RU2274899C2 - Portable device and method for accessing device activated by key data - Google Patents

Abstract

FIELD: engineering of object access means.

SUBSTANCE: device has saved standard, containing fingerprint of authorized user, combined with verification code. In case of match between fingerprint of authorized user with one stored in memory, verification code if generated. Device activated by key periodically transmits an identifier, on receipt by access device of identifier, matching one of identifiers stored in memory, appropriate access key is extracted and sent to device activated by key to allow access to user.

EFFECT: high level of protection from unauthorized access.

3 cl, 2 dwg

Description

Technical field

The invention relates to a method for accessing key-activated devices, a portable device for accessing such key-activated devices, and a secure access system.

State of the art

Access to an increasing number of devices is controlled by data access keys. For example, access to an automated cash register (ATM, ATM) is controlled by entering the appropriate personal identification number (PIN) from the keyboard. Similarly, access to security doors for access can be controlled by keypad entry. Access to security systems, computer networks, and voice mail systems are also typically managed pass code. As the number of devices that require an access key to access is increasing, it becomes more difficult for the user to select all the necessary access keys. In addition, the protection of such a key-activated device may be compromised if the access key is not kept strictly secret by an authorized user.

The present invention is intended to overcome the disadvantages of known protection systems.

SUMMARY OF THE INVENTION

According to the present invention, there is provided a method for accessing key-activated devices, comprising the steps of: receiving an identifier of a key-activated device; receiving biometric data; determining whether the received biometric data is authorized biometric data, comparing said identifier of a device activated by a device key with stored identifiers of a device activated by a key and if it matches a stored identifier of an activated device key, and if said received biometric data is authorized biometric data - retrieve the saved access key, associated with said matching stored identifier a tiviruemogo device key; and transmitting said extracted access key.

According to another aspect of the invention, there is provided a portable electronic access device comprising: means for inputting biometric data; a verifier responsive to said biometric data input means for performing verification that the biometric data that is input into said biometric data input means correspond to authorized biometric data and providing verification indications; a memory retaining a plurality of access keys, each intended for use when accessing a key-activated device, and a plurality of identifiers of key-activated devices, each associated with one of the plurality of access keys; a receiver for receiving an identifier activated by a device key; a comparator that responds to the verification indication from the said verifier, for comparing the received identifier of the device key activated with the stored identifiers of the devices activated by the key and if it detects a match with the stored identifier of the device key activated - retrieving the saved access key associated with the matching matching stored identifier of the activated device key; and a transmitter for transmitting the extracted access key.

Brief Description of the Drawings

In the drawings, which illustrate an embodiment of an exemplary invention:

Figure 1 is a diagram of a secure access system implemented in accordance with the present invention, and

FIG. 2 is a flowchart illustrated in FIG. 1.

Detailed Description of Preferred Embodiments

As shown in FIG. 1, the secure access system 10 comprises a data key activated device 12 and a portable key access device 14. The key-activated device 12 can be a door with a high degree of protection (vehicle or installation), an ATM, a security system, a computer network, a voicemail system, or any other device that requires a data key for access. The key access device 14 comprises a processor 20 coupled to provide two-way communication with a transceiver 22 and to provide two-way communication to a memory 24. The processor also receives signals from fingerprint input means 26. The memory 24 is non-volatile and stores many access keys, each of which is intended for use when accessing a key-activated device. The memory also stores a plurality of identifiers of key activated devices, with each identifier associated with one of the plurality of stored access keys. The transceiver 22 is wireless and can exchange (information) with a key-activated device through radio transmission or infrared signals. The key access device 14 is portable and preferably receives battery power. A switch (not shown) can disconnect the battery when the device is not in use to conserve battery power.

To use a portable access device, the user must first be registered. To complete the registration, the user must transfer a digitized copy of his fingerprint to the registration computer. This can be done by the user by applying his finger to the fingerprint input means 26 of the access device 14 when the device is connected through a port (not shown) to the registration computer so that the processor 20 of the access device is requested to transmit the digitized image of the fingerprint to the registration computer. Alternatively, the user can attach his finger directly to the fingerprint input means associated with the registration computer. This computer then calculates a reference (template) based on the user's fingerprint, which is an encrypted verification code with a fingerprint combination. Suitable methods for obtaining such fingerprint and code based patterns and for recovering code from such a pattern are described in US Pat. No. 5,680,460 to "BIOMETRIC CONTROLLED KEY GENERATION", the contents of which are incorporated herein by reference. This reference is then loaded into a portable access device and stored in memory 24. Next, the registration computer stores the verification indication at the address in memory 24 indicated by the verification code. Registration then ends.

