Field of the Invention

This invention relates to biometric security, more particularly electrocardiogram authentication. Background As more and more electronic devices are used around the world, the more secure they have to be. User authentication is a process that verifies that a person in front of the device has rights (is authorized) to use the device's resources. A standard approach to user authorization is password verification (and its derivatives, including two-factor authorization, one-use tokens, etc.). A good password should be long enough to provide general security from brute-force attacks and unique so if it is compromised (i.e. known to third parties) it cannot be used in other systems.

Unfortunately remembering a great number of long passwords can be hard for most people. Other ways of user authorization are required. Promising approaches are biometrics-based authentication, which involve novel ways of verifying a user's identity using his or her natural characteristics. Most wide-spread methods include using information from fingerprints, iris or voice, as these are regarded unique to each user. Bioimpedance is also proposed for biometrics-based authentication, as described in WO2001/20538, whereby different impedance measurements are made between different points on a user's hand or body at different frequencies. Heartbeat characteristics appear to be unique as well. Research effort is put into developing a system that can identify users using their heartbeat characteristics.

There are many ways to analyse one's heartbeat, but the most practical approach is analysing the patterns gathered by Electrocardiograph, which records a heart's electric potential changes in time. A longer recording of heartbeat activity is called an electrocardiogram or ECG and is recorded using one or more pairs of electrodes. Each pair measures the change of electrical potential between the points of contact of electrodes. That change is strongly correlated with heart and muscle activity of the subject as the heart beat activity of the human body is stimulated through electrical impulses. Fig. 1 shows an electrocardiogram signal depicting the electrical potential of a heart over time. The basic elements of a single heart beat are: (i) a P wave generated when the right and left atria of the heart are depolarized; a Q.RS complex reflecting the depolarization of the right and left ventricles; and a T wave corresponding to the ventricular repolarization. Existing methodologies attempt to characterize an individual by these different elements and their respective sizes, shapes and positions. WO 2008/107684 of Intellisense is an example of such an approach.

ECG Based Recognition Using Second Order Statistics by F. Agrafioti describes an autocorrelation based feature extraction approach illustrated in Fig. 2. The particular approach describes involves four stages: 1) preprocessing, in which noise and artefacts are removed, 2) optional template matching, in which a large-class number problem is transformed to a small-class number problem to reduce the possible number of classes and improve the efficiency of the system by pruning the search space, 3) feature extraction in which personalized signatures are created; and 4) classification, where every individual is identified. The feature extraction uses autocorrelation of ECG segments rather than fiducial detection. It is also described that the particular autocorrelation method has four stages: (i) windowing, in which the preprocessed ECG signal is subjected to segmentation into non overlapping windows; (ii) normalized autocorrelation computation for every window; (iii) dimensionality reduction with the Discrete Cosine Transform (DCT) or Linear Discriminant Analysis (LDA); and (iv) classification based on features obtained from the DCT or LDA. Template Matching with the correlation coefficient is performed on the autocorrelated ECG signals, before dimensionality reduction.

For a practical process, the system should be easy to use and be robust. In real life scenarios, the user cannot be expected to lie down and attach 12 electrodes to his or her body to provide a one- minute long ECG recording, just to authorize himself at an ATM (for example).

CN10546895 describes a method for identification by an electrocardiographic feature. The method comprises acquiring an original ECG signal of a user through an electrocardiographic sensor and determining a feature vector corresponding to the original ECG signal. The feature vector is said to comprise time domain characteristic data and frequency domain characteristic data of the original ECG signal, so that the identity of the user corresponding to the original ECG signal can be determined using a large distance nearest-neighbor algorithm. A wavelet transform is used from which the spectral features and time domain features are derived. Wavelets are generally calculated or represented in the form of co-efficients corresponding to a number of sub-bands of the input signal. CN10546895 does not describe any wavelet merit function, so the granularity of the feature extraction in time or frequency is unspecific. If the granularity is too coarse, valuable data is lost. If too fine, the feature vector is long and the burden on processing and memory is high. There is a need for an improved method of robust user authorization using short ECG samples from just two electrodes (placed on a subject's fingers or another relevant body part).

