CN1215428C - Equipment and method for providing access right to safety data or zone - Google Patents

Abstract

The present invention provides a device and a method for visiting safe data or regions, which comprises at least two safety data modules and a double-module reader, wherein the safety data modules contain the safety data and other kinds of information and belong to a specific safety scheme, and the double-module reader is used for reading the data and authority instructions contained in the safety data modules. The two safety data modules respectively comprise a starting module and an enquiry module which are communicated through the double-module reader. When the two safety data modules are members of the same safety scheme, the two safety data modules are allowed to carry out communication. A proposal is defined by a properly special encryption key which starts the communication and the data transmission between the two safety data modules belonging to the same scheme, and prohibits the communication and the data transmission between the two safety data modules belonging to different scheme.

Description

Be used to provide apparatus and method to the access right in secure data or zone

A kind of apparatus and method that are used to provide to the access right in secure data or zone are provided, a kind of like this apparatus and method that provide the access right in secure data or zone are provided, wherein control access secure data or safety zone by secure data module or the collaborative safety approach of card.

The method true and virtual characteristics of protection has recently become very complicated.With various forms be used in combination microprocessor, biometric data and advanced encryption technology, guarantee that access secure data and zone only are limited to and have legal those people that enter with access right so that take preventive measures.Unfortunately, some people usually makes these preventive measure invalid or inoperative.

Biometric data is brought a lot of problems as a reliable instruments of inspection.A lot of biometric system still rely on submits password or the PIN code evidence as personal identification to.Use password and PIN code to have weakness in such system, because password and PIN code are misapplied easily and forgotten.People forget password easily, just make by selecting password or PIN(Personal Identification Number) commonly used or deciphering easily, or password or PIN revealed to other people make it apparent.

When not preserve or a necessary assembly of system safe in utilization by strict regulations or in relatively carelessness mode, for example during password, complicated release mechanism is general easy to be damaged by mistake in the environment.For handling this problem, only need consider that people select or forget the mode of its password and PIN.

The further problem that password brought is that they are simple data item.As providing the method that conditional access has the safety equipment of safety classification, password has conspicuous shortcoming.In general, safety equipment require to comprise permissions data and control the memory space of the database in the storer of mainframe computer system of access database.

Needing access to be kept under the data conditions of " intelligence " card or other data storage devices, database must reside in card reader or be connected to other memory devices readers of computer system.The security vulnerabilities of these systems is apparent concerning the technician of computing machine and field of information system.

There are defective and deficiency although password uses, accept password and still be convenient to secure data is offered a large amount of and various individualities and other entities.Just in this point, be used to provide the password scheme of access data and security further to isolate, so that can consistance ground and with secured fashion password stored and other related datas with human factor.Also wish password scheme can be adapted to hold a large amount of hierarchic users and do not need to use a plurality of passwords or any password situation under the safety approach that requires of data access.

The preferred embodiments of the present invention are by providing more reliable and preventing that the security system of altering from solving the problem of prior art, and this system provides the authorize access in secure data and zone and prevents undelegated access to secure data and zone.

In addition, the preferred embodiments of the present invention provide a kind of improved data security and access control system, and this system does not need to use a plurality of passwords that are used for various operations and prevents and the collaborative relevant problem of conventional access card that is produced of using of password.

The preferred embodiments of the present invention solve the problem of prior art by a kind of apparatus and method are provided, this apparatus and method are used at least two secure data module that comprise secure data and other information and belong to a kind of particular safety scheme, and bimodulus piece reader that is used to read data that secure data module comprises and authority instruction provides the access right to secure data and zone.Two secure data module comprise that one starts module and an inquiry module.The startup module preferably includes at one of a plurality of media such as a data card (contact-type or non-contact type), a silicon or other suitable data storage devices and preferably is included in and is used to read in the modular reader of inquiry module.Similarly, can be with the form of data card or also can embody the inquiry module with the form of silicon or other suitable data storage devices.

The inquiry module intercoms through a bimodulus piece reader mutually with the startup module.As long as the member that two modules are same safety approach just allows the communication between the two.Transmit and forbid belonging to the suitable specific encryption key that communication between two modules of different schemes and data transmit and define a kind of scheme by being used to start communication between two modules that belong to a common scheme and data.

Starting that module preferably comprises can be encrypted and the data of definition authority.Determine that by being stored in the authority that starts the data definition in the module this module or card reader could carry out such as creating data, deleted data, reading of data, write data and the inquiry data that module comprised being carried out one or more in a plurality of data manipulations other various data manipulations, module or card reader are included in or are operatively coupled on the startup module of attempting with the inquiry module communication.

The inquiry module preferably includes application data card more than, this many application datas jig has any one in a plurality of different types of data, different types of data comprises such as finger print data, three dimensional face pictorial data, the personal identification data (PID) of retina scanning data and so on; Such as name, address, the personal information of marital status etc. and so on; Finance and Banking information; Personal medical information; Passport relevant information such as Visa and travel information; Insurance information and with the inquiry module user or any other relevant suitable information of holder.Preferably use the suitable data encryption key that belongs to the safety approach that requires to encrypt this data.

In a bimodulus piece reader device, start following the carrying out of communication between module and the inquiry module.Bimodulus piece reader device preferably includes an inquiry modular reader and a startup modular reader.Inquiry module physics is inserted into bimodulus piece reader or carries out contactless communication with bimodulus piece reader.Starting modular reader comprises the startup module or for example is operably connected to the startup module through a network connection.

At first, have " shaking hands " program, determine starting card and inquiry card by this program bimodulus piece reader could interface or communicate by letter.According to starting module and inquiring whether module belongs to the possibility of being determined interface by the same safety approach of encryption key definition.

After the initial handshake success, inquiry module and inquiry modular reader send inquiry to determine whether start module is authorized to the inquiry data that module was comprised are carried out data manipulation through starting modular reader to starting module.Different with prior art, not to determine to start module and start modular reader is carried out the data manipulation of being asked on the inquiry module ability, but with isolation method this is determined by starting the authority setting that module comprised according to the password input.Promptly, in response to through starting modular reader, start module and send a response to the inquiry module and whether have the data on the inquiry module are carried out the data operation permission to notify this reader to start module through starting modular reader from the inquiry that the inquiry module sends.

