User authentication during a transaction

Abstract

To provide an apparatus, a method, a registration apparatus, a registration method, a server apparatus and a server method for user authentication.SOLUTION: An apparatus 30 comprises: image receiving circuitry configured to receive image data 40 on a user; processing circuitry to process the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; authentication circuitry configured to trigger a lookup in a database using the biometric data in order to identify account data associated with the user; and transaction circuitry responsive to identification of the account data, to perform one or more steps of a tax refund transaction and to update the account data to comprise transaction data indicative of the tax refund transaction.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to an apparatus, a method, a registration apparatus, a registration method, a server apparatus and a server method for user authentication. Summary of the Invention

[0002] Some transactions, for example those involving tax-free shopping processes, are carried out in multiple stages and require the use of information from earlier stages of the process to be provided at later stages of the process.

[0003] In accordance with some aspects of the present technique, an image receiving circuit configured to receive image data of a user; a processing circuit for processing the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; an authentication circuit configured to trigger a search in a database using the biometric data to identify account data associated with the user; a transaction circuit that, in response to identifying the account data, performs one or more steps of a tax refund transaction and updates the account data to include transaction data indicative of the tax refund transaction; An apparatus is provided comprising:

[0004] In accordance with some aspects of the present technique, receiving image data of a user; processing the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; using the biometric data to trigger a lookup in a database to identify account data associated with the user; performing one or more steps of the tax refund transaction and updating the account data to include transaction data indicative of the tax refund transaction; A method is provided, comprising:

[0005] In accordance with some aspects of the present technique, a receiving circuit configured to receive user image data; a processing circuit for processing the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; a control circuit configured to register a user account by storing account data at a location in the database identified using the biometric data, the control circuit updating the account data to include tax refund transaction data indicative of the tax refund transaction in response to an indicia of one or more steps of a tax refund transaction associated with the user; A registration device is provided, comprising:

[0006] In accordance with some aspects of the present technique, receiving image data of a user; processing the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; registering a user account by storing account data at a location in a database identified using the biometric data, the account data configured to store tax refund transaction data indicative of one or more steps of a tax refund transaction associated with the user; A registration method is provided, including:

[0007] In accordance with some aspects of the present technique, a storage circuit configured to store a database identifying a plurality of accounts associated with a plurality of users registered for the tax refund service; a control circuit that, in response to receiving a search request from the device, the search request including information indicative of one or more facial features of the user, triggers a search in a database based on the information to identify account data associated with the user; Equipped with A server device is provided in which control circuitry is responsive to an indication of one or more steps of a tax refund transaction associated with a user to update the account data to include tax refund transaction data indicative of the tax refund transaction.

[0008] In accordance with some aspects of the present technique, storing a database identifying a plurality of accounts associated with a plurality of users registered for the tax refund service; in response to receiving, from the device, a data search request including information indicative of one or more facial features of a user, triggering a search in a database based on the information to identify account data associated with the user; updating the account data to include tax refund transaction data indicative of the tax refund transaction in response to an indication of one or more steps of the tax refund transaction associated with the user; A method of operating a server is provided, including:

[0009] The techniques of the present invention will now be further described, by way of example only, with reference to the arrangements illustrated in the accompanying drawings, in which: [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 2 shows a schematic diagram of a series of interactions carried out in a tax-free shopping process. [Figure 2a] 1A and 1B are schematic diagrams illustrating a system including a device, a registration device, and a server device, in accordance with various configurations of the present technique; [Figure 2b] 1A and 1B are diagrams illustrating schematically interactions between devices according to some configurations of the present technique; [Figure 2c] 1A and 1B are diagrams illustrating schematically interactions between devices according to some configurations of the present technique; [Figure 2d] 1A and 1B are diagrams illustrating schematically interactions between devices according to some configurations of the present technique; [Figure 3] 1A-1C are diagrams illustrating schematic details of apparatus according to various configurations of the present technique; [Figure 4] 1A-1C are diagrams illustrating details of a registration device, in accordance with various configurations of the present technique; [Figure 5a] 1A-1C are diagrams illustrating schematic arrangements of image receiving circuitry in accordance with various configurations of the present technique; [Figure 5b] 1A-1C are diagrams illustrating schematic arrangements of image receiving circuitry in accordance with various configurations of the present technique; [Figure 6] 3A-3C are diagrams illustrating schematic details of processing circuitry in accordance with various configurations of the present technique; [Figure 7a] 1A and 1B illustrate schematically the use of a registration device in accordance with some configurations of the present technique. [Figure 7b] 1A and 1B illustrate schematically the use of a registration device in accordance with some configurations of the present technique. [Figure 8] 1A-1C are diagrams illustrating the use of an apparatus in accordance with some configurations of the present technique; [Figure 9] 1A-1C are diagrams illustrating the use of an apparatus in accordance with some configurations of the present technique; [Figure 10] 1A-1C are diagrams illustrating the use of an apparatus in accordance with some configurations of the present technique; DETAILED DESCRIPTION OF THE INVENTION

[0011] At least some configurations provide an apparatus including an image receiving circuit configured to receive image data of a user and a processing circuit configured to process the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features included in the image data. The apparatus also provides an authentication circuit configured to trigger a search in a database using the biometric data to identify account data associated with the user, and a transaction circuit configured to perform one or more steps of a tax refund transaction in response to identifying the account data and update the account data to include transaction data indicative of the tax refund transaction.

[0012] Many countries offer users, usually foreign visitors, the opportunity to purchase some goods tax-free, provided the goods are exported. To benefit from such a system and claim a tax refund for the purchase, the user may need to prove that the purchased goods are being exported. The requirement to prove that the purchased goods are being exported places a burden on the user to maintain proof of purchase information for each purchased item (potentially from multiple stores) and to present this information at a customs desk or self-service kiosk at the country's (region's) exit point. To alleviate this burden, in these examples, transaction data is stored in an account associated with the user. The account data may be stored on one or more host system servers in a centralized location. During one or more steps of the tax refund transaction, the user verifies their identity using facial recognition. The facial recognition is based on the user's image data (which may include video data) and is processed to generate biometric data that forms the basis for a lookup in a database. The user's account can then be accessed and updated to store transaction details (e.g., purchases made by the user or verification processes performed by the user). This system has several advantages. First, users do not need to carry specific identification, such as a passport, visitor card, or token, to associate tax-free transactions with their account. Second, it improves security: facial recognition software is difficult to fool, and its use significantly reduces the chance that one person's account data can be used by another person (for example, to fraudulently claim tax back on another person's purchases).

[0013] In some configurations, the account data includes identification data, and the authentication circuit is configured to determine the user's eligibility for the tax refund process based on the identification data, where the identification data includes information identifying the user and the user's country of residence, and the eligibility determination is performed based on the location of the merchant and the country of residence. A user may associate the identification information with their account, for example, during registration. The identification information can then be provided to a merchant, a customs operator, or a self-service kiosk to indicate whether a particular user is eligible for the tax refund process. The eligibility determination may include determining that the user's country of residence is different from the country in which the merchant is located (where the sale is made). In some configurations, the identification data may also include the user's flight details, identifying arrival and departure dates into and from the country. As a result, the user does not need to carry proof of eligibility for tax-free shopping.

[0014] In some configurations, the image receiving circuitry comprises a camera configured to acquire image data. The camera may be integrated into the point of sale system, customs system, or kiosk. Alternatively, a separate camera connected (wirelessly or using a cable) to the point of sale system, customs system, or kiosk may be provided.