Summary of the Invention In accordance with the present invention, a method of performing electrocardiogram recognition is provided comprising: receiving input from a user; filtering the input; performing feature extraction on the input by autocorrelation to provide a first feature set; performing spectral analysis of the input to provide a second feature set in a frequency domain; combining the first and second feature sets to provide a combined feature vector; performing dimensionality reduction on the combined feature vector to give a reduced feature vector; performing classification of the reduced feature vector to give a recognition decision, and/or storing the reduced feature vector for future recognition.

By performing dimensionality reduction on the combined feature vector, the method is not unduly constrained to any particular feature set nor vector size in either the time domain or in the frequency domain, but is able to optimally extract useful distinguishing features in each domain while resulting in a feature vector of a manageable length.

Extracting useful spectral features from an ECG signal is a challenge. When viewed in the frequency domain, there can be significant variation from one beat to another for a given user. Yet there can be very useful features across several beats that can distinguish between the user and a wider population.

In accordance with an aspect of the invention, the spectral analysis may comprise selecting a representative PQ ST curve, or may comprise selecting a set of PQRST curves and time-shifting and superimposing these on one another to provide an average PQRST curve. Spectral analysis is performed on the selected PQRST curve or on the average PQRST curve. In accordance with another aspect of the invention, a method of model training is provided comprising: receiving a plurality of inputs; creating samples from the inputs; filtering and normalizing the samples; performing feature extraction on the samples; performing dimensionality reduction model training; reducing the length of a plurality of feature vectors; performing classifier training; transforming the feature vectors into a score; finding a threshold for the score; and combining and storing the model.

Brief Description of the Drawings

Fig. 1 is a diagram of an ECG sample.

Fig. 2 is a flow diagram of autocorrelation based feature extraction.

Fig. 3 is a circuit diagram of an embodiment of the invention, showing a user device, a terminal and a server. Fig. 4 is a flow diagram showing the operation of the devices of Fig. 3 in authentication mode starting with a digitally sampled input after hardware filtering.

Fig. 5 is a flow diagram showing the operation of the devices of Fig. 3 in enrolment mode. Fig. 6 is a flow diagram showing the operation of the devices of Fig. 3 in model training mode.

Glossary of terms

User, subject - a person using the system. Depending on the context it can be someone who is enrolled, owner of a model, trying to authorize or whose information was used during other user's enrolment process

ECG recording - a longer ECG recording (of about 20 seconds to one minute) of a single user, representing his or her heart activity.

ECG sample - a short part of an ECG recording. This part is extracted by cutting the ECG recording. In tests it is assumed that one ECG sample means one authorization attempt.

Verification/Authorization - process of checking if the user is authorized to use a device. It is performed using a short ECG sample, extracting its features and comparing it with an earlier prepared trained model. Enrolment - process of preparing a user's model using a longer ECG recording. The recording is cut into smaller ECG samples and those samples are used to generate a user's model.

ECG features - numeric values representing an ECG sample's features. Those features are calculated using various methods and one feature can be represented either as a single number (i.e. mean value of sample) or a set of values (i.e. sample's autocorrelation). Multiple features can be combined to create a feature vector.

Feature vector - ordered structure combining multiple features of one ECG sample.

User model - a mathematical representation of multiple users' feature vectors that allow comparison of a provided feature vector (extracted from an ECG sample) against the user's original feature vectors. This process is called a binary classification, as we try to distinguish whether the provided feature vector belongs to the user (positive classification) or not (negative classification). Depending on the variant of the classifying algorithm the representations can vary. From simple storing of all users' feature vectors, through storing all feature vectors in the database, to storing set of support vectors that separate a user's feature vector from the rest of the population.

Detailed Description

In high level terms, an ECG device can perform an authentication check in two ways: (i) by comparing ECG data acquired with an enrolment template stored on a server, or (ii) checking against a template stored in encrypted form on the end user device, for example a smart card. The following description applies to both scenarios.

