DE102021205118A1 - Computer-implemented method and computing device for generating at least one cryptographic key - Google Patents

Abstract

The invention relates to a computer-implemented method for generating at least one cryptographic key for use in a cryptographic encryption method, the at least one cryptographic key being generated using a seed using a generation function, the seed being generated from at least one biometric feature of a user, so that using of the biometric feature, the starting value for one user can be clearly reproduced. The invention also relates to a biometric recognition module.

Description

The invention relates to a computer-implemented method and a computing device for generating at least one cryptographic key for use in a cryptographic encryption method, the at least one cryptographic key being generated using a seed value using a generation function. Furthermore, the invention relates to a biometric recognition module.

It is known to use public and private keys when encrypting messages. Such a key pair is called an asymmetric key pair or asymmetric encryption. In these systems, it is computationally infeasible to create the private key from the public key. This allows the public key to be disclosed without jeopardizing the security of the encryption. Such a key pair is used for distributed systems such as a blockchain. Also known as a public ledger, a blockchain is a technology for preventing hacking that can occur when dealing with virtual currency (cryptocurrency) transactions. Furthermore, such a blockchain can also be used to record data.

With the help of the private key, access to the “blockchain”, i.e. to a cryptocurrency stored there, for example, is possible. The private key represents the password for your own cryptocurrency. Such a private key is usually stored in a wallet (digital purse), for example in such a way that it can only be viewed by the user.

In this way, it is only possible for the user to actually carry out payment transactions.

Since the cryptocurrency can only be accessed through the wallet or the private key, the user alone is responsible for its security.

The user must protect the wallet from attacks. If the key (or the key pairs) and/or the "wallet" has been deleted, it is no longer possible to access the blockchain.

It is not possible to regenerate the private key/wallet; i.e. H. if the private key has been deleted; so the key is inevitably lost; and thus also access to the "blockchain" (cryptocurrency). This is because only random numbers are used to generate the private key (key pair).

Cases are known in which several million cryptocurrencies have been lost in this way.

the DE 10 2010 011 657 A1 discloses a device for providing at least one secure cryptographic key for the execution of a cryptographic security function by a control unit, which requests a cryptographic key for this purpose, a configured key provided for the security function being read from a first configuration memory and being checked using the configured key read out, whether a secure replacement key associated with the read out configured key is stored in a second configuration memory, which is provided to the control unit instead of the configured key for the execution of the safety function.

It is therefore an object of the invention to specify means which, on the one hand, solve a secure generation of at least one cryptographic key for use in a cryptographic encryption method and, on the other hand, solve the above-mentioned problem.

The object is achieved by a computer-implemented method having the features of claim 1, and a computer device having the features of claim 7. The object is also achieved by a biometric recognition module having the features of claim 15.

The object is achieved by a computer-implemented method for generating at least one cryptographic key for use in a cryptographic encryption method, the at least one cryptographic key being generated using a seed value using a generation function, and
wherein the starting value is generated from at least one biometric feature of a user, so that the starting value for the one user can be clearly reproduced using the biometric feature.

It has been recognized that the keys, in particular the private key or the key pair, are generated in a cryptographic encryption method using a mathematical function on a so-called seed, ie an initial value. The cryptographic key can be derived or generated from the starting value, which is stored in a wallet, for example. That is, it was recognized according to the invention that the starting value is the source for cryptographic keys. With the same "seed", the same cryptographic key is generated.

By generating the seed, i.e. the starting value, from a biometric feature, a user (personal)-bound secure starting value is generated. The at least one biometric feature can be embodied, for example, as a fingerprint, voice (speech pattern and voice recognition) and/or hand-face recognition and/or iris or pure imaging and/or typing behavior. A single biometric feature as well as a combination thereof can also be included, as well as a first biometric feature which is verified by a second one.

The at least one biometric feature is suitably recorded.

The at least one recorded biometric feature is converted into a starting value. The starting value is thus based on the characteristic features of the user or their biometric feature.

