EP2353123A2

EP2353123A2 - Requirements-based personal authentication method

Info

Publication number: EP2353123A2
Application number: EP09807493A
Authority: EP
Inventors: Friedrich Kisters
Original assignee: HUMAN BIOS GmbH
Current assignee: HUMAN BIOS GmbH
Priority date: 2008-12-02
Filing date: 2009-12-01
Publication date: 2011-08-10
Also published as: WO2010075921A2; US20110247058A1; WO2010075921A3; AT507759A1; AT507759B1

Abstract

The invention relates to a personal identification method based on requirements. An authentication checking system (1) thereby receives an authentication requirement (7) from a service provision system (5) and said requirement is analyzed and the required authentication level (9) is determined from the same. After activating (21) a detecting means (3) of a detecting device (2), a personal identifier is detected (22) and compared (23) to a corresponding reference feature (14) stored in a memory unit (15, 16). If the comparison matches, a release signal (17) is provided to the service provision system (5); if the match is incorrect (25) a further detecting means (3) of the detecting device (2) is activated and the corresponding process steps are repeated.

Description

Requirement-based personal identification procedure

The invention relates to a requirement-based personal identification method.

To claim a service offered, it is known that a person must correctly identify and authenticate with the service provider. Especially when using a non-local service there is the problem that over a distance, a correct and reliable authentication of a requesting person must be ensured. In particular, when using a service, there is usually a need for the use of the service itself, or the services offered above, to be charged to the requesting person. It is therefore of particular importance that only a properly identified person can avail himself of the services provided. For correct authentication or identification of a person, it is known to capture a unique feature of the person and to compare this with a reference feature. Furthermore, it is known to manage the use of a provided service via an access identifier. Thus, an access identifier and / or a unique user identifier is detected and released in accordance with a reference feature, the use of the service.

The service providing system can now manage or make available a plurality of different services, whereby also different demands on the quality or security of the authentication of a person are given. For example, accessing a news service usually requires a lower level of security than is required to access a financial transaction system. In known systems, a person had to go through a different authentication procedure for each access to a different service, whereby the individual authentication processes usually had to be carried out on different detection devices.

However, personal, individual identifications also bear the risk that they may be forgotten in the event of irregular use and thus there is a risk that a correct and unambiguous identification or authentication of a person may be avoided. which is not always reliable. A common practice now is to use only a few personal identifiers, for example, only a small number of passwords, thereby bypassing the security functionality of the authentication and authentication check. An attacker could thus gain access to a variety of different services by espionage of such a password and thus cause considerable damage.

If, for example, a person-related identifier is forgotten due to insufficient use, there is hardly any possibility of using the desired service in known systems, since in most cases no emergency scenario is provided in order nevertheless to achieve authentication.

Furthermore, known authentication methods are generally based on a correct reproduction of a predefined personal identifier or on the correct execution of a predefined sequence of actions by the person to be authenticated. In any case, it is about the correct reproduction of a predetermined action, whereby a potential attacker can spy on these actions and thus gain access to the service delivery system in an abusive way.

Known methods are usually based on a so-called 3-factor authentication. In this case, features are used for personal authentication, which are essentially in direct relation to the person. The disadvantage here is that these features are sometimes quite easy to spy on and thus provide only a small degree of security in the identification of a person. Also, known methods are usually not flexible enough to use different personal identifiers to authenticate a person. Furthermore, in the case of an incorrect detection of a personal identifier or in the event of a faulty comparison, in the case of known methods, an abortion of the authentication process usually occurs.

The object of the invention is now to provide a method for the unique identification and authentication of a person, wherein the authentication is not limited to a single person-related feature and in particular the disadvantages of the prior art should be solved. The object of the invention is achieved by the method steps according to claim 1.

In a first step, the authentication control system receives an authentication request from a service delivery system. By transmitting the authentication request to an authentication control system, the performance of the personal authentication or identification can be separated from the service provision; in particular, a service provisioning system can therefore cooperate with a plurality of authentication control systems, or an authentication control system can consist of several Service provisioning systems receive an authentication request. Another advantage is that only one authentication request is transmitted and thus the implementation of the personal identification or authentication is separate from the implementation of the service provision. In particular, it is thus possible for the individual systems involved to be formed separately. The authentication request can now be configured so flexibly, for example, that not only is an authentication request transmitted as such, to which the authentication control system reacts, but that a request relating to the desired service is transmitted and thus the authentication control system based thereon, can activate a corresponding detection means.