Fig. 3 illustrates suitable hardware for capturing and processing a user's ECG sample for (a) enrolment and (b) authentication. Fig. 3 shows a user device 100 having: sensors 105, 106; a power supply 218; an amplifier 220; hardware filters 221; a memory module 224; a microprocessor 226 and an optional display 214. Fig. 3 also shows a terminal 200, a memory 230, a microprocessor 232 and an optional display 228. Fig. 3 also shows a server 300, with which the user device 100 and terminal 200 optionally communicate 236, 238 with via a radio, antenna, base station and network (not shown). The user device 100 and the terminal 200 also optionally communicate 234 with each other. The user device 100 has a power source 227 from the power supply 218 to the amplifier 220, memory 224 and microprocessor 226. The sensors 105, 106 are connected to the amplifier 220 and the filters 221. The amplifier 220, filters 221 and memory 224 are connected to the microprocessor 226. The sensors 105, 106 can be used to collect an electrocardiograph (ECG) signal and are positioned in a manner suitable for the user to put two thumbs or a finger from both hands on them simultaneously.

The filters 221 preferably comprise, in sequence, a high pass filter of about 0.5Hz cut-off and a low pass filter of about 180Hz cut-off, plus (optionally) a notch filter at 50Hz for filtering any noise from mains supply (60Hz for USA).

The processes of enrolment and authentication are now described. Authentication is described first, on the assumption that a user has already enrolled and the system has a sample of that user's feature vectors.

When a user wants to authorize in the system he/she must provide a short ECG sample. This sample is used at least once and a hard decision - accept or reject - is given.

Verification times can be 1, 2, 3, 5 or 10 seconds depending on the use case and signal quality. In this description we assume that this time is less than 2 seconds, this being the most likely time that will be used in an end product.

Because the window may be very short, a user can be allowed multiple such windows to authorize. If a user's sample is rejected he/she is given at least two more chances. From the user perspective, the verification time could be longer (anywhere from minimum 2 seconds, to any reasonable time).

The description below shows the lower level of the authorization process that analyses one ECG sample and gives an answer if that sample belongs to the user or an imposter.

When the user touches the electrodes, the hardware starts to record the signal. After it collects a 2- second sample 402, that has been subject to preprocessing (amplifying in amplifier 220 and filtering in filter 221), that sample 402 is put through and analogue-to-digital converter (222) at the input of the processor 226 and is sent along a processing pipeline that transforms it into a binary response: true if the sample 402 matches the user's model, or false if an imposter is trying to authenticate. The processing pipeline has a number of steps to perform the transformations. These are illustrated in Fig. 4. The authentication process may run using the memory and microprocessor of just the user device 100 or the terminal 200, or a combination of both when they are in communication 234 with each other. The user device 100 and terminal 200 may communicated 236, 238 with a server 300 the results of the authentication.

At a high level, the sample 402 is first normalized 404 and filtered 408 and is then transformed 418 into a template representing the sample features. Then, based on some prior known statistics, insignificant features are removed in a process called dimensionality reduction 422. Finally, the reduced feature vector is tested using a binary classifier (support vector machine) 424 that was prepared during the enrolment process and can analyse the user's feature vector to give an answer - acceptance or rejection. The support vector machine 424 receives the owner feature vector 428 and has the population feature vector 430 already stored within it.

The algorithm assumes that it receives an ECG sample to verify - i.e. to check if it belongs to the model's owner. If the received input 402 has no discernible ECG signal, an error is displayed on a display 214, 228 of the user device 100 or terminal 200. The user may be asked to try again by means of a message on a display 214, 228. The input signal 402 is first cut into samples. Each sample undergoes simple filtering steps to reduce noise and normalize the output. First, normalization 404 is performed, which means the signal is standardized (scaled) so that all values are between -1 and +1 and the mean is equal to zero. This processed is performed in two steps: first (eq. 1) the mean of the samples is calculated and all values are shifted by subtracting the mean, secondly (eq. 2) the resulting vector is divided by its maximum value.

For each signal xeW.n,x=(xi,X2, ...,Xn) we obtain its normalized version yeMn,y=(yi,y2, ...,yn) , (1) where:

yi=xi—mean(x)

yi=yi/max(y) (2)

The normalized signal is then processed by a Butterworth's bandpass filter 406 of order 4 in the 0.5Hz - 40Hz band. Depending on what features will be extracted, the range and/or shape of the filters may vary. Good results are also achieved if the band is extended from a 0.5Hz high pass software filter (e.g. a 4 ^th order Butterworth filter) to a 85Hz low-pass software filter - e.g. an MR Butterworth filter of 10 ^th order. This provides a flat baseline with a burst of noise at each heartbeat. Other filters achieving this purpose can be used.