[0015] In some configurations, the apparatus includes a communications circuit configured to send a request for image data to a user mobile device, and the image receiving circuit is configured to receive image data sent from the user mobile device in response to the request. Thus, the apparatus does not necessarily need to be equipped with a camera, but can instead utilize the user's mobile device (e.g., a mobile phone or tablet). The request for image data may be received using an existing application on the user's mobile device, or a dedicated application may be provided for communication with the apparatus. The apparatus may also be configured to send a request in the form of an email requesting the user to submit image data. These options increase the flexibility of the system.

[0016] In some configurations, one or more steps of the tax refund transaction include one or more steps related to a purchase of a product by a user, and the transaction data includes information identifying the purchase of the product. The information identifying the purchase of the product may include a price of the product and / or a tax classification of the product indicating whether the product is of a type that can be purchased tax-free. The step related to the purchase may include the purchase itself and / or may be related to one or more subsequent steps for registering the sale as a tax-free sale.

[0017] In some configurations, one or more steps of the tax refund process include a validation process performed at a customs station, where the validation process includes retrieving one or more items of stored transaction data each identifying one or more purchases made by a user to determine whether each of the one or more purchases is eligible for a tax refund, and issuing a tax refund in response to a determination that each of the one or more purchases is eligible for a tax refund, where the account data includes payment information associated with the user, and issuing the tax refund includes refunding the refund amount to a financial account associated with the payment information. The customs station (validation station) may be a human-operated customs station or a self-service kiosk. For example, the customs station may be provided with one or more rules defining a "green channel" situation that provides automatic approval for low-value items and / or purchases by travelers from certain countries, and a "red channel" situation that requires the user to present the purchased items to a customs official for approval, e.g., for high-value purchases. Customs stations may be provided at airports, ferry ports, or any other points of entry or exit. The issuance of the refund (e.g., payment of the refund to the user) may be performed at the next opportunity once a decision has been made, or may be performed after a short delay, for example to allow one or more further checks to be performed.

[0018] In some configurations, the biometric data includes an index derived using an index function, where the index function is selected to minimize variation in the index due to changes in orientation and environment of one or more facial features and to maximize variation in the index due to differences between respective facial features of different users. The index function may receive as input a pre-processed image obtained by performing alignment, cropping, and / or color balancing operations on the image data. The index function is designed so that the index generated for a user (a unique string identifying the user) is sufficiently close to the index stored in association with the user's account, regardless of the user's environment (e.g., lighting conditions and / or interference from external sources such as rain that distort the image data), whether the user's face is partially obscured (e.g., the user is wearing glasses), or the user's hairstyle. In some configurations, the index function may be provided by one or more off-the-shelf facial recognition algorithms that use still image data and / or video data of the user.

[0019] In some configurations, the index function includes performing measurements related to one or more facial features, quantizing at least one of the measurements into a plurality of bins, and encoding information in the index that identifies one of the plurality of bins that is closest to the at least one measurement. Typically, measurements of the same user's facial features vary very slightly based on, for example, image resolution, imperfections in the camera optics, and variations in the user's facial expression. By quantizing the measurements, i.e., providing a coarse-grained approximation of the measurements, the index function can ignore such small variations. In some configurations, one or more filtering operations may be applied to the image data before the measurements are performed and / or one or more filtering operations may be applied after the measurements. The level of quantization applied to each measurement need not be the same. Some measurements of a user's face may be more sensitive to noise and environmental factors than other measurements. Measurements known to be noise-insensitive may only need to be quantized at a fine scale, while measurements known to be noise-sensitive may need to be quantized at a coarser scale. Quantization may be applied to each measurement, with each measurement being individually quantized into its own set of bins. Alternatively, or in addition, one or more measurements may be quantized interdependently. For example, a ratio or sum of two or more different measurements may be quantized in addition to at least one of the individual measurements. In some configurations, one or the measurements may be quantized using multivariate statistics.

[0020] In some configurations, the index function includes quantizing each of the measurements into a corresponding number of bins and encoding information in the index that identifies the corresponding bin that is closest to each of the measurements. In some configurations, the bins are bins of the same size, but this is not necessary. Rather, in some configurations, one or more bins of different sizes may be provided for a single measurement. In some configurations, the index function may encode a confidence factor that indicates how close the measurement is to the edge of the bin (quantization region).

[0021] In some configurations, the index function includes encoding information in the index that at least identifies the bin that is second-closest to at least one measurement. The purpose of quantization is to reduce the sensitivity of measurements to variations in image data. However, when a measurement is close to a quantization boundary, quantization can result in inaccuracies (e.g., rounding errors). In these configurations, the index function is sensitive to such inaccuracies and identifies the second-closest bin to the measurement. The index function may identify the bin with a center point closest to the measurement as the closest bin. The second-closest bin may be identified, for example, as the bin with a center point second-closest to the measurement. Alternatively, the second-closest bin may be a bin other than the closest bin that has an edge (maximum or minimum value contained within that bin) closest to the measurement. In some configurations, the multiple bins may comprise overlapping bins. Such an approach may reduce ambiguity in measurements close to quantization boundaries.

[0022] In some configurations, the index function includes encoding the information using a hash function, which may be a non-reversible hash function configured to compress the information generated from one or more measurements.

[0023] In some configurations, the measurements include one or more of the separation distance between two of the one or more facial features, the depth of one of the one or more facial features, the position or shape of one or more facial contours, and a plurality of similarity scores, each indicating a similarity between the one or more facial features and a plurality of predefined eigenfaces. The distance between the one or more facial features may include the separation between any combination of eyes, ears, nose, chin, and forehead. Additional facial features may include the size or shape of the face and / or one or more facial features. The measurements may also include any number of relative measurements or ratios related to these features. The term eigenface is derived from the term eigenvector, which is used to refer to a set of basis vectors in a vector space, a combination of which can be used to generate any vector in that vector space. Similarly, the term eigenface is used to refer to a library of facial images that is itself representative of a much larger set of possible faces. Eigenfaces define a space of possible faces, and any face in the space of possible faces is identifiable as a linear combination of eigenfaces. Of course, there may be technical difficulties associated with providing a complete library of eigenfaces that covers the space of all possible human faces. However, the goal of such methods is not to accurately reproduce each human face, but to find a unique approximation for each human face. By providing a library of a sufficient number of different eigenfaces, any human face can be mapped to the closest face belonging to the space of faces spanned by the eigenfaces. The eigenfaces may include image data generated from individual human faces, computer-generated faces, composite images generated from any combination of different human or computer-generated faces, processed / filtered faces, and / or idealizations of facial features. The decomposition into similarity scores may be generated through a statistical / mathematical decomposition of one or more facial features to map the facial feature to a weighted sum of multiple eigenfaces. For example, an image of a given face may be decomposed using principal component analysis to identify a weighted combination of eigenfaces (weighted by similarity scores), which, when summed using those weights (similarity scores), provide an accurate representation of the given face.In some configurations, the decomposition may be based on an initial coarse discretization of the image data.

[0024] In some configurations, the authentication circuitry, in response to an indication that the search process is unable to identify a unique account, requests further identifying information and triggers a further search based on the further identifying information to identify account data. While facial recognition algorithms provide an accurate method of identifying a user, they may not always be able to provide such data. For example, situations may arise where facial recognition cannot be used to verify a user's identity (e.g., particularly poor lighting, wearing a face mask, and / or a significant change in the user's appearance). In such situations, the initial search in the database may fail, triggering a further search for the user's account data in the database using further identifying information, which may be a passport number, payment card information, a unique token, a visitor card, and / or user identification data such as name, address, date of birth, and / or a user-defined PIN number.

