INTERNET VOTING WITH BIOMETRIC AUTHORIZATION BACKGROUND OF THE INVENTION Field of the Invention This invention relates to a system for casting and registering votes entered by eligible voters at geographically dispersed computer terminals linked by a publicly accessible network (e. g. the Internet), and more particularly to a secure system that protects against non-eligible votes while preserving the anonymity of the voter.

Low voter participation in national and local elections is in part due to the inconvenience in making a voter go to a local polling place on a prescribed day or alternatively obtaining and filing an absentee ballot. In the long term, to be an effective form of government, democracy requires participation by all or at least a very large percentage of the governed.

SUMMARY OF THE INVENTION An object of this invention is the provision of a system which allows an eligible voter to vote from a conveniently located computer terminal; for example the voter's own terminal located in his or her home or office, or a public terminal in a library, copy center, or hotel business center. In this unsupervised environment, the system must protect against voting fraud and protect the anonymity of the vote cast.

Briefly, this invention contemplates the provision of a voting system in which a biometric input from the voter is used to authorize an eligible voter to vote from a computer terminal over a publicly accessible network. The names and addresses of eligible voters are digitally stored in a computer data base. For each individual authorized to vote using a computer terminal the database also has a digital biometric identifier unique to each of these voters. Any one of a number of digitally encoded biometric identifiers may be used; for example: a digitally encoded finger print sample, a digitally encoded voice sample, or an encoded biometric signature sample. In order to vote, the voter enters his or her digital alpha/numeric identifier (e. g. name, and/or Social Security number, and/or voter identification number, or the like) and provides a biometric sample input. The identifier and the biometric sample are transmitted to the data base where the identifier is used as an address to access the stored biometric identifier for that voter. The stored biometric and the transmitted biometric are compared, and if they match the voter is authorized to vote.

In one embodiment of the invention, a ballot is electronically transmitted (e. g. e-mailed) to any requesting terminal or broadcast to potential voters in a voting district. The voter marks the ballot using typical graphical user interface commands. At this time, the voter also enters his or her alpha/numeric identifier (e. g. name and/or address) and his or her biometric identifier.

The ballot with the identifiers is transmitted (e. g. via the Internet) to the data base where the alpha/numeric identifier is used to address and fetch the corresponding biometric identifier, which is then compared with the transmitted biometric identifier.

If there is a match on the biometric identifier, the identifiers are stripped from the ballot, the vote is recorded, and the voter's file in the database is marked so that he or she cannot vote again in that election.

In an alternate embodiment of the invention, the voter transmits his or her alpha/numeric identifier and biometric identifier to the data base in order to receive a ballot. The validation procedure is as in the first embodiment where the alpha/numeric identifier is used to address and access the corresponding biometric identifier which then is compared with the transmitted biometric identifier. If there is a match on the biometric identifier, the ballot with a recordable electronic identifier is downloaded to the requesting computer address (e. g. e-mail address) along with code data that the ballot is a recordable ballot. Again, the voter marks the ballot, typically by means of graphical user interface commands, and when completed, initiates a transmit command that transmits the filled-in voting data with valid ballot identification code, but without voter identification. In response to a valid ballot'identification code, the system records the vote. The database at the voter's address can be marked at the time he or she receives an authorized ballot so that he or she cannot receive another authorized ballot in the election. Alternatively, in this embodiment, the voter's file in the database can be marked at the time the vote is registered so that he or she cannot vote again in that election. In this alternative, a voter's identification code is transmitted to the database contemporaneously with, but separate from, the recordable ballot. In each embodiment, the recorded ballots may be kept for any desired period of time to provide validation of the correctness of the ballot count.

In addition to casting political ballots from computer terminals linked by a public network, the invention is also applicable to union ratification votes, corporate stockholder votes, polling, and similar applications. It is understood that this voting system can be used for some eligible voters while existing or other voting systems can be used for the other eligible voters.

BRIEF DESCRIPTION OF THE DRAWINGS The foregoing and other objects, aspects and advantages will be better understood from the following detailed description of a preferred embodiment of the invention, in which: Figure 1 is a block diagram of one embodiment of a system in accordance with the teachings of this invention, in which embodiment an unsupervised voter must transmit a valid ID number and biometric code in order to obtain a recordable ballot.

Figure 2 is a block diagram of an embodiment in which an unsupervised voter must transmit a valid ID number and biometric code in order for his or her ballot to be counted.

Figure 3 is a block diagram of an embodiment similar to Figure 1 but in which a voter's biometric is encoded on a card and is entered into the terminal and compared with a biometric sample entered contemporaneously by the voter at the terminal in order to authorize the voter to vote.

Figure 4 is a block diagram in which a biometric identifier, digitally recorded on a card, is read and compared with a biometric identifier entered by the voter at the terminal in order to authorize the voter.

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT Referring now to Figure 1, the system includes a data base processor 10, which stores the names and addresses of registered voters and their political districts based on their addresses in order to establish a record of who is entitled vote and for whom they are entitled to vote. A political entity, for example a state in the United States, may maintain a central data base for all registered voters in that state with an identifier code for each voter identifying the voter's political district. For those voters who have qualified as a"pc voter", in this embodiment of the invention, the data base also includes a digital biometric characteristic identifier code. The term pc voter, as used here, refers to a voter who has made himself or herself eligible to vote from a pc terminal 12 that is not under the physical supervision of an election official. The pc terminal 12, for example, may be located in the voter's home or office, or at a pc terminal available to the public generally, such as at a library, copy center, or hotel business center. A publicly accessible network 14 (e. g. the Internet) connects the pc terminals 12 to the data base 10, to a data base of official ballot forms 16, and a vote recorder 18. In a preferred embodiment of the invention, conventional polling places 20, which are physically controlled by election officials, are also connected to the data base 10 so that a pc voter retains the option of voting at a polling place 20. If a voter votes at a conventional polling place 20, his or her name is flagged in the data base 10 so that he or she will not be able to again vote using a pc terminal in that election.