The operation of the system 10 in FIG. 1 is described in conjunction with FIG. 1 in conjunction with FIG. 2, which illustrates program control for the processor 20. A key-activated device 12 periodically transmits a device identifier. It is usually preferred that the time between such transmissions is no more than about five seconds; the radius of these gears is preferably approximately two meters. When the portable access device 14 is brought within the transmission radius of the key-activated device and turned on, the transceiver 22 will receive these transmissions and transmit the identifier of the key-activated device to the processor 20 (step 50). If the user of the portable access device then puts his finger on the fingerprint input means 26, the fingerprint image is also received by the processor 20 (step 52).

The processor may then determine whether the fingerprint that was entered is the fingerprint of an authorized user. This is accomplished by retrieving by the processor a reference stored in the memory 24 during registration, and combining it with a recently inserted fingerprint from the input means 26. The resulting verification code is used as the memory address 24. If the processor finds a verification indication at this memory address in the memory 24, then the biometric data entered are considered authorized (step 54). In this case, the processor compares the received identifier of the key-activated device with the identifiers of the key-activated devices from memory. If a match is found (step 56), the processor transmits an indication of a trusted user to the transceiver 22 for transmission to the key-activated device 12 (step 58). This indication of a trusted user may contain a verification code or its encrypted version. Additionally, the processor retrieves the access key from the memory 24, which is associated with the matching identifier of the activated key device (step 60).

When the key-activated device 12 receives a valid user indication from the access device 14, it transmits a temporary encryption key once. It is received by the transceiver 22 and transmitted to the processor 20. The processor 20 uses this temporary key to encrypt the extracted access key (step 62). The encrypted access key is then transmitted to the transceiver 22 and transmitted to the device activated by the key (step 64). The key-activated device uses the decryption key to recover the decrypted access key and, if the resulting decrypted key is a valid key, allows the user access. When the key-activated device is a door with a high degree of protection, this unlocks the door. When the key-activated device is an ATM, this allows the user to access the device through a keyboard that can be provided on the portable access device 14.

Obviously, since the access device 14 stores several identifiers of key-activated devices and associated access keys, the device 14 can be made wearable by a authorized user and used to gain access to several different key-activated devices without the need for the user to memorize multiple codes for the purpose of passage.

The portable access device can be used together with an existing key-activated device, modifying this device to integrate a transceiver into it, and programming the processor of the key-activated device so that the device functions as described above.

A number of modifications of the described system are possible. For example, a trusted user identifier may be transmitted as soon as the allowed fingerprint is received by the access device 14 before determining whether the received identifier of the device key-activated key matches one of the stored identifiers.

Alternatively, for applications with a lower degree of protection, the portable access device does not transmit an indication of a trusted user, nor does the key-activated device transmit any temporary keys. Instead, for such applications, it is determined on the access device 14 that the authorized user has applied their fingerprint to the input means, and upon detection of the access key for the key-activated device, this access key is transmitted in unencrypted form to the key-activated device.

Another option for the key-activated device 12 is to send an “average security” indicator, when it is required that the access device 14 send a verification code and receive a temporary key to encrypt the access keys before transmission, and send a “low security” indicator, or no security indicator when it is required that the access device 14 follow the described low security option.

The high security option is for access keys that must be encrypted in access device 14. To perform this option, during registration, as well as when generating a template from the user's fingerprint and verification code, the template is formed from the user's fingerprint and a special key. A special key is then used to encrypt each access key. During operation, when the access device 14 receives the identifier of the device activated by the key and the user's fingerprint, it retrieves any associated encrypted access key and both patterns. If the fingerprint is that of an authorized user, the fingerprint successfully returns a verification code from one reference. This leads to the fact that the access device 14 sends a verification indication to the key-activated device 12. The key-activated device responds by sending a temporary encryption key. The access device then uses a fingerprint to return a special key from another fingerprint reference, and a special key is then used to decrypt the access key. The access device 14 then uses a temporary key to encrypt the access key, and sends the encrypted access key to the key-activated device 12.