[0025] In some configurations, the authentication circuit triggers further identity verification in response to the server's identification of the account data. The further identity verification may require further information from the user, such as, for example, verification of the user's name, address, zip code, date of birth, etc. The further identity verification need not be performed for every step of the tax refund process and may only be required, for example, upon purchase of items over a predefined amount, upon the user's first purchase upon entry into a particular country (region), if the facial recognition circuitry is unreliable and / or random. The inclusion of the further identity verification further increases the level of security of the tax refund process.

[0026] In some configurations, the user is a customer, and further identity verification involves receiving a photograph from the server and asking the merchant operating the device to verify that the photograph matches the customer. The photograph may be uploaded by the user during a registration process, for example, and stored as part of the account data. This further identity verification provides additional security without requiring the user to remember or carry additional information, and can be performed by the merchant even in situations where the merchant and customer do not speak a common language.

[0027] In some configurations, the account data includes password information indicating the user's password, and further identity verification includes requesting the password from the user and transmitting the requested password to the server. The user may be required to enter the password directly into the device. Alternatively, the user may receive a notification (e.g., by email or via a dedicated application) on their mobile device prompting them to visit a website and enter their password. As yet another alternative, the user may be required to scan a code (e.g., a barcode or QR code) using their mobile device to navigate to the website to enter their password.

[0028] In some configurations, the image data includes a video stream encoding a continuous series of images. For example, the video stream may include a short section of video recorded by a user that is used as input to a facial recognition algorithm. In some configurations, the video stream is a live video stream. In such configurations, one or more facial recognition algorithms may be applied to live video data that may be captured using, for example, a user-facing camera on a user's mobile device or a dedicated camera provided as part of a point of sale and / or customs station. Using a live video stream provides an additional level of security by verifying that a user is actually present for a transaction and eliminating the possibility that pre-recorded images or video may be provided.

[0029] According to some configurations, a registration device is provided that includes a receiving circuit configured to receive image data of a user; a processing circuit configured to process the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features included in the image data; and a control circuit configured to register a user account by storing the account data at a location in a database identified using the biometric data, the control circuit updating the account data to include tax refund transaction data indicative of the tax refund transaction in response to an indication of one or more steps of a tax refund transaction associated with the user. The registration device may be provided as a dedicated device at a point of entry or exit (e.g., an airport or ferry port). Alternatively, the registration device may be provided on a user's mobile device, e.g., a mobile phone, or as part of a system operated by a merchant that allows users to register at the merchant. The registration device may generate and / or update the account data by transmitting information to a central server configured to process the registration and update of the account data in response to transactions.

[0030] In some configurations, the receiving circuitry is configured to receive identification data of the user, and the registration circuitry is configured to include the identification data in the account. The identification data may include a passport image, the user's country of residence, the user's address, the user's date of birth, the user's name, and / or the user's bank account details. The identification data may also include a password or PIN number to further enhance security in transactions performed by the user.

[0031] In some configurations, the control circuitry is configured to perform a search in a database using the biometric data before registering a user account, and in response to determining that the biometric data conflicts with existing account data, modify the existing account data to include a conflict indication and include a conflict indication in the account data. An ideal facial recognition algorithm would require each person to generate different biometric data. However, off-the-shelf facial recognition algorithms may not perform ideally, and there is a small chance that two or more users may be sufficiently similar in terms of facial features that a conflict occurs between users in the database. A more likely scenario is that the same user attempts to register twice, potentially resulting in a conflicting account. These configurations may address the possibility of a conflicting account occurring during the registration phase by determining whether such a conflict exists and marking both the new user's account and the conflicting existing account in the context of the configuration as conflicting accounts. The manner in which the registration circuitry handles a conflict may vary depending on the nature of the conflict. If a conflict arises because the same user has registered twice, it can be determined that the same user has registered twice using identifying data stored in the accounts, i.e., by determining whether the conflicting accounts are associated with users with the same username, address, date of birth, etc. In such a situation, one of the conflicting accounts can be deleted to resolve the conflict. If a conflict arises because two different users are competing, a conflict marker can be maintained on the conflicting account and may trigger further identifying data to be presented by the two different users when attempting to execute a transaction.

[0032] In some configurations, a server device is provided that includes a storage circuit configured to store a database identifying multiple accounts associated with multiple users registered for the tax refund service, and a control circuit configured to, in response to receiving a search request from a device including information indicative of one or more facial features of the user, trigger a search in the database based on the information to identify account data associated with the user. In response to an indication of one or more steps of a tax refund transaction associated with the user, the control circuit updates the account data to include tax refund transaction data indicative of the tax refund transaction. The server device manages the database identifying the account data for each of the multiple users. The database may be stored on a single computer or may be distributed across multiple physical computers at one or more locations. The server responds to requests from devices (at points of sale, customs stations, and / or self-service kiosks) to update the account data in the database. The server also responds to requests from registration devices to generate new account data indicating that the user is registering an account. In some configurations, the server may respond to a hit in the database by returning data, but it is not required to respond to a hit in the database by returning data, and in some configurations, the search may only require the server to determine the records to be modified based on information contained in or identified by the search request. In such configurations, the account data may be updated at the server without being returned to the device on which the search request was received.

[0033] Generally, the server is not required to provide data in response to a search that may only require updating account data (although an acknowledgment signal may be provided). In some configurations, the control circuitry, in response to failing to identify a unique account in the search, sends a request for further identifying information to the device, and in response to a further search request from the device that includes the further identifying information, the control circuitry triggers a further search using the further identifying information to identify the account data. The further identifying information may be a passport number, payment card information, a unique token, a visitor card, and / or user identification data such as name, address, date of birth, and / or a user-defined PIN number, etc. The further search provides an alternative means for accessing the user's account data if the first search fails.

[0034] In some configurations, the information includes biometric data generated from image data of the user using one or more facial recognition algorithms, and the search is performed using the biometric data. In some configurations, the information includes image data of the user, and a server device includes processing circuitry that processes the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data, and the search is performed using the biometric data. Although the search is performed using the biometric data generated from the image data, the image data may be processed on the server or on a device separate from the server. Performing processing on a server reduces the processing requirements on individual devices and reduces the implementation costs of devices provided at the point of sale and / or customs station. Performing processing at individual point of sale and / or customs station reduces server load and reduces wait times during busy periods. In some configurations, the server may receive the biometric data and the image data, and in the latter case, perform the image processing itself. This approach allows for less complex devices to be provided at the point of sale / customs station, if desired, while also reducing wait times when more complex point of sale / customs devices are provided.

[0035] In some configurations, the control circuitry, in response to a search identifying multiple accounts, triggers generation of additional biometric data from the image data using one or more additional facial recognition algorithms different from the one or more facial recognition algorithms, where the one or more additional facial recognition algorithms include at least one facial recognition algorithm having higher accuracy than the one or more facial recognition algorithms. The server may implement multiple different facial recognition algorithms, for example, trading off speed for accuracy. In a first example, the server may be configured to use a fast algorithm for facial recognition that has lower accuracy than other, slower algorithms. In most cases, the fast algorithm is sufficient to uniquely identify the account. If the fast algorithm fails, the server may switch to a more accurate algorithm to uniquely determine the user's account data. This tradeoff reduces latency and provides clearer distinction between user accounts in most cases.