Do not have the due authority of the data on the inquiry module being carried out data manipulation if determine to start module, the response that then comes self-starting module for negate and do not allow data communication.

On the contrary, really have the due authority of the data on the inquiry module being carried out data manipulation if start module, then start module and start modular reader and send whether inquiry has the data manipulation that execution asked on this ad hoc querying module with the holder who determines the inquiry module due authority to the inquiry module.Whether the holder of inquiry module is authorized to use the inquiry module and carries out determining of data manipulation, preferably by inquire that individual biostatistics recognition data that module comprises mates next definite with bimodulus piece reader when attempting to carry out such communication from the individual biometric data of the resulting reality of holder of inquiry module.Storage and the coupling individual biometric data of reality can be suitable to the face image recognition system by one, palm or fingerprint scanner, or the biometric data collecting device of retina scanners or the collection of other biometric data and compare facilities and so on carries out.As a kind of replacement, the definite of the data manipulation whether holder of inquiry module is authorized to carry out on this card can also be undertaken by the password inquiry and the response exchange of routine.

After holder's the mandate of setting up the inquiry module, start modular reader and start module and will send request of data to the inquiry module and whether can be activated the module access with these data of determining to be contained in the inquiry module and require to carry out the data manipulation that inquiry module holder asked.That is, the data set of may not the access any specific data recording of specific startup module or any whole data recording does not allow to start such data recording of module access or data set because start the authority that module comprised.The inquiry module is by sending the request that inquiry responds self-starting module through starting modular reader to starting module, whether allows to start to determine to be stored in the authority that starts on the module that the module access asked is stored in data on the inquiry module.Start module and can be authorized to access responds the inquiry module from the data of the request msg of inquiry module inquiry by sending this startup module of indication.If start the necessary permissions data that module does not provide response inquiry form, inquire that then modular reader and inquiry module forbid that the data of being asked are activated module and start the modular reader access.

Preferably encrypt to embody and start the above-mentioned each inquiry and the response of communicating by letter between module and the inquiry module according to an encipherment scheme, wherein, this encipherment scheme is unique for specific safety approach, starts module and inquires that module all must belong to this safety approach so that communicating by letter each other.Each safety approach preferably has the unique identifier in the high statistical certainty.Start data communication between module and the inquiry module attempt in this unique scheme be used as a secret assembly to produce the session key before this specific communications trial.Inquiry and the response of specific communications between trial period uses unique session key to encrypt, thereby only allows to belong to this information of module decrypts of same scheme.

Set up safety approach through a controller module or card.Established originally when founding a safety approach, the programmable controller card makes it have the data and the authority of authorizing all data manipulations.These authorities are not general passwords, but are stored in the more complicated of secure data module and data structure flexibly.But each authority authorize access is stored in data set or data recording or other data manipulations on the secure data module.Further, each authority can be carried out with other secure data module or not hold consultation.

In a preferred embodiment of the invention, desired data manipulation group comprises:

1. initialization secure data module

2. establishment data set

3. deleted data group

4. establishment data recording

5. delete data record

6. reads data log

7. write data recording

8. change record attribute

Can as requested other data manipulations be increased to a particular safety scheme or therefrom deletion.

The encipherment scheme of realizing by a plurality of encryption keys of suitable desired use with this data storage to controller module.

With data storage after controller module, can the slave controller module obtain the module of the other types such as starting module and inquiry module.That is, controller module becomes it to start module authority is granted other modules or card by permissions data being write other modules.Permissions data also can the slave controller module or is started module and write the inquiry module.By this way, the authority classification group of data manipulation can be written to module.Yet, start module and can not grant another module than starting the more authority that module itself comprises.

According to a preferred embodiment of the present invention, can use suitable special software and conventional hardware to realize above-mentioned be used for the starting safety approach of above-mentioned data manipulation and any permissions data.That is, preferably realize and finish the data manipulation of being undertaken by a secure data module that comprises bimodulus piece reader through the software program of carrying out in suitable computing machine and CPU (central processing unit).

In a preferred embodiment of the invention, set up and the control safety approach by a CPU (central processing unit) (CPU), this CPU (central processing unit) is controlled the whole device of the access right in secure data or zone providing according to the present invention.Specifically, CPU preferably includes a ROM (read-only memory) equipment (ROM) and the random-access memory (ram) equipment that CPU and memory storage are operated necessary data and software that is connected to.This device preferably includes one and is convenient to signal post needs between the secure data module that the user imports two secure data module systems the data and the user input device of instruction.This device preferably also comprises a display device that shows to the video of user's generator mode of operation.ROM, RAM, user input device and display device are operably connected to CPU.

This device preferably also comprises an output device that is connected to CPU.This output device is preferably computer monitor or other suitable display forms or is the printing device that is used to show the device operation of being watched by the user.

This device comprises that also one is stored in such as ferroelectric RAM, the database in the DRAM, the CPU storer of flash memory and so on or other suitable memory devices.This database preferably includes necessary data and the information that comprises special software of device operation.

This device also comprises a two secure data module reader, and this pair secure data module reader comprises at least two two bimodulus piece readers that are used to read the data that secure data module comprised such as starting module and inquiry module.Two secure data module readers of two secure data module are connected to CPU.A reader preferably is suitable for reading the inquiry module, and another modular reader preferably is suitable for reading a startup module.

In the secure data module reader of bimodulus piece reader each all preferably includes a CPU (central processing unit) (CPU) that is used to control the corresponding module reader operation.This modular reader comprises also that preferably one is connected to reader CPU and by the data fetch equipment of its control, a transmitter that is used for data are sent to secure data module, this secure data module insert module reader, and a receiver that is used for receiving data from the secure data module of being inserted.Transmitter and receiver are connected to reader CPU.This modular reader comprises that also one is used to store the data of the software that comprises that reader CPU operation is required and the storer of information.

Secure data module can be the form of card.Such card comprises a CPU (central processing unit) (card CPU) that is used for the operation of control data card.This data card can also comprise that one is connected to card CPU and is used for data are sent to the receiver that the transmitter of corresponding secure data module or card reader and are used for receiving from corresponding secure data module or card reader data by the fetch equipment of its control, one.Transmitter and receiver are operably connected to card CPU.Data card can also comprise a storer that is used to store data and information such as FRAM, DRAM, SRAM, flash memory or other suitable memory devices.The secure data module of data card form is with module or the card reader co-operating with two secure data module readers of the mode that will be described below.