Note that the software filter has a narrower band than the hardware filter 221. Both are used and each complements the other. The hardware filter limits the bandwidth and reduces the amount of processing required by the processor. The software filter filters out noise that may have bypassed the hardware filter through the groundplane or even through the user's own fingers, and it further limits the bandwidth to the frequencies of particular interest.

The output of this step is a normalized signal (i.e. values between -1 and 1, with sample's mean equal to 0). From this sample all features are calculated.

The next phase is feature extraction 418. In this phase the filtered and normalized samples are analysed and features are extracted 418. Two types of features are used- temporal 416 (based on time domain) and spectral 412 (based on statistical features of different sub-bands). Those features are calculated independently and later combined 420 to produce one output feature vector, i.e. an ordered list of numbers. By using two (or more) features we calculate one vector for each (one vector with AC features, and one vector with Spectral features 414). Then those vectors are concatenated 420 into one, longer feature vector. The algorithm does not have to know which of the values in the feature vector correlate to which feature, but the ordering should be consistent between the enrolment and authentication phases.

The output of this step is long string of numbers - a feature vector. For each ECG sample this vector should have the same length.

The calculations of the two vectors are now described in greater detail.

The first feature calculated is normalized autocorrelation 416. This is done by performing a cross correlation of the signal x with maximum time lag M set to a number from 0.1 - 0.4 seconds (eq. 3). I.e. the time lag is fixed at a set value within this range. The signal is normalized by dividing it with the cross correlation value for time lag equal to 0 (eq. 4). Because cross correlation is a symmetrical function, we discard the negative part and the first dimension of the positive part (result for time lag equal to 0). The autocorrelation descriptor of signal x is defined as (x)=y, where y is defined as:

r=xcorr(x,M) (3)

r= r/r ₀ (4) y=(r, :i>0) (5)

The spectral approach analyses different sub bands of the ECG sample. Because the spectral features are not time shift invariant, the input signal should first be normalized in time.

As the building blocks of each ECG recordings are heartbeats, the sample is processed to extract positions and lengths of the heartbeats. A Pan-Tompkins algorithm 412 is used for that purpose. The Pan-Tompkins algorithm 412 recognizes Q.RS components of each heartbeat based upon digital analysis of slope, amplitude and width of each pulse.

When all of the beats are found, spectral features 414 are extracted from them (e.g. peaks in the frequency domain are identified) and a feature vector is created. (A representative PQRST curve can be selected, e.g. from the centre of a set of beats found, or a set of PQ.RS curves can be time-shifted and superimposed on one another to provide an average PQ.RS curve.)

The cycle's signal is filtered multiple times in different sub bands (sub bands are extracted using a narrow Butterworth's filter 406). From each sub band we calculate: mean of power, standard deviation of power, maximum amplitude, amplitude's deviation, power's kurtosis, power's skewness. Additionally we append to the feature statistical features of the whole ECG cycle: maximum value, standard deviation, kurtosis and skewness. We analyse multiple sub bands in the frequency range of interest. E.g. the range of interest may be set at 0.5Hz to 40Hz or 85Hz and divided into k bands of about 5Hz - 8Hz. About 6 to 10 bands are preferred. The bands may be narrower in the range 8Hz - 35Hz than at the extremes of the frequency range of interest. By way of example, in the range 0.5Hz to 50Hz, the following bands are suitable:

0.5 - 8 Hz; 8 - 13 Hz; 13 - 18 Hz; 18 - 25 Hz; 25 - 30 Hz; 30 - 35 Hz; 35 - 50 Hz.

We denote the signal of filtered sub band k to be sk.

The feature vectors can be very long and they typically carry a lot of excess information. They are preferably subjected to a process of dimensionality reduction 422. There are many dimensionality reduction algorithms 422 and they can be classified into multiple groups. In general the dimensionality reduction algorithm knows how to find feature vectors in a collection of excessive data. The instructions on which parts of the vector to remove, which to transform, and which ones should be combined together is generated during the model training phase, as we have information through whole population. More on that process is described in the section on model preparation in relation to Fig. 6.