[0036] Particular configurations of the present invention are described below with reference to the accompanying drawings.

[0037] FIG. 1 illustrates an approach for obtaining a tax refund associated with a purchase. The approach illustrated in FIG. 1 involves a user (traveler) 1 receiving a traditional store receipt from a merchant 3 at the time of purchase. The store receipt and the merchandise are then presented to Customs 5. Customs 5 then determines eligibility and validates the store receipt. A tax authority 7 then approves the validated receipt, processes the tax refund, and provides payment to User 1. Payment to User 1 may be in any suitable form, such as, for example, loading the tax refund amount onto a payment card, providing cash to User 1, or depositing funds into User 1's account. For example, User 1 may desire payment made directly to a bank account. User 1 provides the bank account to Tax Authority 7 so that the payment can be processed and completed.

[0038] Overall, the process of requesting and obtaining a tax refund involves four steps: 1. User 1 purchases a product. 2. Submit relevant information to Customs5. 3. Determine User 1's eligibility for reimbursement. 4. Refund the tax paid by User 1.

[0039] The above systems require the collection and storage of large amounts of information (e.g., documents or data), which requires the user to either keep track of the information themselves at the time of purchase (e.g., by keeping receipts) or carry identifying information (e.g., a passport or some other token linked to the account) to associate the receipt information with their account. In either case, the user must maintain at least some physical information, which places an administrative burden on the user.

[0040] Furthermore, any receipt can be presented for a refund, creating the temptation for collusion between merchants and users. Outside of the store, "receipt buying" can occur, where domestic customers sell their receipts to users (either by directly selling physical receipts or by offering purchases using the user's token so that the purchase is recorded in the user's account). While there's a small chance that User 1 will be asked to present the goods for inspection, there's a chance that User 1 will be charged for every receipt they can collect. Therefore, issuing receipt refunds when goods haven't been exported or aren't intended for export increases the risk of fraud.

[0041] The inventors have realized that identifying users through facial recognition can reduce the likelihood of fraud. Facial recognition can be integrated into the system at one or more stages of the TFS process, and the user performing that stage of the process (e.g., making a purchase and storing details of that purchase in their account) must be the user with whom the account is associated. In addition to reducing the likelihood of fraud, the present invention also eliminates the need for users to carry identification information (e.g., a passport or token). As a result, the convenience of the TFS process is improved.

[0042] FIG. 2a shows a high-level overview of a system according to some embodiments of the present invention. The diagram shows a merchant device 23, a server device 24, a database 25, a verification device (customs device) 26, and a user registration device 27, connected via a network 22. In this system, a user 1 can register their details using the registration device 27, including providing image data depicting the user's face. Upon registration, the registration device 27 triggers the creation of a user account that stores account data associated with the user 1. The account data is stored in a location in the database 25 identified by biometric data generated from the image data using one or more facial recognition algorithms. When the user 1 purchases goods from a merchant 3 for which the tax refund is intended to be applied, the purchase is made and data related to the purchase is recorded in the user 1's account, which was identified using the facial recognition algorithm. The merchant device 23 at the merchant location uses image data (photograph or video) of the user 1 to identify the user. Biometric data identifying one or more facial features of the user is generated from the image data and transmitted to the server device 24 along with payment amount information indicating the price of the goods purchased. The server device 24 receives all this information and uses the biometric data to find account data with the same biometrics in the database 25. In practice, it is unlikely that there will be an exact match between the search data and the biometric data stored in the database 25, so some mitigation techniques are described below. Finally, the user can utilize the verification device 26 to send a request (including the user's biometric data) to the server 24, which, once the user's account data is registered, responds by providing data related to purchases made by the user so that a customs verification process can be carried out and, if successful, a tax refund can be issued.

[0043] The details registered by user 1 include identification information and (optionally) payment information. For example, the identification information may include user 1's name, address, passport number, date of birth, country of residence, contact details (e.g., telephone number, email address, etc.), or a combination thereof. The payment information may include, for example, one or more of a credit or debit card number, or bank account details (e.g., account number and branch code). In systems that include payment information, the exact payment information provided may be system dependent, but is sufficient for payment to be made. In some examples, merchant interface 23 also transmits purchase information to the server indicating, for example, the type of goods purchased, any taxes levied on the goods, or information identifying merchant 3 or the taxing jurisdiction / location of merchant 3.

[0044] Figures 2b-2d show a schematic illustration of a series of exemplary interactions between the devices shown in Figure 2a. The interactions shown illustrate some typical tax-free shopping flows.

[0045] FIG. 2b schematically illustrates the interactions between the registration device 27, the server device 24, and the database 25 during a registration process performed by a user who wishes to utilize the tax-free shopping process. In the illustrated configuration, it is assumed that the database does not contain existing biometric data that overlaps (i.e., is identical to) that provided by the user. The user provides image data 270 and account data 272 to the registration device 27. The image data 270 is an image of the user's face, and the account data 272 may include the user's name, address, country of residence, etc. From the image data, the registration device 27 generates biometric data indicative of one or more facial features of the user and transmits the biometric data and account data to the server device 24 in step 260. The server device 24 performs an initial search in the database using the biometric data to determine whether a user with biometric data indicative of one or more facial features of the user is already enrolled. In step 264, the database transmits an indication that biometric data corresponding to the biometric data provided by the registration device 27 does not exist in the database (i.e., the user is not yet enrolled and no other account containing the same biometric data exists). In step 266, the server triggers the creation of a new entry in a database that stores the account data 272 in an indexed location using the biometric data. In step 268, the server device sends an acknowledgement to the enrollment device indicating that the account was successfully created.

[0046] FIG. 2c schematically illustrates the interaction between the merchant device 23, the server device 24, and the database 25 during a purchase transaction performed by a customer (user) purchasing one or more items eligible for a tax refund. In the illustrated example, it is assumed that the user is already registered with the system and therefore has an account stored in the database 25. The user brings the items they wish to purchase to the merchant and indicates that they wish to purchase them tax-free. The merchant operates the merchant device 23 to acquire image data 220 of the user's face. In step S200, the merchant device 23 transmits biometric data to the server device 24 via the network 22. The server device 24 receives the biometric data and, in step S202, triggers a search for data in the database 25. In step S204, the database 25 returns account data identified using the biometric data to the server device. In step S206, the server device indicates to the merchant device 23 that the biometric data was found in the database. Subsequently, in step 208, the merchant device 23 transmits information indicative of the purchased item to the server device 24, which in step 210 stores the information indicative of the purchased item in the database 25. It will be readily apparent to those skilled in the art that in some alternative configurations, the information indicative of the purchased item may be transmitted along with the biometric data in step 200, rather than being transmitted as a separate step.