By using the biometric feature, a secure starting value and thus, for example, a secure private key is generated. If, for example, a fingerprint is used as a biometric feature, the various patterns such as loops, arcs, whorls, for example in connection with the interruptions in the papillary ridges (minutiae), differ from finger to finger, and a starting value can be generated from this. As a result, according to the invention, a secure start value that is unique to the user and a secure cryptographic key can be generated from this secure, unique start value. Thus, according to the invention, a one-to-one secure cryptographic key linked to the user is generated. In the case of a fingerprint, the starting value can be a binary code, for example, which can be represented by the minutiae.

The invention now makes it possible to reproduce the start value and thus the cryptographic key uniquely and securely. A reproducible cryptographic key is thus generated by the invention. If one loses the cryptographic key, for example the entire wallet, secure access to the cryptographic system is still possible using the invention. For example, if the user is in possession of cryptocurrency stored on a blockchain, this is not lost if the wallet/private key is lost and it was not stored elsewhere. The invention allows a new cryptographic key to be generated securely, for example to access the blockchain. It is therefore no longer necessary to save the private key or the starting value or even to put it in writing.

By using a biometric feature, the initial value and the cryptographic key can be reproduced in a personalized manner. This at least reduces misuse by third parties. In addition, even if the key is lost, especially the private key, the blockchain or the system that is based on the cryptographic process can still be accessed. A loss of cryptocurrency, for example, due to the loss of the wallet / key is therefore excluded.

Above all, the various embodiments of the invention are described in more detail below using a blockchain. However, the various embodiments are not limited to such a distributed system, but rather can be used where cryptographic methods using a key or key pair are used.

The unique start value is preferably generated by means of a generation function which is linked to the at least one biometric feature.

The generation function is preferably stored or, for example, assembled at random and linked to the user. The generation function can be a calculation rule, for example. However, the at least one biometric feature can also be analyzed according to a predetermined calculation rule and a starting value can be generated therefrom.

In a further embodiment, the at least one generated cryptographic key is stored in a wallet. The wallet can be an electronic wallet, for example an electronic file on a computer. This storage can be particularly secure. When used in a blockchain system, the wallet or cryptographic key refers to the public address in the blockchain where the cryptocurrency is (is stored).

In a further preferred embodiment, the cryptographic key is designed for single use.

Furthermore, the at least one cryptographic key is preferably discarded after it has been used once. In particular, the at least one cryptographic key from the wallet turned off. This allows for an additional increase in security. If the key is required, for example to carry out a transaction on a blockchain/distributed system, it can be generated from the initial value, which is generated using the user's biometric feature.

Two keys are preferably generated, the keys belonging to an asymmetric encryption method. One key is the so-called private key and the other key is the public key. It is practically impossible to calculate the private key from the public key.

Furthermore, the object is achieved by a computer device for generating at least one cryptographic key for use in a cryptographic encryption method, comprising a generator which is designed to generate the at least one cryptographic key using a generation function applied to a start value,
wherein the computer device is designed to record at least one biometric feature of a user and wherein the generator is also designed to generate the starting value from the at least one recorded biometric feature of the user, so that the starting value for one user can be clearly reproduced.

A generator is any system that can generate a starting value from a biometric feature. This can be a processor, for example, or software/programs that are stored on a processor.

The computer device according to the invention thus generates a reproducible cryptographic key using a personalized, reproducible start value. The computer device according to the invention now makes it possible to reproduce the start value and thus the cryptographic key unambiguously and securely. The advantages of the method can also be transferred to the computing device.

Furthermore, the generator has a generation function coupled to the one biometric feature, the generator being designed to generate the unique start value by means of the generation function. The generation function can be a calculation rule, for example. However, the at least one biometric feature can also be analyzed (and extracted according to features) according to a predetermined calculation rule, and a starting value can be generated therefrom.

The generator is preferably designed to store the at least one generated cryptographic key in a wallet. A wallet can be a file, for example. With such a wallet, the key can be kept safe.

In a further refinement, the generator is designed to configure the at least one generated cryptographic key for single use.