In the information of routine and other data systems, physics or virtual region various piece or local access are usually comprised a plurality of passwords of input.User with more special permissions will be required to show more password with access system.By using the general utility functions that start module, be easier to set up and operate the hierarchy of more complicated so that an almost unconfined scope of access right to be provided.

In a preferred embodiment of the invention, define all secure data module or card so that belong to one " scheme ".Has only the interior card of same scheme interface mutually.Can create new scheme from a clear data card by " the custodian's key " of introducing and store a plurality of definition, custodian's key is preferably the encipherment scheme data mode that is used to realize desired encipherment scheme.These keys are used for a clear data card is converted to controller card.Controller card comprises whole bundle of permissions, and controller card can be carried out any task on any other interior data card of same scheme like this.Can create the controller card of any number, as long as use same custodian's key and it is programmed with the key of same sequence input.Be encrypted in all information that transmit between the data card, make the data card that has only same scheme can understand information each other.

Apparatus and method of the present invention provide a plurality of level of securitys.Can select and programming scheme data card and/or secure data module make its objectionable intermingling by above-mentioned associated encryption program.Protect employed data set and data recording by its different identification.At last, data set and data recording have the feature of the particular data operation of forbidding carrying out thereon.That is, data set and data recording have and forbid carrying out such as deleted data thereon, write the attribute of one of data manipulations such as data, reading of data, establishment data.

The apparatus and method of the preferred embodiment of the present invention can also be used for network environment.In such network environment, this device or system comprise that a remote system with any proper number adds the server computer of network configuration.When network environment is used, server computer through a suitable communications network service in remote system.

The preferred embodiments of the present invention are suitable for comprising the system and the environment of any number in access secure data or zone.For example, the preferred embodiments of the present invention can be used for controlling system, individual or the network computer of access ATM (automatic teller machine) account, financial records, government records, country and international boundary, welfare system, drive recorder, medicine or hospital record, building entrance, sports events or are used to provide any system of access right to secure data or zone.

As shown in drawings, by following detailed description to the preferred embodiment of the present invention, these and other parts of the present invention, feature and advantage are with apparent.

Fig. 1 illustrates a preferred embodiment of the present invention with the block scheme form;

Fig. 2 illustrates the first secure data module reader of Fig. 1 device with the block scheme form;

Fig. 3 illustrates the second secure data module reader of Fig. 1 device with the block scheme form;

Fig. 4 illustrates in conjunction with employed first secure data module of Fig. 1 device with the block scheme form;

Fig. 5 illustrates in conjunction with employed second secure data module of Fig. 1 device with the block scheme form;

Fig. 6 illustrates the programming secure data module so that create the program of data card from blank card;

Fig. 7 illustrates and first embodiment of the invention is worked in coordination with the inquiry module of using and start the operation of carrying out between the module;

Fig. 8 illustrates and is used for passport, visa and travel document safety and control with the collaborative safety approach classification of using of another preferred embodiment of the present invention;

Fig. 9 illustrates another preferred embodiment of the present invention, and wherein device is used for network environment; With

Figure 10 illustrates the further preferred embodiment of the present invention, and wherein this device and ATM systematic collaboration use.

Fig. 1 illustrates a preferred embodiment of the present invention device with the block scheme form, and this device is by reference numerals 11 expressions.With reference to Fig. 1, the preferred embodiment device 1 comprises that provides the CPU (central processing unit) (CPU) 2 to the control of the operation of parts shown in Figure 1.CPU2 is preferably a microprocessor.Yet, be important to note that CPU2 can also be with a microcomputer, a microcomputer, a workstation or a mainframe computer are realized.

Device 1 preferably includes a ROM (read-only memory) (ROM) equipment 3 and the random-access memory (ram) equipment 4 that CPU2 and storage control and actuating unit operate necessary data and software that is operably connected to.Device 1 also comprises a user input device 5 of being convenient to user input data and order.Device 1 also comprises an output device that is preferably the form of display device 6, and display device 6 is used for providing the video of mode of operation to show to the user.ROM3, RAM4, user input device 5 and display device 6 are operably connected to CPU2.Device 1 comprises that also one comprises with device and operates the database 7 that relevant all must data.

Device 1 also comprises two secure data module reader DR that preferably include two secure data module or card reader 8 and 9.In preferred embodiment shown in Figure 1, first reader 8 is " noncontact " reader and second reader 9 " contact-type " reader preferably preferably.Contactless reader and contact-type reader and relevant noncontact and contact-type communication protocol are well-known, are not repeated in this description.

Card reader 8 and 9 preferably is operably connected to CPU 2 and by its control.Card reader 8 and 9 can be long-range interconnective independent reader or also can be the reader of integrated bimodulus piece reader unit DR.As will be described in detail below, card reader 8 preferably is suitable for reading " inquiry " module or card and card reader 9 is suitable for reading " startup " module or card.At the preferred embodiment of Fig. 1, inquiry modular reader 8 is public accessible readers and start card reader 9 and be in device operator or system manager's supervision and protection down.

Module or card reader 8 and 9 can also be combined as an independent physical housings to form whole cells D R.Card reader 8 as " noncontact " reader provides best common interface function (that is, be easy to use, exempt impurity, be tamper-proof).Module or card reader 9 preferably are arranged in safety (locking) encapsulation of housing.As the card reader 9 of " contact " reader provide be fixed for one determine during or the optimal mechanical of the startup module used is connected so that prevent the unnecessary motion that card reader is interior.

Be important to note that starting module can be included in the card reader 9 so that become wherein permanent parts.At such embodiment, start module and preferably be included in the suitable physical memory devices, for example be positioned at the silicon of card reader 9.Also important is notices that starting module and/or inquiry module can also be embodied as one and be operably connected to card reader 8 or 9 or the computer chip or the hardware cell of analog machine.

Preferably (that is, ISO7816) carry out and the communicating by letter of secure data module, no matter it is noncontact or contact-type according to world definition standard.Use these standards not only to be convenient to module or card but also be convenient to secure data module Technology Selection source.

Device 1 also comprises an output device 10 that is connected to CPU2.In the preferred embodiment of Fig. 1, output device 10 can comprise a printer that is used to obtain from the printed copy that installs 1 information that obtains.