[0047] FIG. 2d schematically illustrates the interaction between the verification device 26, the server device 24, and the database 25. In the illustrated example, it is assumed that the user is already registered with the system and therefore has an account stored in the database 25. It is further assumed that the user has made one or more purchases of items eligible for tax-free shopping, and that information indicating the one or more tax-free purchases (e.g., receipt data) is stored in the database 25. The process begins when the user accesses a verification station (or self-service kiosk) in an airport and wishes to verify their purchase before leaving the country. The verification station 26 acquires image data 250 of the user's face. The verification station performs image processing to generate biometric data indicative of one or more facial features of the user. In step 230, the verification device 26 transmits the biometric data to the server device 24, which in step 232 triggers a search in the database 25 to identify account data associated with the user. In step 234, the database 25 returns an indication of a hit to the server device 24, including the user's account data. In step 236, server device 24 sends the user's account data (including receipt data indicating transactions performed by the user) back to verification device 26. In step 238, verification device 26 performs the verification process. For example, the verification station may be provided with one or more rules defining "green channel" situations that provide automatic approval for purchases of low-value items and / or by travelers from certain countries, and "red channel" situations that require the user to present the purchased items to a customs official for approval, e.g., for higher-value purchases. Once the purchase is approved, either through automatic processing or approval by a customs official, verification device 26 sends the results of the verification in step 240 to the server device, which updates database 25 to indicate that the purchase has been approved and triggers the refund process in step 244.

[0048] The flows described above in connection with Figures 2b-2d relate to some possible tax-free shopping flows. It will be readily apparent to those skilled in the art that there are numerous possible tax-free shopping flows implemented in various regions in accordance with local laws and regulations. The exact nature of the tax-free shopping flow is not important, and the use of facial recognition based on image data can be integrated into existing flows at various points. Specifically, if an existing tax-free shopping flow requires a user to verify their identity in order for the data to be linked to an account, the present techniques can be applied as a method for the user to verify their identity.

[0049] In the above configuration, identification of user 1's account data using facial recognition is performed for each stage of the process, i.e., the purchase and verification steps of the tax-free shopping process. However, in alternative configurations, facial recognition may be used only for some transactions. For example, facial recognition may be used for the purchase step at all stores or some stores. However, alternative identification methods may be used for the verification step, purchases at other stores, and / or purchases over a certain amount. Alternatively, facial recognition may be used for the verification step, but an alternative identification method may be used for in-store purchases. In some configurations, a user may also be able to log in to their account using, for example, a mobile device, and view and manage their account details using facial recognition functionality.

[0050] FIG. 3 schematically illustrates details of a device 30 according to some configurations of the present technique. The device 30 includes an image receiving circuit 32, a processing circuit 34, an authentication circuit 36, and a transaction circuit 38. The device 30 is configured to communicate with a database 42, e.g., via a network. The database 42 stores account data 44 associated with multiple users. Each set of account data 44 is identified using biometric data. The image receiving circuit 32 is configured to receive image data 40. The image data 40 is passed to the processing circuit 34, which is configured to perform a facial recognition process using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features included in the image data. The processing circuit 34 passes the biometric data to the authentication circuit 36. The transaction circuit 38 is configured to perform one or more steps of a tax refund transaction and provides data indicative of the one or more steps of the tax refund transaction to the authentication circuit 36. The authentication circuit 36 ​​uses the biometric data to trigger a search in the database 42. If the search in database 42 is a hit, i.e., identifies an entry corresponding to the biometric data provided by authentication circuit 36, database 42 may record data indicative of the transaction in database 42 and may return an indication to authentication circuit 36 ​​that the biometric data was a hit in database 42. If the search in database 42 is unsuccessful, i.e., fails to identify an entry corresponding to the biometric data provided by authentication circuit 36, database 42 may return an indication to authentication circuit 36 ​​that the search was unsuccessful.

[0051] FIG. 4 schematically illustrates details of an enrollment device 50 according to various configurations of the present technique. The enrollment device 50 includes an image receiving circuit 54, a processing circuit 56, and a control circuit 58. The enrollment device is coupled to (communicative with) a database 42 that stores account data 44 for multiple users. The image receiving circuit 54 is configured to receive image data 52 from a user and account data, e.g., identification information, from the user. The image receiving circuit 54 is configured to pass the received image data to the processing circuit 56, which is configured to perform a facial recognition process using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features included in the image data. The processing circuit 54 passes the biometric data to the control circuit 58. The control circuit 54 responds to receiving the biometric data to enroll the user account by storing the account data in the database 42. The control circuit 58 transmits the biometric data, which is used as an identifier to identify the location in the database where the account data is stored.

[0052] 4 and 5, the device 30 and the registration device each communicate directly with the database 42. In some alternative configurations, the device 30 and the registration device communicate with the database 42 through a server device that manages the database.

[0053] 5a and 5b schematically illustrate image receiving circuits according to various configurations of the present technique. FIG. 5a schematically illustrates an image receiving circuit 60 including a camera circuit 62. The camera circuit 62 includes a charge-coupled device (CCD) arranged to receive optical images of a user, which are converted to digital data and output to the image receiving circuit 60. The camera may be configured to capture still image data and / or video data (including live video data). FIG. 5b schematically illustrates an alternative configuration in which the image receiving circuit 68 includes a communication circuit 66 configured to communicate with a user mobile device 64. The user mobile device 64 includes a camera circuit 69 including a charge-coupled device (CCD) configured to receive, under user control, optical images of the user, which are converted to digital signals and output as image data to the user mobile device 64. The camera may be configured to capture still image data and / or video data (including live video data). The user mobile device 64 transmits the image data to the communication circuit 66, which outputs the image data to the image receiving circuit 68.

[0054] 6 schematically illustrates further details of a processing circuit 70 configured to convert image data 72 into biometric data 84, according to various configurations of the present technique. The processing circuit 70 includes a preprocessing circuit 86 and a plurality of sets of measurement circuits 74, including measurement circuit 1 74(1), measurement circuit 2 74(2), ..., and measurement circuit N 74(N). The processing circuit 70 also includes a decomposition circuit 76, a library of eigenfaces 78, a first combination circuit 80, and a plurality of sets of quantization circuits 82, including quantization circuit 1 82(1), quantization circuit 2 82(2), ..., and quantization circuit M 82(M). The processing circuit also includes a second combination circuit 84.

[0055] The preprocessing circuit 86 is configured to receive the image data 72 and perform one or more preprocessing steps, including filtering, cropping, scaling, aligning, and color balancing, on the image data 72 to generate preprocessed image data. The preprocessed image data is routed to the measurement circuit 74 and the decomposition circuit 76. Each of the blocks of the measurement circuit 74 is arranged to perform measurements related to one or more facial features present in the image data. In the illustrated configuration, the N blocks of the measurement circuit 74 output N different measurements to the first combination circuit 80.

[0056] The decomposition circuit 76 is arranged to receive the preprocessed image data and the eigenfaces from the library of eigenfaces 78 and perform principal value decomposition to identify weighted combinations of the eigenfaces that approximate the preprocessed image. The weights (similarity scores) are output by the decomposition circuit 76 to a first combination circuit 80.

[0057] The first decomposition circuit 80 is arranged to receive measurements from each of the blocks of the measurement circuit 74 and a set of weights from the decomposition circuit 76. The first combination circuit 80 is configured to generate one or more combinations of the received measurements and weights, which are passed to each of a set of quantization circuits 82. The quantization circuits 82 are arranged to quantize the inputs received from the first combination circuit 80 into a plurality of bins. In other words, the quantization circuit 82 receives fine-grained measurements and outputs coarse-grained measurements. The outputs of the set of quantization circuits 82 are provided to a combination circuit 84, which generates biometric data 84 by combining the coarse-grained measurements from the quantization circuits.

[0058] It will be readily apparent to one skilled in the art that any number of sets of measurement circuitry and quantization circuitry may be provided. Furthermore, while the illustrated configuration shows separate circuit blocks for each functional block of the circuit, it will be readily apparent to one skilled in the art that the circuitry may be provided as any number of functional blocks that interact to provide the described functionality. Furthermore, one or more of the functions described in connection with the circuit blocks of FIG. 6 may be provided by hardware implementing one or more program instructions configured to control the circuitry to perform the functions described in connection with FIG. 6. In alternative configurations, measurement circuitry 74 or decomposition circuitry 76 may be omitted.

