means for processing the or each received training data set to identify at least one attribute of at least one feature; and    means for generating process data indicative of the identified at least one attribute.    
     
     
         100 . A data processing method comprising: 
 receiving one or more training data sets, each training data set representative of the analogue source;    processing the or each received training data set to identify at least one attribute of at least one feature; and    generating process data indicative of the identified at least one attribute.    
     
     
         101 . A storage device storing instructions for causing a programmable processing apparatus to become operable to perform a method as claimed in any of claims  94 ,  96 ,  98  and  100 .  
     
     
         102 . A signal conveying instructions including instructions for causing a programmable processing apparatus to become operable to perform a method as claimed in any of claims  94 ,  96 ,  98  and  100 .  
     
     
         103 . An apparatus for generating a private key corresponding to a known public key, the public key being associated with a user, the apparatus comprising: 
 a receiver operable to receive data representative of an analogue source associated with the user;    a number generator operable to process the received data to generate an intermediate key representative of the received data, said intermediate key being a number;    a data store for storing a mapping key, said mapping key being a number predetermined to combine with the intermediate key generated from data representative of said analogue source, in accordance with a monotonic mapping function, to generate the private key; and    a key generator operable to combine the intermediate key and the stored mapping key in accordance with the monotonic mapping function to generate the private key.    
     
     
         104 . A registration apparatus for generating a mapping key associating a private key, corresponding to a public key associated with a user, with an intermediate key representative of data from an analogue source, the analogue source being associated with the user, in accordance with a monotonic mapping function, the apparatus comprising: 
 a receiver operable to receive data representative of the analogue source;    a number generator operable to process the received data to generate the intermediate key representative of the received data, said intermediate key being a number; and    a data processor operable to process the intermediate key and the private key in accordance with the monotonic mapping function to generate the mapping key.