Fig. 2 illustrates the block scheme of the preferred embodiment of secure data module card reader 8.Card reader 8 preferably includes a CPU (central processing unit) (reader CPU) 81 that is used for 8 operations of control card reader.Card reader 8 preferably also comprises " noncontact " fetch equipment 82 that is operably connected to CPU81 and is subjected to the routine of its control.Card reader 8 comprises also that preferably one is used for that data are sent to the transmitter 83 of the secure data module inserted or card and one and is used for the receiver 84 of receiving data from the secure data module inserted or clamping.Transmitter 83 and receiver 84 are operably connected to reader CPU81.Card reader 8 comprises that also is used to store software and relevant all data and the database of information 85 of application this data card of use that comprises operation sheet reader 8.Card reader 8 is suitable for first secure data module or blocks 50 and communicate by letter, and Fig. 1 also illustrates first secure data module or blocks 50.At the preferred embodiment of Fig. 1, card 50 is preferably an inquiry card.

Fig. 3 illustrates the block scheme of second reader 9 of two secure data module reader DR shown in Figure 1.Card reader 9 preferably includes a CPU (central processing unit) (reading CPU) 91 that is used for 9 operations of control card reader.Card reader 9 preferably also comprises " contact " fetch equipment 92 that is connected to reader CPU91 and is subjected to the routine of its control.Card reader 9 comprises that also one is used for that data are sent to the transmitter 93 of the data module inserted or card and one and is used for the receiver 94 of receiving data from the data module inserted or clamping.Transmitter 93 and receiver 94 are operably connected to reader CPU91.Card reader 9 comprises that also is used to store special software and relevant all data and the database of information 95 of application this data card of use that comprises card reader 9 operations.Card reader 9 preferably is suitable for second secure data module shown in Figure 1 or blocks 60 and communicate by letter.At the preferred embodiment of Fig. 1, card 50 is preferably one and starts module or card.

Fig. 4 illustrates secure data module or blocks the block scheme of 50 preferred embodiment.Data card 50 best and card reader 8 co-operatings.Data card 50 comprises a CPU (central processing unit) (card CPU) 51, and CPU (central processing unit) (card CPU) 51 is preferably microcontroller or other the suitable equipment that is used for 50 operations of control data card.Data card 50 preferably also comprises a noncontact fetch equipment 52 that is operably connected to CPU51 and is subjected to its control.Data card 50 also comprises the transmitter 53 and the receiver 54 that is used for receiving from card reader 8 data that are used for data are sent to card reader 8.Transmitter 53 and receiver 54 are operably connected to CPU51.Data card 50 also comprises the data and the database of information 55 that are used to store the software that comprises that control card 50 operations are required.

Fig. 5 illustrates secure data module or blocks the block scheme of 60 preferred embodiment.Data card 60 and card reader 9 co-operatings.Data card 60 preferably includes a CPU (central processing unit) (card CPU) 61, and CPU (central processing unit) (card CPU) 61 is preferably microcontroller or other the suitable equipment that is used for 60 operations of control data card.Data card 60 preferably also comprises a contact fetch equipment 62 that is connected to CPU61 and is subjected to its control.Data card 60 also comprises the transmitter 63 and the receiver 64 that is used for receiving from card reader 9 data that are used for data are sent to card reader 9.Transmitter 63 and receiver 64 are operably connected to CPU61.Data card 60 also comprises the data and the database of information 65 that are used to store the software that comprises that operation sheet or module 60 are required.

Although described at least one preferred embodiment of the present invention that utilizes the secure data card, be important to note that any suitable equipment or the object that can store data and/or information can use with the preferred embodiment of the present invention is collaborative.Such data card, equipment and/or object can be hereinafter referred to as " secure data module " or " SDM ".

Use the preferred embodiment of the present invention of structure shown in Fig. 1-5 that a kind of apparatus and method of controlling access secure data or zone preferably are provided, these apparatus and method are used and are comprised and start module and inquire module and the two secure data module system of relevant safety approach provides the degree of the uniqueness of security and dirigibility.

In the two secure data module system of the preferred embodiment of the present invention, secure data module 50 or 60 comprises the data that are defined as " mandate ", uses these data with the data that obtain other secure data module of access or card and comprise and carry out " authority " to its operation.These mandates are not typical passwords, but comparatively complicated and data structure flexibly, and this data structure is preferably each the set of encrypted data form that is used for allowing a plurality of data manipulations.These data structures and/or entity are defined as " authority ".

But each authority authorize access is stored in data set or data recording on secure data module or the card.Further, each authority can with or do not consult with another secure data module or card.Grant the secure data module of authority or card for starting module or card, this startups module or be stuck in essence and with regard to conventional sense, play " key " and act on so that open or allow a desired particular access or data manipulation.Secure data module when carrying out data manipulation is inquiry module or the card that relates to above.

Dingan County is region-wide really with the storer of data storage on such card for inquiry module or card.These safety zones have " locking " that is set or opens according to application requirements.These lockings are preferably set of encrypted data or data recording form, and this set of encrypted data or data recording are only by having each " key " or an authority access of decrypted code that suitably is used for opening locking data group or data recording.

In two secure data module schemes of the preferred embodiment of the present invention, only in two secure data module readers, can carry out the data manipulation that needs authority, wherein use to start module and inquiry module.In the data manipulation that does not need authority, independent module or card are just enough.When with automatically-controlled door or the collaborative use of vending machine, start in the hardware of the present device 1 of module body.By this way, start card only by maintainer's access.

Because authority is stored on secure data module or the card, can use the functional of data card to strengthen and to expand the ability of whole security system.Further, a startup card comprises an extent of competence, and this paper is defined as it " bundle of permissions " and the child group of its authority can be copied to other data cards of same approach.By this way, might be from starting other startup cards that card produces the authority combination with original startup card.A startup card generally has finishes an authority that application is required.Can use more powerful startup card creating the startup card of more weak function, so that the whole classification that can create such data card is to adapt to any security system.

In the conventional security system with the hierarchical approaches tissue, the various piece of access physics or virtual region need be imported a plurality of passwords.Like this, more privileged user is required to show plurality purpose password.Yet,, might set and operate very complicated hierarchy with comparalive ease so that an almost access right scope of indefinite is provided by using the general utility functions that start card.