In a further step, the authentication request is analyzed and the required authentication level determined therefrom. Due to the advantageous logical or physical separation of the service provision of the person identification or authentication, an indication is possible by transmission of the authentication request, which degree of reliability the authentication to be performed must reach in order to grant the person access to the provided service. A preferably universally designed authentication control system is therefore able to record different personal identifiers and thus to be able to ensure a different degree of authentication security by the method according to the invention. In particular, for security-critical uncritical services a simply trained personal identifier can be detected, for security-critical services critical a personal identifier can be detected, which is extremely difficult to spy or falsify. - A -

After the required authentication level has been determined, a corresponding detection means of a detection device is activated in order to acquire a personal identification corresponding at least to the required security level. The detection device preferably comprises a plurality of detection means in order to be able to detect a plurality of different personal identifiers without another one

Detection device would be required. With regard to safety-related covering, this integrated detection device has the very special advantage that it can be designed in a particularly secured manner and thus a high degree of tampering or manipulation security is achieved. Another advantage is the self-sufficient implementation of the detection of a personal identifier by the authentication control system and in particular by the detection device.

The detected identifier is then compared with a corresponding reference feature stored in a memory unit, wherein the memory unit can be arranged in the detection device or in the authentication control system. The comparison can now be designed such that, in addition to an exact comparison result, a degree of agreement is also determined, it being possible by means of appropriate parameterization to determine which degree of agreement is required for a correct comparison result.

Upon detection of a match, the authentication control system issues a release signal to the service delivery system, whereupon it makes the requested service accessible to the person. In particular, it is ensured for the operator of the service that a possible usage fee can be unambiguously and unmistakably assigned to a person. It can also be ensured by means of an appropriate authentication level that the person, when using the provided service, undertakes a legally binding act and this can be clearly documented.

A particular advantage of the method according to the invention lies in the fact that, in the case of an erroneous match, a further detection means of the detection device is activated and the method steps for detecting a person-related identifier as well as the comparison with a corresponding reference feature are repeated. At the Due to external influences, it may happen that the subsequent comparison fails, even though there is no attempt to tamper with it. In known methods, the authentication would be canceled in this case and the person would thus have no access to the requested service. With the method according to the invention, it is now possible in an advantageous manner to record another person-related feature, so as to perform the failed authentication again by re-authentication, in this case, however, with a security-related higher-value personal identifier. Identifying an authentication level determines the minimum level of security that the acquired personal identifier must provide in order to use the service. With the method according to the invention, however, it is now possible in an advantageous manner, for example, to record the security-related next higher-level personal identifier in order to be able to perform the authentication for the requested service. If necessary, the comparison operation in this case may require a lower degree of coverage, since only a failed comparison of a lower-security authentication level must be remedied. In a development, it is also possible that, instead of a higher-security personal identifier, at least one other security-equivalent identifier is detected.

With the method according to the invention, it is advantageously possible to correct a mistakenly failed detection or a faulty match by detecting a personal identifier, for example a higher safety-related classification. In the case of an actual abuse attempt, this renewed authentication attempt will now also fail, as a result of which a further development is advantageous, according to which an error flag signal is output as an alarm signal in the case of possibly repeated repeated erroneous matching. This alarm signal can, for example, activate an alarm output device that is communicatively connected to the authentication control system and / or to the detection device, and thus alert possibly existing security guards to the abuse attempt. But it is also possible that such an alarm signal to the service delivery system and / or an alarm control system is transmitted, the respective system initiates appropriate steps to prevent the abuse attempt or to alert, for example, a security service. This further development has the particular advantage that an erroneous faulty authentication can be remedied, but a repeated, incorrect authentication as abuse attempt is recognizable.