It will be apparent to those skilled in the art that the transmission of the extracted access key may be protected by other cryptographic means. For example, a public key infrastructure (PKI, PKI) can be used so that this extracted access key is first digitally signed using the user's private key (synonym for the special key mentioned above) and then encrypted using the public key of the device key activated (synonym temporary key mentioned above). This encrypted data packet is then sent to a key-activated device. In this way, the user can be guaranteed that only the user with the appropriate authorization can correctly use the transmitted data (when only they will have the private key of the device activated by the key to decrypt the data), and this key-activated device can accordingly guarantee that the authorized user has been represented (by verification of the digital signature of the extracted access key using the user's public key). This provides strong mutual authentication between the real user of the system and the key-activated device (instead of only between the portable access device and the key-activated device), when a digital signature can only be initiated after the user submits a positive biometric authentication information. This embodiment provides not only a secure transmission line between the electronic device and the key-activated device, but also provides a high degree of identification of the transmission when the user must be presented to initiate a digital signature.

Other methods for safely transmitting the extracted access key are obvious to those skilled in the art.

Although in the described embodiment, the user is authorized exclusively in the portable access device, it is possible for the key-activated device to participate in this permission. More specifically, during registration, the registration computer may simply transmit the standard to a portable access device, rather than an indication of verification. In this case, when biometric data is entered into the access device, the verification code is returned, and this code is transmitted directly (in encrypted or unencrypted form) to the device activated by the key. The key-activated device can then transmit the code to a central database, which will use it to find if the code indicates a valid user. If so, the key-activated device will ask the access device to continue. Further, the device activated by the key will only respond to any key transmitted by the access device if the device activated by the key determines that the user is authorized.

In circumstances where the access device must transmit an indication of a trusted user, and the device activated by the key must respond with a temporary key, the indication of a trusted user is an appropriately (encrypted or unencrypted) recovered verification code and the request from the key-activated device is an appropriate temporary key.

Although device 14 is shown for use with fingerprint input means, any other user biometric data may be used in the same way. For example, access device 14 may scan the iris of a user's eye.

Since any biometric verification device will have a non-zero acceptance frequency, it is preferable that key-access devices 14 are programmed to terminate or transmit a warning code after a predetermined number of consecutive failed verification attempts by the user.

Other modifications will be apparent to those skilled in the art, and therefore, the invention is defined by the claims.

Claims (26)