In the preferred embodiments of the present invention, all secure data module of programming or card are to belong to one " scheme ".A scheme is the function that is defined as a plurality of keys of " custodian's key ", and custodian's key is preferably the data encryption key form.Have only the data card in the same approach to use.Can create new scheme from a clear data card by introducing and store a plurality of custodian's keys defined above thereon.Can also use these keys that a clear data card is converted to a controller card, this controller card comprises whole bundle of permissions, thereby can carry out the task on any other interior data card of same approach.Controller card even can impel blank card to become the member of the scheme of controller own prepares to receive authority or other data to become " the unprocessed data card " that starts card or inquiry card thereby create.

Can create the controller card of any number, but must use identical custodian's key programming and carry out with same sequence.Therefore all information that transmit between data card are encrypted, have only the data card of same approach to be appreciated that the information of other data cards.

The suitable special software that use is carried out on CPU2 also uses the two secure data module reader DR that comprise card reader 8 and card reader 9 to realize said system, startup card and the inquiry card of controller card.

Fig. 6 illustrates and uses device programming secure data module shown in Figure 1 or card so that create the program of controller card, unprocessed data card, startup card and inquiry card from blank card.

As shown in Figure 6, by use and management people key and application scheme identification in various combinations, the processing of data package or authority obtains various cards.

Specifically, the setting of a safety approach and whole security system is since a blank SDM that will become controller SDM.Create controller SDM by the information of use database 7 with through the input of input equipment 5 at the CPU2 executive routine.Come setting controller SDM by record security scheme or security at first thereon or custodian's key, security or custodian's key be preferably three and with the regulation journal that must repeat so that copy controller SDM.CPU2 preferably records blank SDM to create a controller SDM through card reader 9 with appropriate managerial people key data.Then, the highest weight of the data manipulation that will permit in particular safety scheme limit level is written to blank SDM to create controller SDM.

Obtain another secure data module, this module is preferably the card form shown in Fig. 3 or 4, and this module is unprocessed SDM.Write the safety approach that unprocessed SDM introduces unprocessed SDM controller SDM by the scheme of enciphered data and key form being discerned by controller SDM.Two secure data module reader DR through comprising card reader 8 and 9 finish this data and transmit.Because unprocessed SDM does not comprise any data, authority or safety approach identifying information are so controller SDM can write unprocessed SDM with any data.

If through the device that comprises card reader 8 shown in Figure 1 data set or data recording are recorded unprocessed SDM, then unprocessed SDM becomes inquiry SDM.Various authority records can be arrived inquiry SDM by controller SDM or by the startup SDM that slave controller SDM creates.

If write down authority on unprocessed SDM, and not record data group or record, then unprocessed SDM becomes and is used to create other and starts SDM or permission or record authority and start SDM to of inquiry SDM.Use comprises that two secure data module reader DR of card reader 8 and 9 can also carry out this data manipulation.

In the above described manner and use structure shown in Fig. 1-5, can create and realize the secure data transmission system of a complete classification with the form of two secure data module schemes, this scheme comprises a data manipulation between the secure data module that only allows to belong to a common security scheme and communicates by letter.

The apparatus and method of the preferred embodiment of the present invention are used two kinds of dissimilar authorities.Each authority is by the proper data definition that is stored on the secure data module.A kind of permission type is for carrying out the data operation permission.Another kind of permission type is carried out the authority of predefine task for authorizing other data cards.About permission type the preceding, concrete data storage areas on data permission and the data card and the concrete operations of carrying out thereon are relevant.These data areas are defined as " data set " and generally represent the clear and definite type of information, personal data for example, medical history etc.The data set of data card can be for that separate and irrelevant and can be by independent control of authority with other predefined data groups.

Preferably existing can be in eight kinds clear and definite " authority " of at least one preferred embodiment use of the present invention.These eight authorities are:

1. log-on data card and/or secure data module (SDM)

2. establishment data set

3. deleted data group

4. establishment data recording

5. delete data record

6. reads data log

7. write data recording

8. change record attribute

Data permission itself directly relates to 8 kinds of operations can carrying out the data of data block card, thereby defines the environment of delegatable any or all of operation.This method provides the dirigibility and the accuracy of the distribution of control data operation permission.

Another kind of permission type with authority is granted another card make its become one start block relevant.Once more, the authority permission relates to concrete data manipulation.Yet authority itself can be sent to the inquiry card.Be important to note that starting card can not block to another comprise the permission grant that authority Duos than itself.

By in concrete data set, writing down the further improvement that the data designated record attribute provides safety approach based on recording.In the preferred embodiments of the present invention, an attribute can be assigned to each order that can operate on data.These record level authorities make relevant data access function invalid or effective effectively.By this way, might be in having the data set that write permission enables the write-protect data.Just in this point, although authority can act on whole data set, each record can have to be selected and the unilaterally invalid function that acts on itself.

Can replace the key of the set of encrypted data form that is stored on the data card with rule at interval at the data card life period.Start cycle service time that card can have a qualification.Therefore, the startup card is just invalid after changing key.This is used to stop people to attempt key on the recognition data card, because changed this key before suitably discerning and deciphering.

Start card and can keep the key of being stored, therefore start the application function that card can be carried out any requirement.No matter when the inquiry card meets with the access situation of qualification, can require to inquire that clamping receives key.Then, the corresponding card that starts can be sent to the inquiry card with a suitable authority through the conversion of the encryption between two data cards, so that grant the described data of its access.

Fig. 7 illustrates and starts module according to the preferred embodiment of the invention and inquire communicating by letter between the module.Should be noted that the startup module shown in Fig. 7 and inquire that communicating by letter between the module carried out and control by CPU in comprising two secure data module reader DR of card reader 8 and 9 through suitable software.

Specifically, inquiry module 50 physics are inserted into the card reader 8 of bimodulus piece reader DR or carry out contactless communication with card reader 8.Starting module card reader 9 comprises startup module 60 or for example is operably connected to startup module 60 through a network connection.

At first, there is " a shaking hands " program, determines to start module 60 and inquire that module 50 could interface or communicate by letter by this program bimodulus piece reader DR by CPU2 control.According to starting module 60 and inquiring whether module 50 belongs to the identical safety approach that is defined by the encryption key that is stored in module 50,60 and determine interface capability.