[0059] 7a and 7b schematically illustrate the generation of biometric data for registering accounts for two users. FIG. 7a schematically illustrates the generation of biometric data 712 for a first user. The user provides image data including an image of their face f1, which is passed to a measurement circuit 702. In the illustrated configuration, it is assumed that preprocessing steps performed by the preprocessing circuit 86 have already been performed, such that the image data 700 is cropped, scaled, filtered, and aligned. The measurement circuit 702 obtains a series of raw measurements from the image data 700. In particular, the measurement circuit 702 measures the face height H(f1), face width W(f1), eye separation x1(f1), and eye-mouth separation x2(f1). Because the raw measurements are likely to be affected by image variations and image noise, they are passed to a quantization circuit 704, which is arranged to generate a quantized version of the combination of measurements. The quantization circuit 704 includes three individual quantization units: Quantization 0 706 , Quantization 1 708 , and Quantization 2 710 .

[0060] Each of the quantization units receives an input combination of raw measurements and outputs a quantized version of the input combination of raw measurements. Quantization unit 0 706 receives an input H / W combination (face height divided by face width). This quantity is shown on the x-axis of the mapping function shown in quantization unit 0 706. The quantization unit maps the continuous input H / W to a quantization variable Q0^. The mapping function is a piecewise constant mapping such that a range of values ​​of H / W is mapped to the same value of the quantization variable Q0^. Quantization unit 1 708 receives an input x1 / W combination (eye separation divided by face width). This quantity is shown on the x-axis of the mapping function shown in quantization unit 1 708. The quantization unit maps the continuous input x1 / W to a quantization variable Q1^. The mapping function is a piecewise constant mapping such that a range of values ​​of x1 / W is mapped to the same value of the quantization variable Q1^. Quantization unit 2 710 receives an input combination x2 / W, which is the eye-mouth separation divided by the width of the face. This quantity is shown on the x-axis of the mapping function shown in quantization unit 2 710. The quantization unit maps the continuous input x2 / W to a quantization variable Q2̂. The mapping function is a piecewise constant mapping such that a range of values ​​of x2 / W is mapped to the same value of the quantization variable Q2̂.

[0061] The mappings implemented by the three quantization units are different from one another. Quantization unit 0 706 and quantization unit 1 708 provide relatively coarse quantization between input combinations of raw measurements and output quantized values ​​with equal-sized quantization bins (areas where input values ​​map to the same output value). In contrast, quantization unit 2 provides relatively fine quantization between input combinations of raw measurements and quantized values ​​with variable-sized bins. The output quantized variables for face f1 are concatenated to provide biometric data 712, including Q0^(f1), Q1^(f1), and Q2^(f1) calculated for face f1. The biometric data 712 is combined with user account data 714 and a raw image 716 of face f1 and transmitted to a server device for storage in a database.

[0062] FIG. 7b schematically shows the same process executed on different faces f2 provided by a second user in the image data 720. The image data 720 is provided to a measurement circuit 702 that obtains the same set of raw measurements as described in connection with FIG. 7a. The raw measurements are quantized again using a quantization circuit 704 as described in connection with FIG. 7b. In the illustrated example, the second face f2 differs from the first face f1 in that the distance x1 between the eyes is narrower, i.e., x1(f2) < x1(f1), and the width W of the second face f2 is narrower than the width of the first face f1, i.e., W(f2) < W(f1). As a result, the combined measurement values quantized by the quantization unit 0 702 of the second face f2 are larger than those of the first face f1, i.e., H(f2) / W(f2) > H(f2) / W(f2), resulting in a quantization parameter Q0^(f2) that is larger than that of the first face f1. The second quantization parameter Q1^ is based on the inter-eye distance x1 and the face width W. Since both of these parameters are smaller for the second face f2 than for the first face f1, the visible change in the parameter x1 / W is smaller than in the case of the combination used by the quantization unit 0 706. In the illustrated configuration, this results in the same quantization value being generated by the quantization unit 1 708, i.e., Q1^(f2) = Q1^(f1). The third quantization parameter Q2^ is based on the distance x2 from the eyes to the mouth and the face width W. As a result, the combined measurement values quantized by the quantization unit 2 706 of the second face f2 are larger than those of the first face f1, i.e., x2(f2) / W(f2) > x2(f2) / W(f2), resulting in a quantization parameter Q2^(f2) that is larger than that of the first face f1. The biometric data 722 generated for the second face f2 includes different parameters Q0^(f2), Q1^(f2), Q2^(f2) than those obtained for the face f1. The biometric data 722 is combined with a copy of the account data 724 and the second image data 726 provided by the second user and transmitted to a server device for storage in a database.

[0063] FIG. 8 schematically illustrates a method for triggering a search in a database performed by a device according to various configurations of the present technique. In the illustrated configuration, it is assumed that multiple users, including a first user and a second user, have already been registered in a database 808. For each registered account, the database 808 stores biometric data, account data, and an image of the user. When a user performs a transaction in the TFS process, image data 810 of the user's face f1 is provided to a measurement circuit 800. The measurement circuit 800 generates the same measurements as those described in connection with the enrollment process shown in FIG. 7a. In particular, the measurement circuit 800 generates measurements of the face height H(f1), face width W(f1), eye separation x1(f1), and eye-mouth separation x2(f1). The measurements are then provided in combination with a quantization unit 0 802, a quantization unit 1 804, and a quantization unit 2 806 to quantize the measurements to generate biometric data 816 used in the search in the database 808. Note that the image data 810 used to generate the biometric data 816 may differ from the image data 700 used in the first face enrollment process (e.g., through changes in optics, lighting, etc.). While this is mitigated to some extent through the use of ratios as the combined parameters, there may still be some variation in the combined parameters H / W, x1 / W, and x2 / W. This variation may cause inaccuracies in the search process and may result in the biometric data 816 not being included in the database 808. This is overcome through a quantization process, as shown in the expanded box 818. In particular, it can be seen that whether the parameter H / W is smaller by a first amount 814 or whether the parameter H / W is larger by a second amount 812, the measurement of H / W will result in the same quantized value Q0^. Through the quantization process, expected variations in the biometric data of the same user can be eliminated, resulting in the biometric data 816 being representative of face f1. The biometric data 816 can then be used to perform a search in the database 808 to identify the user's account data.In particular, the biometric data 816 matches the biometric data associated with the f1 account data stored in the database 808, i.e., the account data of the first user, and is stored, f2 account data and f. N This is distinct from the biometric data associated with the account data. In response to the search, f1 account data is returned, including image data that is stored in database 808 so that an operator can perform further checks on the identity of the user upon receiving the returned data.

[0064] In an alternative arrangement, recording of the image data in database 808 may be omitted. Alternatively, or additionally, the user may be asked to provide a PIN code or password in response to data being returned from database 808. In a further alternative arrangement, the raw measurements, the combined parameters used for quantization, and the quantization levels (bins) used during the quantization process may be defined differently.