When we reduce the number of features, we are performing a projection (from higher dimensional space to lower one). This way we take a long feature vector, project it onto a smaller feature space, and get a shorter, more compressed feature vector. The only requirement of this step is that it has to produce vectors of constant length, similar to the feature extraction step.

The process of user authentication can be seen as a binary classification problem. We have two classes of samples (user's samples and other people's samples). The classifier 424 used in our approach relates to multiple ways of determining if a given feature vector resembles the owner's feature vectors. One of those ways is direct comparison of those vectors (using different vector metrics) or usage of statistical tools that separate the user's vectors from all the rest.

In the latter approach a mathematical model is generated and parameters defining the model are stored. The parameters describe what calculations should be performed to receive a binary answer - authorize the sample or reject the sample. Depending on the chosen approach and its implementation different classifier produce different outcomes.

The preferred model is a support vector machine (SVM) sometimes referred as a support vector network), which is a supervised learning model in which examples of a feature vector are classified into the category "match subject" or the category "mismatch" (i.e. "more similar to general population"). It is a non-probabilistic binary-linear classifier. The SVM model is a representation of input feature vectors as points in space, mapped so that the examples of the separate categories are divided by a clear gap that is as wide as possible. New examples are mapped into that same space and are identified as belonging to a category based on which side of the gap they fall on. The space can be multi-dimensional (having as many dimensions as the feature vectors). Feature vectors representing the two categories are stored and (preferably) the threshold, line or multi-dimensional surface defining their separation is also stored.

Unsupervised learning can be used to find natural clustering of feature vectors of many users into groups. When a population of users has been classified into a satisfactory number of groups (e.g. 4 to 20 clusters), these groups can be represented by representative feature vectors, and a newly input feature vector can be assigned to the subject (a match) or one of the groups (a mismatch). Such a clustering algorithm is called support vector clustering. In the embodiment, the feature vectors for each of the respective categories are stored.

Some models (like vector comparison) return the distance between the provided sample and the owner's feature vectors stored in the model. In that case additional number - a threshold - is calculated in that model. That threshold is the decision boundary that tells if the tested sample is "close enough" to the model saved sample. If the distance is smaller than the threshold this means the sample belongs to the owner.

Probabilistic classifiers, on the other hand, return a probability that given sample belongs to the model's owner. This number is a floating point value from 0 to 1. 1 means that it's certain that provided sample belongs to the owner, 0 means that there is no resemblance between the sample and the owner's model. Such classifier use thresholds as well, as it is hard to get a probability score of 1 each time the owner provides a sample. The threshold works the same way is in the similarity approach with the only change that scores above thresholds are accepted, and those below are rejected. In order to first store a model for an owner, the owner must first undergo an enrolment process. This is illustrated in Fig. 5. During this process, the user provides a sample 502 of ECG so the model can be built for the user and consequently various patterns can be found to distinguish him or her from rest of the population. Enrolment can be performed with the same device/hardware as authentication. During enrolment, a user is presented with instructions to provide an ECG recording which may be longer than the verification time (e.g. 20 or 30 seconds or up to 1 minute). A message is displayed on a display 214, 228 instructing the user to provide this recording. The message may simply instruct the user to place two fingers (or thumbs) of opposite hands on the sensors and hold them there while a graphical timer counts down. If necessary, the message may further specify other conditions (e.g. to control the environment to reduce noise and reduce variance between beats).

The device performs ECG recording over the enrolment period. If there are signal quality issues, the user may be instructed, by means of a message displayed on a display 214, 228, to repeat the process. The repeat message may instruct the user to make additional preparations (e.g. to first wipe the sensors with a clean dry cloth and/or to take three deep breaths).

An acquired ECG signal is processed (contemporaneously or at a later time) by the filtering 408, feature extraction 418 and dimensionality reduction 422 elements of Fig 3, but not the classification element 424. The result is a feature vector 510 for the newly enrolled user. This is stored for later use in the classification step of Fig. 4. Optionally, the feature vector may be put through a classifier model 504 (described below) that will identify an appropriate classifier threshold 508 for the particular feature vector.