After initial handshake success, inquiry module 50 and inquiry module card reader 8 send inquiry and whether are authorized to carry out the data manipulation (being preferably one of above-mentioned 8 kinds of data manipulations) that data that inquiry module 50 is comprised are carried out to determine to start module 60 to starting module 60 through starting module card reader 9.Not as prior art, determine startup module 60 and start module card reader 9 to carry out the ability of the data manipulation of being asked according to the password of input, but determine in the mode of isolating by the bundle of permissions that startup module 60 comprises in inquiry module 50.Promptly, response is through starting the inquiry that module card reader 8 sends from inquiry module 50, start module 60 and send a response to inquiry module card reader 8, whether have the authority announcement card reader 8 of carrying out the data manipulation on the inquiry module data starting module 60 through starting module card reader 9.

If definite module 60 that starts does not have the due authority of carrying out the data manipulation on the inquiry module data, the response that then comes self-starting module 60 is negative and does not allow to carry out data communication.

On the contrary, really has the due authority of carrying out the data manipulation of being asked on the inquiry module data if start module 60, then start module 60 and start module card reader 9 and send inquiry, determine whether the holder of inquiry module 50 has suitable mandate to carry out the data manipulation of being asked on this ad hoc querying module to inquiry module 50.Whether the holder of inquiry module 50 is authorized to use inquiry module 50 and carries out determining of data manipulation, preferably mates to come definite by individual biostatistics recognition data and the bimodulus piece reader DR when attempting to carry out such communication that will be included on the inquiry module from the actual individual biometric data that the holder of inquiry module 50 obtains.This coupling of the individual biometric data of storage and reality is carried out through a suitable biometric data collecting device, the face image recognition system that for example two secure data module reader DR provide, palm or fingerprint scanner, retina scanners or other suitable biometric data are collected and compare facilities.As a kind of replacement, whether the holder of inquiry module 50 has determining and can also carrying out through the password inquiry and the response transform of a routine of the mandate of carrying out the data manipulation on this card, and the password of routine is inquired about and response transform is undertaken by input equipment 5 and output device 10 or display 6.

After the holder's who sets up inquiry module 50 mandate, start module card reader 9 and start module 60 and will send request of data, to determine data that inquiry module 50 comprises and whether can be by the access of startup module by the data of data manipulation needs of holder's request of inquiry module 50 to inquiry module 50.Promptly, the whole data set of any specific data recording or any data recording cannot be by specific startup module 60 accesses because start authority that module 60 comprises do not allow to start module 60 accesses such be stored in data recording or data set on the inquiry module 60.Inquiry module 50 is by sending inquiry and whether allow to start module 60 accesses and be stored in the inquiry that request msg on the inquiry module 50 responds self-starting module 60 to determine to be stored in the authority that starts on the module 60 to starting module 60 through starting module card reader 9.Starting module 60 starts module 60 and is authorized to access and responds inquiry from inquiry module 50 from the permissions data of the request msg of inquiry module 50 by sending indication.

Do not provide necessary permissions data with response inquiry form if start module 60, inquiry module card reader 8 and inquiry module 50 prevent to start module 60 and start the data that 9 accesses of module card reader are asked.

Preferably encrypt according to encipherment scheme and embody above-mentioned each inquiry and the response that starts communication between module 60 and the inquiry module 50, this encipherment scheme is unique so that intercommunication mutually for starting module 60 with the specific safety approach that inquiry module 50 must belong to.Preferably each safety approach has in higher statistics certainty factor and to be unique identifier.In the communication trial that starts between module 50 and the inquiry module 60, this unique scheme is used as a secret assembly to produce the former session key that this specific communications is attempted.Inquiry and the response of specific communications between trial period uses unique session key to encrypt, thereby only allows to belong to this information of module decrypts of same scheme.

Compare with the system and method based on password of routine, the apparatus and method of the preferred embodiment of the present invention provide a kind of application function flexibly and need effectively and the efficiently system and method, particularly conventional system of minimal-overhead and method to comprise to use a plurality of passwords.

The method that importantly also is appreciated that deciphering inquiry and response requires all data cards in the specified scheme to communicate with identical communication mode and language.In this mode, from the secure data module of other or uncorrelated scheme or card will be identified as " uncorrelated " block and be rejected access with from the secure data module of other schemes or communicating by letter of card.

The apparatus and method of the preferred embodiment of the present invention provide the highest level of security safety.Can select and programme the secure data module that belongs to a particular safety scheme or card so that make its objectionable intermingling by its encipheror.The inquiry with operation response during protect employed data set by its different identification.At last, data recording has a feature or a plurality of feature of forbidding the operation that can carry out thereon.

Importantly also be appreciated that and distinguish invalid command.If the publisher of data card wishes classified document name and size, then can use these characteristics to eliminate directory command.In addition, the communication protocol of any scheme can also change.By this way, a scheme can be used a standard asynchronous agreement, and another scheme can be used a bit load cycle coding strategy.This not only allows the adaptability of card in a big way different readers, and another security feature is provided indirectly.At last, although keep complete compatibility to ISO7816 port-3, the present invention also allows the transmission greater than the data block of 256 bytes, thereby various advantages are being provided aspect simplicity and the operating speed.

For the method and apparatus of the described the preferred embodiments of the present invention of reference Fig. 1-7, there are a lot of different application and uses.

At a preferred embodiment of the application of apparatus of the present invention and method, provide a kind of travelling and immigration control system of novelty.Fig. 8 illustrates the system of a preferred embodiment, wherein the present invention is used for management and monitoring passport, visa and other travel documents.

Control of this embodiment system and travelling, people are in the immigration on airport, the data security that the office that applies for passport etc. are relevant.Hope is such as the airport, border and immigration Control work personnel, and the office worker that police etc.s and so on are responsible for the various tissues of safety and immigration control grasps one or more secure data module or the card that blocks for starting.Wish tourist or various combination services user, that is, the public grasps a secure data module into the inquiry card.

By the data on the inquiry card that the startup card of organizing the employee to hold is used to write, access and management are held by public member.These inquiry cards can join passport, visa, boarding card, luggage tag or other travel documents, and generally comprise and corresponding individual's travelling and live relevant explanation and permission.The scope of safety approach preferably include current passport, visa or other travel documents at a particular country management and control in related all personnel and administrative body.This scheme preferably also adds all the travelling residents of this country and the people of those passports at this particular country, visa, travel document or the work of inhabitation permitting mechanism.