[0065] 9 and 10 illustrate a schematic configuration in which a user's biometric data cannot be identified in the database, and how the occurrence of such a situation can be mitigated. In the exemplary configuration shown in Figures 9 and 10, a first user wishes to register a transaction as part of their account data held in database 808. However, in the illustrated configuration, the user's face f1 m is hidden by the glasses. As a result, the image data 910 provided to the measurement circuit 800 differs significantly from the image data f1. The modified face f1 in the image data 910 m and the user's face f1 recorded in the database 808 is the measurement H(f1 m ), W(f1 m ), x1(f1 m ), and x2(f1 m ) is so large that it differs from H(f1), W(f1), x1(f1), and x2(f1). In particular, the presence of eyeglasses in the image data 910 may cause the distance between the eyes x1(f1 m)≠x1(f1) and the distance between the eyes and mouth x2(f1 m )≠x2(f1). In the illustrated configuration, these differences are so large that the quantization process cannot correct for them, and the quantization parameter Q1^(f1 m )≠Q1^(f1) and Q2^(f1 m )≠Q^(f1). Thus, the output biometric data 916 is different from the biometric data used to identify the first user in database 808. Therefore, a search based on biometric data 916 in database 808 fails and the user's account data cannot be identified.

[0066] 9 and 10 each handle failures in the database 808 differently. In the example shown in FIG. 9, the database 808 includes a hash of an alternate index 924 for each account. The hash of the alternate index 924 is a string of data unique to the account and is generated at registration based on a hash of information provided by the user, such as a passport number. If a first user cannot access their account from the image data, an indication of failure in the database is returned to the communication circuit 920, prompting the user to provide an alternate index. The alternate index is passed from the communication circuit 920 to the hash circuit 922, which generates a hash of the index value and transmits the hash value to trigger a search in the database 808 based on the alternate index 924. In the illustrated configuration, the user provides an alternate index I1, and the hash circuit 922 generates a hash #I1. A search based on the alternate hash value results in a hit in the database 808. To reduce the likelihood of fraud in such situations, the biometric data 916 is compared to the stored biometric data associated with the hit to determine a similarity score indicating how close the biometric data 916 is to the stored biometric data. If the similarity score exceeds a minimum similarity threshold 930, the biometric data is assumed to be sufficiently close to the stored biometric data and account data 926 is returned.

[0067] In the example shown in Figure 10, database 808 is arranged to store alternative biometric data 1024. Additionally, a search is arranged to identify entries that are "close" to biometric data 916. In particular, an initial search in database 808 may identify entries for face f1 and face f2 as close to biometric data 916. This is achieved by combining the biometric data using a mapping function G(Q̂) 1037 that maps the upper portion of each of Q0̂, Q1̂, and Q2̂ to the upper portion of G(Q̂), and maps the lower portion of each of Q0̂, Q1̂, and Q2̂ to the lower portion of G(Q̂). For example, for i = 0, 1, 2, Q i0 Q i The most significant part of ^ and Q i1 Q i Q0^=Q, where Q0^ is the least significant part of ^. 00 ,Q 01 , Q1^=Q 10 ,Q 11 , and Q2^=Q 20 ,Q 21 Then, G(Q^)=Q 00 ,Q 10 ,Q 20 ,Q 01, Q 11 ,Q 12 As a result of this mapping, close faces, i.e., faces whose quantized face measurements differ only in the least significant bit of the measurements, are located close to each other in the database. The initial search in the database 808 is a two-part search: first, the upper part of G (i.e., Q 00 , Q 10 , Q 20 ) identifies account data that matches the biometric data stored in database 808. These entries are those that are considered to be "near" to the biometric data 916. Once the "near" entries are considered, a sub-portion of G (i.e., Q 01 , Q 11 , Q 21) is performed. In the illustrated configuration, the initial search identifies pairs of entries 1035 as “close” to the biometric data, but because the second part of the search is not found, no entries are identified. As a result, a supplemental search is triggered based on the alternative biometric data. However, the supplemental search is limited to pairs of entries 1035 identified as close to the biometric data 916. The alternative biometric data 1024 is generated by the server device using a different, more accurate facial recognition algorithm 1026. In the illustrated configuration, the more accurate facial recognition algorithm 1026 includes contour measurements 1028, which generate measurements of contour width, contour length, contour separation, and contour position, which are passed to the quantization circuit 1030. Because the alternative biometric data 1024 is generated on the server, this step can be performed in the background once the user enrolls and can involve much more accurate methods that may require significantly additional processing resources and / or take longer than the facial recognition algorithms described in connection with FIGS. 7a, 7b, and 8. If the first user cannot access their account from the image data, an indication of failure in the database is returned to trigger the measurement circuit 800 to pass image data 910 which is used to generate alternative biometric data to perform an auxiliary search. The image data 910 is passed through an instance of a higher accuracy facial recognition algorithm 1036 which includes instances of a contour measurement circuit 1038 and a quantization circuit 1040. The contour measurement circuit 1038 and the quantization circuit 1040 generate auxiliary biometric data which can be used to perform a further search in pairs of "close" entries 1035 identified in the database 808 based on the alternative biometric data which returns the user's account data 1040.

[0068] The particular format of data and circuit arrangement provided in the illustrated configuration are for illustrative purposes only. In alternative configurations, an instance of the higher accuracy facial recognition algorithm 1036 may be provided using the same circuitry (processing elements) used for the higher accuracy facial recognition algorithm 1026. Furthermore, while the alternative biometric data 1024 may be stored in the database 808, in some alternative configurations a second database indexed by the alternative biometric data may be provided to return the biometric data. For example, it will be readily apparent to those skilled in the art that any high accuracy facial recognition algorithm using any of the techniques described above can be used to provide the higher accuracy facial recognition algorithm. While the use of the mapping function 1037 is shown in conjunction with a higher accuracy search, it will be readily apparent that the mapping function can be used without the auxiliary search or in conjunction with the auxiliary search method shown in FIG. 9.

[0069] In brief, in general overview, an apparatus and method are provided, the apparatus including an image receiving circuit configured to receive image data of a user. The apparatus also includes a processing circuit configured to process the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data. The apparatus also includes an authentication circuit configured to trigger a search in a database using the biometric data to identify account data associated with the user. The apparatus also includes a transaction circuit configured to, in response to identifying the account data, perform one or more steps of a tax refund transaction and update the account data to include transaction data indicative of the tax refund transaction.

[0070] In this application, the term "configured to..." is used to mean that an element of an apparatus has a configuration that enables it to perform a defined operation. In this context, "configuration" refers to an arrangement or manner of interconnection of hardware or software. For example, an apparatus may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured" does not imply that an apparatus element needs to be modified in any way to provide the defined operation.

[0071] In this application, a list of features preceded by the phrase "at least one of" means that any one or more of those features can be provided individually or in combination. For example, "at least one of 'A', 'B', and 'C'" includes any of the following options: A only (without B or C), B only (without A or C), C only (without A or B), a combination of A and B (without C), a combination of A and C (without B), a combination of B and C (without A), or a combination of A, B, and C.

[0072] Although exemplary configurations have been described in detail herein with reference to the accompanying drawings, it should be understood that the invention is not limited to those precise configurations, and that various changes, additions, and modifications could be made by those skilled in the art without departing from the scope and spirit of the invention as defined by the appended claims. For example, various combinations of the features of the dependent claims could be made with the features of the independent claims without departing from the scope of the invention.