To explain how an enrolment recording is transformed into a user's ECG representation, the process called model training will be described with reference to Fig. 6. The same model is used each time a user tries to authenticate or another user tries to enrol. The process of model training includes the filtering 408 and feature extraction 418 elements of Fig. 3 but it uses a larger dataset 502, 602, 604 and is correspondingly more complex. Whereas during authentication we only use information gathered in the model (and processing parameters) the process of calculating those is much more complex and requires ECG samples from different subjects, as is now described.

As described above, the system analyses each subject's heartbeat in samples 606. To create samples 606 (e.g. 2s long) from the enrolment recording it is necessary to cut it into smaller parts. Each recording (subject's and the background's) is cut ("blindly") into 2-second samples 606 and those samples 606 are used in the training process. The length of those samples 606 is dependent on the minimal verification time.

The output of this phase is a collection of pairs: (subject id, ECG sample), where the subject's id denotes who is the owner of the sample (it is later used in the dimensionality reduction 612 and classifier training 622 stages).

Features are extracted 418 using the same algorithm and parameters that will later be used in the authentication step. After this transformation the result is a collection of feature vectors. To distinguish the subject's ECG parameters from other users, recordings of other subjects 616 are also required. This data is used as background information, especially in the dimensionality reduction step. This is known as supervised learning. Because a feature vector obtained during the previous phase can be very long, we need to perform dimensionality reduction to reduce its length. Usually, gathered data has some regularities that can be easily found using some statistical reasoning. We could, for example, find out that in one particular dimension (e.g. some identified characteristic in time or frequency that has regularity across different subjects) one feature vector does not change across a whole population and therefore it does not carry any information. In this case the dimension is de-emphasised as it is of no use in the comparison between a user feature vector and population feature vectors. Another case is that one dimension can be expressed as interrelating with (or dependent on) other dimensions and therefore it also does not carry any more information than that encoded in other parts of the feature vector, so it can be de-emphasised. The de-emphasis of dimensions such as these enables the size of the feature vector to be reduced, without losing data vital for comparison.

This is the reason why other subjects' samples must be present during the training. They (together with the model owner's samples) statistically represent a sample population. From this data we can deduce the characteristics of the feature space.

There are two main approaches in dimensionality reduction. One "blindly" tries to compress the data to a smaller number of dimensions (e.g. Discrete Cosine Transform (DCT), or Principal Component Analysis (PCA)). Another takes into account that each point can belong to a different class/subject (e.g. Linear Discriminant Analysis (LDA), Partial Least Squares (PLS)). The first category is called unsupervised dimensionality reduction, the latter one is called supervised dimensionality reduction.

The unsupervised methods 608 try to find similarities in the data and minimize the variance in the final set of dimensions so the data can be compressed into a smaller number of dimensions, while supervised dimensionality reduction methods 610 reduce the dimensionality of the signal while trying to also increase a distance measure between the different classes in the new set of dimensions so the classes can be identified more easily. DCT or PCA may perform unsupervised dimensionality reduction. A DCT is a Fourier-related transform that uses only real numbers to expresses the dataset in terms of a sum of cosine functions of different frequencies. PCA uses orthogonal transformation to convert the dataset into a reduced set of principal components. Principal components account for as much of the variability in the data as possible, while reducing the number of dimensions. This method is also appropriate when the variables in the dataset are noisy. PCA concentrates the majority of the signal into the first few principal components, while the later principle components may be dominated by noise and so may be excluded without much loss of useful data.

LDA or PLS may perform supervised dimensionality reduction.

LDA is a method that attempts to model the difference between the classes of data. It finds a linear combination of features that characterizes or separates two or more classes of data. The resulting combination may be used for dimensionality reduction. A fundamental assumption of the LDA method is that the independent variables are normally distributed.

PLS is a statistical linear regression method which projects vectors to new spaces based on the dataset. The new space is chosen in a way that maximises covariance between extracted factors from the datasets.