For constituting such travelling and immigration controlling schemes, must determine to be stored in various data sets on the individual inquiry card of travelling and the Permission Levels related on definite startup card that uses and be stored in administrative body or tissue with data set.Can pass through to use startup card or the controller card or the new data set and the authority related of card increase of higher level at any time with it.The additional data group can be increased to the scheme of using and/or expanding in the future.

Immigration and travelling embodiment at Fig. 8 preferably use and are expressed as data set A, B, and four data sets of C and D come operating system.Data set A preferably comprises photo or other biological statistical data and other personally identifiable informations of inquiry card holder's a stored digital.Data set B preferably includes the data relevant with passport and comprise the information of the current printing form that finds on general passport and/or other travel document.These data can be stored in the microcontroller storer that blocks shown in the Figure 4 and 5 with encrypted form.

Data set C will comprise visa information and it will be stored in application and participate on individual's the card of visa associated rights of this scheme country.Data set D is preferably as the storage area of the information that can store note and/or be provided by each administrative body that participates in this scheme or country.

The number of data set, whether content and arrangement will and be passport or specific inquiry card of visa purpose configuration based on specific application and scheme.

As shown in Figure 8, the startup card that can have less authority to post issue is convenient to change personal data thus so that data set A is only read and write in the post office.Consulate, and other foreign mechanisms can read and write data set A and C by permission, therefore can issue visa to it.

Government functionary at place of entry such as airport and harbour or harbour should have reading of data group A, B and C, and write the ability of data set D.For example, can use to be used to write down date of arrival in country and number of times the data set D of departure ground or any other relevant information.

The startup cartoon is crossed the scheme identifier and is only responded the work that the function that relates to inquiry own has made things convenient for corresponding government functionary.Therefore, owing to, can use a lot of other cards from different tissues only by specific scheme inquiry of a relevant card response.By this way, can reduce processing time and program.Can still not receive mandate and the permission that writes to providing mandate with all data sets of access such as police or the so safe government functionary of customs officer yet.

Managing the tissue of the concurrent line control unit card of this scheme, is a department of country at this embodiment for example, need have the ability of creating all scheme data cards.In addition, the suitable data set that use is created and stored thereon can be created the clear data card and be introduced in the scheme.Then these data cards are delivered to relevant passport or visa department.The correct combination of each department privilege is created and is started card in can using-system.

The country that implements a scheme only needs exchange to start card so that allow foreign country to read its passport, visa and other travel documents.

Should be noted that preferably to use and finish safety approach and the system that transmits and realize Fig. 8 with reference to the described data communication of Fig. 8 and data with reference to the described method and apparatus of Fig. 1-7.

At a preferred embodiment more of the present invention, can use the necessity that keeps a plurality of startup cards more than one safety approach with minimizing.

In scheme hierarchical data base shown in Figure 8, this database is preferably created and is stored within it by CPU2 and controlled by it, and each in a plurality of countries is represented by corresponding data sets.For realizing any one country of visit, can require the user to have the input visa of outside authority form.In case granted, the user just can be at this country's travelling and its corresponding data set of access.Yet if the user wishes to realize concrete data recording of access, he or she may find that this data recording can not access.Just in this point, the authority that only has this country's data set can not be granted each interior data recording of this data set of access.If but this data recording non-locking and/or show as access, then the user will obtain entering all parts automatically.

Preferably according to the description of Fig. 7 and use the parts shown in above-mentioned Fig. 1-7 to realize the operation of security system shown in Figure 8.

Although as autonomous system of operation, described the preferred embodiments of the present invention, be important to note that the apparatus and method that to use the preferred embodiment of the present invention a network environment.Fig. 9 illustrates another preferred embodiment of the present invention, wherein uses this device a network environment.The device of Fig. 9 or system are by reference numerals 100 expressions.

At Fig. 9, system 100 comprises a server computer 110, and server computer 110 is served the autonomous system with any number of its apart from each other.System 100 also comprises at least one device 120 than far orientation.With reference to Fig. 9, device 120 comprises that one provides installing the CPU (central processing unit) (CPU) 122 of 120 control.Be preferably a microprocessor at this Embodiment C PU122.Yet, be important to note that CPU122 can also be by small-size computer, microcomputer, workstation or mainframe computer are realized.

Similar with Fig. 1 device, device 120 also comprises a ROM (read-only memory) (ROM) equipment 123 and random-access memory (ram) equipment 124 that is connected to CPU122 and the necessary data of memory storage 120 operations.Device 120 also comprises a user input device 125 of being convenient to import data and/or order.A display device 126 that provides the video of mode of operation and data to show to the user preferably also is provided device 120.ROM123, RAM124, user input device 125 and display device 126 are operably connected to CPU122.Device 120 comprises that also is included in necessary all related datas of system operation and/or the database of information 127 that CPU122 goes up the special software of carrying out.

The system 100 of the preferred embodiment of Fig. 9 also comprises a card reader 128.Card reader 128 is operably connected to CPU122 and by its control.Card reader 128 preferably is suitable for reading the inquiry card.In the preferred embodiment, card reader 128 is preferably public accessible card reader.Card reader 128 is " noncontact " card reader preferably, thereby the common interface an of the best is provided.The device 120 of system 100 can also comprise that one is connected to CPU122 and is preferably an output device 129 that is used to obtain from the printer of the printed copy of the information of device 120 at this embodiment.

In Fig. 9, server computer 110 comprises that provides the CPU (central processing unit) (CPU) 112 to the control of server 110.In the preferred embodiment, CPU112 is a microprocessor.Yet, be important to note that CPU112 can also be by small-size computer, microcomputer, workstation or mainframe computer are realized.

Server 110 also comprises a ROM (read-only memory) (ROM) equipment 113 and the random-access memory (ram) equipment 114 that are connected to CPU112 and the necessary data of storage system operation.Server 110 also comprises a user input device 115 of being convenient to import data and/or order.Server 110 preferably also comprises a display device 116, and being used for provides the video of mode of operation to show to the user.ROM113, RAM114, user input device 115 and display device 116 are operably connected to CPU112.Server 110 also comprises a database 117 that comprises necessary all relevant informations of system's 100 operations of the required special software of executable operations thereon.