Claims

1. an image receiving circuit for receiving user image data; a processing circuit for processing the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; an authentication circuit that uses the biometric data to trigger a lookup in a database to identify account data associated with the user; a transaction circuit that, in response to identifying the account data, performs one or more steps of a tax refund transaction and updates the account data to include transaction data indicative of the tax refund transaction; Equipped with the biometric data includes an index derived using an index function, the index function being selected to minimize variation in the index due to changes in orientation and environment of the one or more facial features and to maximize variation in the index due to differences between respective facial features of different users; Device.

2. the account data includes identification data, and the authentication circuit determines the user's eligibility for the tax refund transaction based on the identification data; the identification data includes information identifying the user and the user's country of residence, and the determination of eligibility is made based on the location of the merchant and the country of residence; 10. The apparatus of claim 1.

3. the image receiving circuitry comprises a camera configured to acquire the image data; and the apparatus comprising a communication circuit for transmitting a request for the image data to a user mobile device, the image receiving circuit for receiving the image data transmitted from the user mobile device in response to the request; At least one of 3. The device according to claim 1 or 2.

4. the one or more steps of the tax refund transaction include one or more steps related to a purchase of a product by the user, and the transaction data includes information identifying the purchase of the product.

3. The device according to claim 1 or 2.

5. the one or more steps of the tax refund transaction include a validation process performed at a customs station; the verification process includes obtaining one or more items of stored transaction data each identifying one or more purchases made by the user, determining whether each of the one or more purchases is eligible for a tax refund, and issuing the tax refund in response to a determination that each of the one or more purchases is eligible for a tax refund; the account data includes payment information associated with the user, and issuing the tax refund includes refunding the refund amount to a financial account associated with the payment information.

3. The device according to claim 1 or 2.

6. the index function includes performing measurements related to the one or more facial features; quantizing at least one of the measurements into a plurality of bins; and encoding information in the index that identifies a bin of the plurality of bins that is closest to the at least one measurement.

10. The apparatus of claim 1.

7. the index function includes quantizing each of the measurements into a corresponding plurality of bins and encoding information in the index that identifies a corresponding bin closest to each of the measurements.

7. The apparatus of claim 6.

8. the index function includes encoding information into the index that identifies at least a bin that is second-closest to the at least one measurement.

7. The apparatus of claim 6.

9. the index function includes encoding the information using a hash function; 7. The apparatus of claim 6.

10. The measurement value is a separation distance between two of the one or more facial features; a depth of one of the one or more facial features; the position or shape of one or more facial contours; a plurality of similarity scores, each indicating a similarity between the one or more facial features and a plurality of pre-defined eigenfaces; including one or more of:

7. The apparatus of claim 6.

11. the authentication circuit, in response to an indication that the search is unable to identify a unique account, requests further identifying information and triggers a further search based on the further identifying information to identify the account data.

3. The device according to claim 1 or 2.

12. the authentication circuitry triggers further identity verification in response to the server identifying the account data; 3. The device according to claim 1 or 2.

13. the user is a customer, and the further identity verification includes receiving a photograph from the server and requesting a retailer operating the device to verify that the photograph matches the customer; 13. The apparatus of claim 12.

14. the account data includes password information indicating a user's password; the further identity verification includes requesting a password from the user and transmitting the password to the server; 13. The apparatus of claim 12.

15. the image data includes a video stream encoding a continuous series of images; 3. The device according to claim 1 or 2.

16. the video stream is a live video stream; 16. The apparatus of claim 15.

17. The method of claim 16, further comprising: receiving user image data by a receiving circuit; processing the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; an authentication circuit using the biometric data to trigger a lookup in a database to identify account data associated with the user; transaction circuitry performing one or more steps of a tax refund transaction and updating said account data to include transaction data indicative of said tax refund transaction; Including, the biometric data includes an index derived using an index function, the index function being selected to minimize variation in the index due to changes in orientation and environment of the one or more facial features and to maximize variation in the index due to differences between respective facial features of different users; method.

18. a receiving circuit for receiving user image data; a processing circuit for processing the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; control circuitry for registering a user account by storing account data at a location in a database identified using the biometric data, the control circuitry updating the account data to include tax refund transaction data indicative of the tax refund transaction in response to an indication of one or more steps of a tax refund transaction associated with the user; Equipped with the biometric data includes an index derived using an index function, the index function being selected to minimize variation in the index due to changes in orientation and environment of the one or more facial features and to maximize variation in the index due to differences between respective facial features of different users; Registration device.

19. the receiving circuitry receives identification data of the user, and the control circuitry includes the identification data in the account; 20. The registration device of claim 18.

20. The control circuit performing a search in the database using the biometric data before registering the user account; in response to determining that the biometric data conflicts with existing account data, modifying the existing account data to include a conflict indication, and including the conflict indication in the account data; 20. A registration device according to claim 18 or 19.

21. The method of claim 20, further comprising: receiving user image data by a receiving circuit; processing the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; registering a user account by storing account data in a database location identified using the biometric data, the account data storing tax refund transaction data indicative of one or more steps of a tax refund transaction associated with the user; Including, the biometric data includes an index derived using an index function, the index function being selected to minimize variation in the index due to changes in orientation and environment of the one or more facial features and to maximize variation in the index due to differences between respective facial features of different users; How to register.

22. A server device, a storage circuit for storing a database identifying a plurality of accounts associated with a plurality of users registered for the tax refund service; a control circuit that, in response to receiving a search request from the device, the search request including information indicative of one or more facial features of a user, triggers a search in a database based on the information to identify account data associated with the user; Equipped with the control circuitry, in response to an indication of one or more steps of a tax refund transaction associated with the user, updates the account data to include tax refund transaction data indicative of the tax refund transaction; the information includes biometric data generated from image data of the user using one or more facial recognition algorithms, and the search is performed using the biometric data; or the information includes image data of the user, the server device including processing circuitry for processing the image data using one or more facial recognition algorithms to generate biometric data indicative of the one or more facial features included in the image data, and the search is performed using the biometric data; at least one of the biometric data includes an index derived using an index function, the index function being selected to minimize variation in the index due to changes in orientation and environment of the one or more facial features and to maximize variation in the index due to differences between respective facial features of different users; Server device.

23. the control circuitry, in response to the search failing to identify a unique account, sending a request for further identification information to the device; the control circuitry, in response to a further search request from the device including further identification information, triggers a further search using the further identification information to identify the account data; 23. The server device according to claim 22.

24. the control circuitry, in response to the search identifying a plurality of accounts, triggers generation of further biometric data from the image data using one or more further facial recognition algorithms different from the one or more facial recognition algorithms; the one or more additional facial recognition algorithms include at least one facial recognition algorithm having a higher accuracy than the one or more facial recognition algorithms; 24. The server device according to claim 22 or 23.

25. A method of operating a server, comprising: storing a database identifying a plurality of accounts associated with a plurality of users registered for the tax refund service; in response to receiving a data search request from a device, the data search request including information indicative of one or more facial features of a user, triggering a search in a database based on the information to identify account data associated with the user; updating the account data to include tax refund transaction data indicative of the tax refund transaction in response to an indication of one or more steps of a tax refund transaction associated with the user; Including, the information includes biometric data generated from image data of the user using one or more facial recognition algorithms, and the search is performed using the biometric data; or the information includes image data of the user, the server processes the image data using one or more facial recognition algorithms to generate biometric data indicative of the one or more facial features contained in the image data, and the search is performed using the biometric data; at least one of the biometric data includes an index derived using an index function, the index function being selected to minimize variation in the index due to changes in orientation and environment of the one or more facial features and to maximize variation in the index due to differences between respective facial features of different users; method.

Images