1. A method of accessing key-activated devices, comprising the steps of: receive the identifier activated by the device key from the device activated by the key, accept biometric data determine whether said received biometric data is authorized biometric data, comparing said received identifier of a key-activated device with stored identifiers of a key-activated device, and if it matches a stored identifier of a key-activated device, and if said received biometric data is authorized biometric data, the stored access key associated with said matching stored identifier of a device-activated key is extracted, and transmitting said extracted access key. 2. The method of claim 1, further comprising the steps of: receiving a temporary key and encrypting said extracted access key with said temporary key before transmitting said extracted access key. 3. The method of claim 2, further comprising the step of: in response to determining that said received biometric data is authorized biometric data, an indication of a trusted user is first transmitted. 4. The method of claim 3, wherein said temporary key is received after transmitting said indication of a trusted user. 5. The method according to claim 3, wherein said transmission of an indication of a trusted user first depends on whether the stored identifier of the device key activated by the key matches the said received identifier of the device key activated. 6. The method according to any one of paragraphs. 2-5, in which each of said stored access keys is encrypted and includes performing an operation to decrypt the extracted access key before encrypting said extracted access key with said temporary key. 7. The method of claim 6, wherein each of said stored access keys is an encrypted special key and wherein said decryption operation comprises extracting a pattern and attempting to recover said special key from said pattern using said received biometric data. 8. The method according to any one of paragraphs. 1-5, further comprising the step of extracting the standard and attempting to restore a special key from said standard using the mentioned biometric data, said special key for use in performing a cryptographic operation. 9. The method of claim 8, wherein said cryptographic operation uses at least one of said access keys. 10. The method according to any one of paragraphs. 3-5, in which said transmission of an authentic user indication first depends on whether the stored identifier of the device-activated key matching the said received identifier of the device-activated key is found. 11. The method according to any one of paragraphs. 1-5, 7 or 9, wherein said step of determining whether said received biometric data is authorized biometric data, comprises the step of using a reference containing said authorized biometric data and a verification code, so that the presence of said biometric data allows the restoration of said verification code. 12. A portable electronic access device containing biometric data input means, verification means responsive to said biometric data input means for verifying that biometric data that is input into said biometric data input means corresponds to authorized biometric data and providing verification indications; a memory retaining a plurality of access keys, each intended for use in accessing a key-activated device, and a plurality of identifiers of key-activated devices, each associated with one of the plurality of access keys, a receiver for receiving an identifier activated by a device key, a comparator for comparison in response to the verification indication from said means for verifying the identifier of the key-activated device received from the key-activated device with said stored identifiers of the device-key activated and upon detection of a match with the stored identifier of the device-activated key, retrieving the stored access key associated with said matching stored the identifier activated by the device key, and transmitter for transmitting the extracted access key. 13. The apparatus of claim 12, wherein said stored access keys are encrypted and include a decryptor for decrypting the extracted access key before transmitting said access key with said transmitter. 14. The device according to p. 12, in which said memory is also intended to store a special key pattern, said access key being encrypted with a special key and said decryptor responds to said biometric input means to perform a special key recovery operation from said special key pattern using entered biometric data and the subsequent decryption operation on said extracted access key using the recovered special key until Tupa. 15. The device according to item 12, in which said memory is also designed to save the standard of a special key containing the aforementioned authorized biometric data and a special key, wherein said special key is intended for use when performing a cryptographic operation. 16. The device according to any one of paragraphs. 12-15, wherein said verifier is intended to access a stored reference containing said authorized biometric data and verification code, to attempt to recover said verification code from the entered biometric data, and to use said verification code to obtain said verification indication. 17. The device according to any one of paragraphs. 12-15, wherein said receiver is also adapted to receive a temporary key and includes an encryptor for encrypting said extracted access key with said temporary key before transmitting said extracted access key with said transmitter. 18. The device according to any one of paragraphs. 12-15, wherein said transmitter is also for transmitting, first, an indication of a trusted user in response to said verification step, providing said verification indication. 19. The device according to p. 17, in which said transmitter is also intended to transmit first an indication of a trusted user in response to the fact that said verifier provides said verification indication, while said temporary key is received after said transmitter has transmitted said indication of reliable user. 20. The device according to any one of paragraphs. 12-15, or 19, wherein said receiver is one of a radio receiver and an infrared receiver, and said transmitter is one of a radio transmitter and an infrared transmitter. 21. A secure access system comprising a key-activated device for periodically transmitting an identifier of a key-activated device, a portable access device comprising biometric data input means, a verifier responsive to said biometric data input means for verifying that the biometric data that is input into said biometric data input means matches authorized biometric data, and providing verification indications, a memory retaining a plurality of access keys, each intended for use in accessing a key-activated device, and a plurality of identifiers of key-activated devices, each associated with one of the plurality of access keys, a receiver for receiving said identifier activated by a device key, a comparator for, in response to the verification indication from said verifier, comparing the identifier of the key-activated device received from said key-activated device with said stored identifiers of the key activated by the device and, if matching, retrieving the access key associated with said matching stored identifier of the activated key of the device , and a transmitter for transmitting the extracted access key to said key-activated device. 22. The system of claim 21, wherein said receiver is configured to receive a temporary key, and wherein said access device includes an encryptor for encrypting said extracted access key with said temporary key before transmitting said extracted access key with said transmitter. 23. The system of claim 21, wherein said transmitter is also configured to first transmit a trusted user indication in response to said verifier providing said verification indication to said access device, and wherein said key-activated device is also adapted to respond to receiving said indication a trusted user by transmitting said temporary key. 24. The system according to any one of paragraphs. 21-23, in which said memory is also intended to store a pattern and in which said verifier is also intended to be used in an attempt to recover a special key from said pattern using said biometric data, said special key being intended for use in performing a cryptographic operation. 25. The system according to any one of paragraphs. 21-23, wherein said transmitter is a radio transmitter and said receiver is a radio receiver. 26. The system according to any one of paragraphs. 21-23, wherein said verifier is intended to access a stored reference containing said authorized biometric data and verification code, to attempt to recover said verification code from the entered biometric data, and to use said verification code to obtain said verification indication.

Images