In particular, the generator is designed to delete the at least one cryptographic key from the wallet after it has been used once.

In particular, the at least one cryptographic key is thus deleted from the wallet. This enables an additional increase in security.

Furthermore, the generator is designed to generate two keys which are intended for use in an asymmetric encryption method.

In a further refinement, the generator is designed as a biometric recognition module, the biometric recognition module being designed to record the at least one biometric feature and to generate the start value from the at least one biometric feature and the at least one cryptographic key from the start value. The biometric recognition module can in particular be a fingerprint sensor, which extracts features from the recorded fingerprint and converts them into a starting value. The biometric recognition module can also be a sensor, for example a camera, if the at least one biometric feature is face recognition, or a keyboard if the at least one biometric feature is designed as a typing behavior. A sensor array for detecting a plurality of biometric features can also be designed as a biometric recognition module.

The generator can also have a biometric recognition module for detecting the biometric feature. This can be coupled to the generator in order to transmit the identified biometric feature to it. The biometric recognition module can also determine the starting value and the cryptographic key can be calculated in the generator. A generator can therefore also consist of several software elements/software and hardware elements.

The object is also achieved by a biometric recognition module for generating at least one cryptographic key for use in a cryptographic encryption method, the biometric recognition module being designed to record at least one biometric feature of a user, the biometric recognition module being designed to use the at least one biometric Feature to generate a seed and wherein the biometric recognition module is further configured to generate at least one cryptographic key using a generation function applied to the seed, so that the seed and the cryptographic key for a user is uniquely reproducible.

Such a biometric recognition module can be, for example, a fingerprint sensor and/or a video camera and/or a microphone, which is designed to record and analyze the fingerprint, the face, the eyes or the voice as a biometric feature. The advantages of the method and the computing device can also be transferred to the biometric recognition module.

In a further refinement, the biometric recognition module is designed to generate a unique binary code for the user as a starting value from the at least one biometric feature. For this purpose, patterns such as loops, arcs, whorls, for example in connection with the interruptions in the papillary ridges (minutia), can be used for a finger, for example. From such a unique start value or thereby a binary code can be created or another start value by a suitable rule. The same applies to all biometric features.

In a further refinement, the biometric recognition module has a generation function coupled to the at least one biometric feature. Furthermore, the biometric recognition module is designed to generate the unique start value using the generation function.

The at least one biometric feature is preferably designed as a fingerprint and/or voice (speech pattern and speech recognition) and/or hand-face recognition and/or iris or pure imaging and/or typing behavior. These are particularly suitable for simply being recorded on a computer, mobile phone, tablet, etc., since most of the hardware, i.e. the sensors, is already available.

Further properties and advantages of the present invention emerge from the following description with reference to the enclosed figures.

• 1: ein erfindungsgemäßes Verfahren schematisch, und
• 2: eine erfindungsgemäße Rechnervorrichtung schematisch, und
• 3: einen Fingerabdruck mit Binärcode als Startwert schematisch.

It shows schematically:

• 1 : a method according to the invention schematically, and
• 2 : a computing device according to the invention schematically, and
• 3 : a fingerprint with binary code as seed schematic.

Although the invention is described here using a blockchain application as an example, it is not limited to such. Rather, it can be used wherever cryptographic methods are used with the help of keys. In particular, the invention can be used in all cryptographic methods in which asymmetric key pairs consisting of a private and a public key are used. Blockchain is a continuously expandable list of blocks that are linked together using cryptographic processes. Data is managed in the blocks without a central instance in a traceable and tamper-proof manner. With blockchain, it is possible to verify transactions, such as payment transactions with cryptocurrencies, in a trusting and transparent manner without a central authority.

A cryptocurrency is the digital means of payment based on the blockchain system, which can be accessed using a private key that only the user has. Only those who have the private key can set up a valid transaction and thus dispose of the credit balance behind it. Usually the key is stored in a digital wallet (Wallet 4 ( 2 )) saved. The private key therefore grants access to your own cryptocurrency. The private key is derived from an initial value, the so-called seed.