Both approaches can be used in our system, often with the unsupervised methods taking place before the supervised methods are carried out. For example (as shown in Fig. 6) there can be a degree of unsupervised dimensionality reduction 608 followed by supervised dimensionality reduction 610. This has the advantage of reducing the complexity of the latter. The output is a recipe (usually a matrix) on how to reduce the length of a feature vector and (as a by-product) each input feature vector of the subject and each other user, transformed to the new (smaller) feature space.

Because the system is aimed at authorization of single users and because it is meant to be scalable and easily updateable, it focusses on a binary classification problem. What is needed is a reliable recipe to distinguish the user's feature vectors against feature vectors of others (population). By "reliable" is meant a yes/no classifier that has a low equal error rate (the rate at which the probability of a false positive is equal to the probability of a false negative.

Note that the error rates can be adjusted as required. For example, it may be preferable to have the probability of a false positive be lower than the probability of a false negative (if security against falsely authorising an unauthorised user is more important than customer satisfaction in being able to correctly identify an authorized user) or vice versa (e.g. for low value transactions such as a transport ticket or a turnstile). Multiple approaches can be used generally based on a supervised classifier. Depending on the selected method the training process runs differently, but a uniform factor is that the classifier training 622 algorithm receives a list of all feature vectors that are grouped into two classes - model owners ECG 614, population ECG 616. The output of this step is a classifier model - i.e. a recipe (classifier matrix 620) for the classification process on how to transform the feature vector into a score. The score is a measure of whether the given ECG is more like the heartbeat template of the user or heartbeat templates of a wider user population represented by one or several templates for the wider population. For example, a population may be represented between 8 and 50 (or preferably between 8 and 20) representative templates. After all features run through the whole pipeline we evaluate each model by presenting a set of new (unseen) ECG samples from various users. Each sample goes through the whole authentication process. For each sample we get an associated score (from the classifier), so we know who is the owner of the model, to whom the sample belongs in reality, and what was the classifier response. Using that information we find a threshold 618 for the score that will optimally separate any owner's samples from other subjects' samples. This threshold 618 is later stored together with the model and its use during the full authorization procedure.

All the components of the system: parameters for feature extraction, dimensionality reduction parameters and projection matrix, classifier's model and parameters and the threshold are combined together and saved. The entire model can be saved and can be later read and used in the authorization system.

Returning to the authorization process, the user puts his or her fingers on the electrodes and the system records a short (2 second) sample ECG sample. This sample is converted (via multiple stages of the process as described above in relation to Fig. 4) into a feature vector 428 - its representation. This representation is compared (as described in Fig. 4) with the data stored in the enrolment phase (Fig. 5) in accordance with the model (created in accordance with Fig. 6). The effect of the comparison is a score value, i.e. an indicator showing how closely the provided sample fits the user's ECG characteristics. If the subject's sample belongs to the owner of the model, the score is high. When an imposter tries to authorize, the score is much lower. If the score exceeds some threshold (e.g. established during the enrolment phase) the user is successfully authenticated and can use the system. Otherwise he or she is rejected and cannot access the system.

As an optional additional feature in authentication, multiple authentication attempts may be permitted and combined. In this process, a user provides multiple ECG samples and authorization is based on an aggregate results of each sample's verification result.

As an optional additional feature in enrolment, multiple enrolment attempts may be permitted and combined. In this process, a user provides multiple ECG signals (e.g. at different times and under different conditions of relative rest and exertion), and enrolment is based on an average result of the resulting feature vectors.

An advantage of performing dimensionality reduction (422) on the combined feature vector (after performing feature extraction (418) and spectral analysis (412, 414)) is that the dimensionality reduction (422) may choose the optimum number of dimensions from either domain. There may, for example, initially be a maximum of 500 features which may be reduced down to between 100 and 300 features (dimensions) - i.e. a dimensionality reduction of from 40% to 80%. The proportion of features from the time domain or frequency domain in the reduced feature vector is not pre-fixed, but will depend on the application and therefore on the restrictions imposed on the dimensionality reduction (422). In some applications, for example, time-to-authentication is important (leading to a shorter feature vector) and in others, robustness may be more important (leading to a longer feature vector). The relative proportion of features from each domain may indeed depend on the sample population of users against which a given user is to be compared.

The above description of a method and apparatus has been given by way of example only, and modifications thereof may be made within the scope of the invention as defined by the claims.