At preferred embodiment, server 110 also comprises a card reader 118.Card reader 118 is operably connected to CPU112 and by its control.Card reader 128 is suitable for reading starting and blocks.Also be appreciated that importantly starting module or card can be with the data that for example are stored in silicon memory equipment so that permanent fixation the form here resides in the card reader 118.Importantly also be appreciated that and start computer chip or the unit that card can also be embodied as and be connected to (rigid line is connected to and/or is welded to) card reader or analog machine.

Server 110 also comprises an output device 119, this equipment be connected to CPU112 and, be preferably a printer that is used to obtain from the printed copy of the information of server 110 in this embodiment.

In the device of Fig. 9, can send to server 110 through installing 120 CPU122 from the data of card reader 128 and information.Similarly, data and information, and order can be from server 110, particularly CPU112 is sent to device 120, particularly CPU122, therefore server can send data and/or information, and orders CPU122, thereby implements the control to card reader 128 and device 120.

Under the network environment of Fig. 9, though be in remote location, system 120 is to work with the device 1 similar mode of Fig. 1.By this way, have the system 100 of the integrated data store of data and/or information, can serve from remote location and through the remote-control device of any number of a suitable communication network.Just in this point, for example, system 100 can and use a central database of locating with device 120 apart from each others to discern and confirms data and/or information by access.

Network that can operative installations 100 can be a Local Area Network or wide area network (WAN).The network of Fig. 9 can be realized by any suitable communication network and/or system.

As easy understanding, the system 100 of Fig. 9 can realize in the mode identical with the described system of Fig. 1.Yet access data and authority and data manipulation and communication can be carried out through the performed local data's communication of the network between remote-control device 120 and the server 110 rather than Fig. 1 system.

Implement device 1 and network system 100 in many ways are to provide access secure data and/or information and/or to forbid unauthorized access data and/or information.An alternative embodiment, can or install 100 at an automatic vending machine (ATM) system using system 1 so that safe financial transaction to be provided.

Figure 10 illustrates another preferred embodiment of the present invention, wherein at an automatic vending machine (ATM) system using system 200.Be important to note that device 1 can use with the ATM systematic collaboration.In Figure 10, the server 110 of Fig. 9 is replaced by bank's central processing computer 210.Further, the server 120 of Fig. 9 is replaced by an ATM 220.Inquiry card 50 is realized by individual's bank card or atm card.As shown in figure 10, device 200 also comprises by the same tag numeral and illustrating and all parts of the system 100 of Fig. 9 of mark.System 200 is to realize with the device 100 described modes that combine Fig. 9, so that secure access bank and accounts of finance are provided.

Be important to note that the scheme that is proposed is to being stored in the data characteristics indefinite of data card.Capacity is only limited by the current techniques state.Can use to well known to a person skilled in the art data compression technique, so that increase the memory capacity of data card.Under the situation of using data compression, data can decompress as required.Data can be word-for-word, or otherwise store data card into.

Face-to-face local environment-identification in routine also can use the present invention.The present invention can also be used for the long-distance user and discern application.Can there be a potential application of the present invention in long-distance user's identification in a network, and wherein a large amount of inquiry cards are common to use a few to start card.

In case file is authorized to, the device that then can use the preferred embodiment of the present invention is so that storage and definite information of holding the individual relating to persons of inquiring card.This information can comprise a password or such as, finger print data for example, retina scanning data, the biometric data form of photo etc. and so on.Can also use the present invention to prevent to forge or misapply file.

The apparatus and method of the preferred embodiment of the present invention provide lot of advantages to the data card solution designers.These advantages comprise tight security and the actual ability that customizes each aspect of a scheme from management level to the bit communications level.

The apparatus and method of the preferred embodiment of the present invention can be actually used in data and/or the information utilized, and are created any application of a secure access environment by application characteristic.Just in this point, the present invention can be used for comprising passport management and monitoring, identification card and application thereof, visa and/or driving license management and/or monitoring, car steering record management, arrival record and management thereof, and in conjunction with DDS, medical card, the application of bank and financial records and management thereof and monitoring.In fact, the present invention can be used for any application, wherein keep or to keep permanent individual visual, or not visible record, data and/or information.

Although described and shown the present invention in various preferred and alternative embodiments, these descriptions and represent it only is to explanation of the present invention can not be interpreted as limitation of the invention.Just in this point, the present invention only comprises all changes in the scope of the invention that is limited by the following claim book, modification and/or alternative embodiment.

Claims (11)

1, a kind of device that is used for the access security data comprises:

Central processor equipment CPD is used to control the operation of described device;

Be connected to first equipment of described CPD, be used for starting secure data module SDM from one and receive first information data set, described first data set comprises at least one decruption key; With

Be connected to second equipment of described CPD, be used for receiving the second information data group from an inquiry SDM, described second data set comprises described inquiry SDM holder's encryption biometric data;

Wherein said central processor equipment is controlled the operation of described first data receiver and described second data receiver; Wherein said CPD provides to the inquiry of described startup SDM so that from mandate of described startup SDM request with the described second information data group of access from described inquiry SDM; And wherein said startup SDM is provided for deciphering described at least one decruption key of described encryption biometric data.

2, device as claimed in claim 1 further comprises:

The contact communicator is used to connect described startup SDM and described first data receiver.

3, device as claimed in claim 1 further comprises:

Non-contact communication device, described inquiry SDM and described second data receiver are used to be coupled.

4, device as claimed in claim 1 is wherein organized described first information data set with hierarchical approaches.

5, device as claimed in claim 1, wherein said inquiry SDM is embodied in the data card.

6, device as claimed in claim 5, wherein said second data receiver are a card reader.

7, device as claimed in claim 1 wherein further comprises:

The data input device relevant with described central processor equipment; With

The data output apparatus relevant with described central processor equipment.

8, device as claimed in claim 1 further comprises:

The display device relevant with described central processor equipment.

9, device as claimed in claim 1, wherein:

The described second information data group is organized with hierarchical approaches.

10, device as claimed in claim 1, wherein:

Described startup SDM is embodied in the data card.

11, device as claimed in claim 1, wherein:

Described first data receiver is a card reader.

Images