1 shows the method according to the invention in a schematic overview using a blockchain application.

In a first step S1, a user enters via a biometric recognition module 2 ( 2 ) his individual biometric feature. This can be a fingerprint, iris recognition, voice etc. The starting value for generating the private key is now derived from this. For this purpose, an internal rule, if necessary an internal calculation rule, is applied. For example, a fingerprint is used as a biometric feature drawn, the various patterns such as loops, arches, swirls, especially in connection with the interruptions in the papillary ridges (minutiae), vary from finger to finger, so that a personalized starting value can be derived from them. These features can be recognized using a calculation rule/extraction rule and can be combined to form a starting value, for example in the form of a binary code.

In a second step S2, a private key is generated from the start value using a generation function (calculation rule, mapping function).

In an alternative step S2a, a private key and a public key (asymmetric key pair) are generated from the start value using a generation function (calculation rule, mapping function).

In a third step S3, the private key is put into the wallet 4 ( 2 ) is imported and stored and can be used for transactions on the blockchain 5( 2 ) be used.

In an alternative fourth step S4, after one-time use, i.e. one-time access to the blockchain 5 (( 2 ) transaction etc.) with the private key, the private key from the wallet 4 ( 2 ) turned off. Deletion can also take place after a predetermined period of time, for example if a transaction was intended, but ultimately did not take place and the key was not used.

The method allows the key(s) to be generated “on demand”; ie the key is only generated when an application is intended. After use, the stored key is removed from the wallet 4 ( 2 ) away. This means that third parties cannot steal/read the stored keys and thus carry out unauthorized transactions/access to the blockchain.

The procedure means that the private key is unique and can be reproduced securely. The starting value is personalized and linked to the user. If the private key is lost or the initial value is lost, the user still has the option of accessing his cryptocurrency. Due to the immutability and uniqueness of the biometric feature, misuse of the process, i.e. generation by unauthorized persons, is ruled out.

2 FIG. 1 shows a computer device 1 for generating at least one cryptographic key for use in a cryptographic encryption method. The computing device 1 can be a computer/mobile phone or tablet or another computer system.

The computing device 1 includes a biometric recognition module 2. This can be a fingerprint sensor or a camera with appropriate software for detecting the respective biometric feature such as fingerprint or face or iris etc. Since most computers / systems already have such hardware, a computing device according to the invention 1 can be realized inexpensively.

However, such a biometric recognition module 2 can also be connected externally to a computer device 1 via appropriate interfaces.

Furthermore, the computing device 1 includes a generator 3. This can be, for example, a processor with suitable software or a simple program/file.

The computing device 1 also includes a wallet (digital purse/storage space) 4.

Generator 3 and wallet 4 can be designed as a single module or generator 3 and wallet 4 and biometric recognition module 2 can be designed as a single module.

A personalized starting value can now be generated with the aid of the biometric recognition module 2 . If this is a fingerprint or an iris or the voice, a binary code can be created using the extracted features, for example.

The generator 3 is designed to generate the key using a generation function applied to the start value. The generation function can be an arithmetic function or a mapping function. The key is then stored in wallet 4.

After use with a blockchain 5, the generator 3 or the wallet 4 can delete the key from the wallet 4. The key is thus designed for one-time use. The key can also be deleted from the wallet 4 after a period in which it has not been used. The key can also be made otherwise unusable after use by the wallet 4 or generator 3 .

The key can thus be generated “on demand” by the computer device 1 according to the invention; ie the key is first gene ted when the user needs it. After use, the key is removed from the wallet 4 or rendered unusable. As a result, unauthorized third parties cannot steal/read the stored key in order to gain unauthorized access to the cryptocurrency, for example.

The starting value (seed) can be clearly reproduced for one user by the computer device 1 according to the invention. A loss of the key due to the loss of the wallet 4 or even the entire computer device 1 therefore does not lead to the loss of, for example, cryptocurrency on a blockchain 5. The computer device 1 according to the invention can be used to obtain the key at any time from the restored personalized starting value. Since the starting value is generated by your own fingerprint, this system cannot be misused by third parties.