The voter enters his or her alpha/numeric identifier via the user interface 13 and a biometric characteristic sample via biometric transducer 17. The digitally encoded alpha/numeric identifier and the digitally encoded biometric identifier sample are transmitted to the data base processor 10. The transmitted alpha/numeric identifier is used to address the memory 10 and fetch the digitally encoded biometric identifier at that address. In addition, a code is fetched identifying the political district in which the voter is entitled to vote, assuming the data base covers more than a single political district. The voter's network pc address is transmitted from the terminal 12 along with the biometric identifier code and/or the alpha/numeric code.

A comparator 22 compares the biometric identifier stored at the voter's alpha/numeric address in database 10 with the transmitted biometric identifier and, if there is a match, the system authorizes the data base 16 to transmit a ballot to the terminal 12 at the transmitted pc address. The ballot includes a code (preferably encrypted) that identifies the ballot as an authorized ballot. The authorized ballot is transmitted to the network address of the voter's terminal (e. g. e-mail address), where the voter can call up the ballot on the terminal screen.

Using standard graphic user interface commands the voter fills out the ballot. When the voter has completed the ballot to his or her satisfaction, he or she initiates a command to transmit the digitally encoded vote along with the authorized ballot code over the network 14 to the vote recorder processor 18. This embodiment of the invention has a data base of sample ballots 24 which can be accessed from any terminal on the network 14 but which cannot be used to record a vote in recorder processor 18.

The database at the voter's address can be marked that he or she has already received an authorized ballot so that he or she cannot receive another authorized ballot in the election.

Alternatively, in. this embodiment, the voter's file in the database can be marked at the time the vote is registered so that he or she cannot vote again in that election. In this alternative, a voter's identification code is transmitted to the database contemporaneously with, but separate from, the recordable ballot.

In each embodiment, the recorded ballots may be kept for any desired period of time to provide validation of the correctness of the ballot count.

The biometric characteristic code can be based on any one of a number of suitable biometric characteristics that will uniquely identify an individual; for example, a finger print, a voice print, or a biometric signature. Preferably, the voter would present himself or herself to an authorized person where the biometric sample would be obtained, encoded, and entered into the system. The alpha/numeric identifier need not be secret and could be, for example, the person's name, or social security number, just so long as it can be used efficiently to directly address the data memory 10.

Referring now to Figure 2, this embodiment of the invention is similar to that shown in Figure 1. But here, a voter does not transmit his or her biometric identifier code in order to get a ballot from the ballot data base 16. In response to a request for a ballot (e. g. a request with the name and address of the voter), the data base 16 transmits a ballot to the network address of the requesting terminal 12. The voter fills in the ballot and transmits voting data, along with his or her alpha/numeric identifier and his or her biometric identifier code to the data base processor 10. The comparator 22 compares the biometric characteristic identifier stored at the alpha/numeric address with the transmitted biometric characteristic identifier. If they compare, the vote is recorded in process recorder 18 and the alpha/numeric and physical characteristic identifier are stripped and discarded from the vote data. The voter's file in the database is marked so that he or she cannot vote again in that election.

Referring now to Figure 3, in this embodiment of the invention the voter's biometric is digitally encoded on a card 25, which is read by a card reader 26. The voter enters his or her alpha/numerical identifier by means of the user interface 13 and the biometric read from the card and the voter's alpha/numeric are transmitted to the database 10 where the processor proceeds, here, as in the system shown in Figure 1. However, it will be appreciated that this card validation can be used just as well in combination with the embodiment of Figure 2.

A picture of the voter can be encoded on the card 25 as the biometric, using for example a multinational bar code. Also, the voter's biometric signature can be digitally encoded on the voter card 25. As will be appreciated by those skilled in the art, a biometric signature digitally encodes relative pressures and/or accelerations of the writer as he or she writes along with digital samples of the spatial excursions of the writing instrument. In order to verify the identity of the voter, he repeats his or her signature on a biometric transducer; here a pad and/or with a pen that measures and digitally encodes the same biometric parameters; e. g. relative pressure, relative acceleration, and spatial excursions. These are encoded and compared to the biometric signature read from the card in order to authorize the voter to vote.

In an embodiment of Figure 4, a voter's biometric identifier is recorded on card 25. In order to authorize the voter, the card 25 is read and the voter provides at transducer 17, a corresponding physical biometric sample. The biometric data read from the card 25 and the biometric data entered contemporaneously at transducer 17 are compared in processor 10. If there is a match and if the voter entered alpha/numeric is registered in database 10, the voter is authorized to vote using the unsupervised terminal 12, here with the system of Figure 1, but it will be appreciated that the system of Figure 2 could be used as well.

While the invention has been described in terms of a single preferred embodiment, those skilled in the art will recognize that the invention can be practiced with modification within the spirit and scope of the appended claims.