3 shows a fingerprint 6 with a binary code. Minutiae detection is used to create the personalized seed. Here, characteristic features such as singular points, line endings, forks, etc. are converted into a unique binary number code. This means that the starting value can be reproduced clearly and reliably at any time. This means that the key is also unique and can be reliably reproduced.

reference list

1

computing device

2

biometric recognition module

3

generator

4

Wallet

5

Blockchain

S1 ,-,S3

process steps

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• DE 102010011657 A1 [0009]

Claims (18)

Computer-implemented method for generating at least one cryptographic key for use in a cryptographic encryption method, the at least one cryptographic key being generated using a seed using a generation function, characterized in that the seed is generated from at least one biometric feature of a user, so that using the biometric feature of the starting value for a user is uniquely reproducible. Computer-implemented method claim 1 , characterized in that the unique starting value is generated by means of a generation function which is coupled to the at least one biometric feature. Computer-implemented method according to one of the preceding claims, characterized in that the at least one cryptographic key is stored in a wallet (4). Computer-implemented method claim 3 , characterized in that the at least one cryptographic key is formed for single use. Computer-implemented method claim 4 , characterized in that the at least one cryptographic key is discarded after a single use. Computer-implemented method according to one of the preceding claims, characterized in that two keys are generated, the keys belonging to an asymmetric encryption method. Computer device (1) for generating at least one cryptographic key for use in a cryptographic encryption method, comprising a generator (3) which is designed to generate the at least one cryptographic key using a generation function applied to an initial value, characterized in that the computer device (1) is designed to record at least one biometric feature of a user and wherein the generator (3) is also designed to generate the starting value from the at least one recorded biometric feature of the user, so that the starting value for one user can be clearly reproduced is. Computing device (1) according to claim 7 , characterized in that the generator (3) has a generation function coupled to the one biometric feature and the generator (3) is designed to generate the unique start value by means of the generation function. Computing device (1) according to any one of the preceding Claims 7 or 8th , characterized in that the generator (3) is designed to store the at least one generated cryptographic key in a wallet (4). Computing device (1) according to claim 9 , characterized in that the generator (3) is designed to design the at least one generated cryptographic key for single use. Computing device (1) according to claim 10 , characterized in that the generator (3) is designed to delete the at least one cryptographic key after it has been used once from the wallet (4). Computing device (1) according to any one of the preceding Claims 7 until 11 , characterized in that the generator (3) is designed to generate two keys which are intended for use in an asymmetric encryption method. Computing device (1) according to any one of the preceding Claims 7 until 12 , characterized in that the generator (3) is designed as a biometric recognition module (2), wherein the biometric recognition module (2) is designed to detect the at least one biometric feature and the start value from the at least one biometric feature and the at least one generate a cryptographic key from the seed. Computing device (1) according to any one of the preceding Claims 7 until 12 , characterized in that the generator (3) has a biometric recognition module (2) for detecting the biometric feature. Biometric recognition module (2) for generating at least one cryptographic key for use in a cryptographic encryption method, wherein the biometric recognition module (2) is designed to record at least one biometric feature of a user, characterized in that the biometric recognition module (2) is designed to of the at least one biometric feature to generate a starting value and wherein the biometric recognition module (2) is also designed in such a way that at least one cryptographic key is used using a value based on the starting value to generate applied generation function, so that the start value and the cryptographic key for a user is uniquely reproducible. Biometric recognition module (2) after claim 15 , characterized in that the biometric recognition module (2) is designed to generate a unique binary code as a starting value from the at least one biometric feature for the user. Biometric recognition module (2) after claim 15 or 16 , characterized in that the biometric recognition module (2) has a generation function coupled to the one biometric feature and is also designed to generate the unique starting value by means of the generation function. Biometric recognition module (2) according to one of the preceding Claims 15 until 17 , characterized in that the at least one biometric feature is designed as a fingerprint and/or voice (speech pattern and speech recognition) and/or hand-face recognition and/or iris or pure imaging and/or typing behavior.

Images