With the transmitted authentication request, a security code can be transmitted at the same time, which directly influences the specification of the authentication level. A manipulation attempt to achieve an authentication could be, for example, that the authentication control system is manipulated and thus, for example, a higher level of security authentication level is replaced by a lower level. With the further development according to the invention, a required authentication level can now be predefined from the service provisioning system in order thus to bypass the determination step by the authentication control system. In particular, it is thus also possible to carry out unpredictable security checks, for example by transmitting a security code of a security-related highly prioritized authentication request together with a low-priority authentication request in order to sample the identity or authenticity of the requesting person at a high level of security to check. For example, an abusive use of a security-related low-priority service over a longer period of time or in case of frequent use to produce a corresponding loss. Random security checks also detect such manipulation attempts. In particular, it is possible with this development to be able to define an individually adapted security code and thus an individual authentication level for each authentication request. For example, a random number generator can influence this security code in such a way that an authentication request is transmitted, as it were unpredictably, and thus defines an authentication level that is significantly above that required for the requested service. The random number generator may, for example, also take into account the statistics of the past authentication processes and, in the case of a person with an increased number of faulty authentication attempts, require a more frequent higher level of authentication with regard to security.

To authenticate a person, a personal identifier is recorded, which is then to be compared with a reference feature. To increase the security against manipulation, the authentication control system can be designed such that a personal The identifier is stored in a storage medium only for the duration of the authentication process, in particular for the duration of the comparison process, and is subsequently deleted immediately. According to the further development, a reference sentence of a person-related feature is transmitted with the authentication request and is thus available for the comparison. However, this training also has the further advantage that the authentication control system does not receive a personal reference identifier until the person first wishes to identify with this specific authentication control system. For a distributed system in which a plurality of authentication control systems communicatively connected to one or more service providing systems, this has the particular advantage that the reference features are transmitted only at the time of the authentication to be performed and thus the risk is substantially reduced deposited reference features could possibly be spied on.

If the authentication requirement is compared to a stored security hierarchy profile to determine the authentication level, this is particularly advantageous in that the authentication level is determined or assigned via the hierarchy profile and thus an individually adaptable assignment becomes possible. In particular, therefore, the security hierarchy profile can be adapted to the authentication control system and, for example, in an environment in which there is a greater risk of manipulation of the authentication control system, the hierarchy profile to be adjusted accordingly, so that in principle a higher level of authentication is determined. This design has the further advantage that this security hierarchy model can be individually adapted and thus, for example, an individual security hierarchy profile can be used for each authentication request. In particular, this security hierarchy profile can be managed, for example, by the person himself and thus an individualized authentication process can be created. It can also be determined by means of this security hierarchy profile, which degree of agreement must be achieved when comparing the detected personal identifier with the reference feature. Furthermore, it is possible to determine how to proceed in the case of a negative match, in particular which personal identifier can be used to remedy the erroneous comparison. In a further development, the security hierarchy profile establishes an association between the detection means of the detection device and the authentication level. The authentication level basically determines which security-related requirement is placed on the authentication to be carried out, that is to say which minimum level of security with regard to a clear identification or authentication of a person must ensure the detected personal identifier. This further development has the further advantage that individually trained authentication control systems can be present, which may possibly also detect personal identifiers differently, but due to the required and, in particular, generally valid authentication level, correspondingly secure personal authentication is ensured.

With regard to securing the authentication control system against unauthorized manipulation, a further development is advantageous according to which a procedure is transmitted with the authentication request. This development can ensure that a manipulation of the authentication control system with respect to the

Carrying out the detection of a personal identifier is difficult or impossible, since the expiration statement for performing the detection of the identifier with the authentication request is transmitted and thus possibly the expiration command is transmitted again for each authentication request. In particular, the authentication control system can be designed in such a way that the information transmitted by the service providing system is temporarily stored only for the duration of the authentication process and is then irretrievably deleted. Thus, an attacker can not access any security-critical information.

A further advantage is a development according to which the authentication control system controls the functionality of the detection device, since in turn a further increase of the manipulation security is achieved. The detection device with the detection means is usually the first point of attack for a manipulation attempt, since this device is open as the last link in the chain for performing the personal authentication and access by unauthorized persons. If the control of the functionality of the detection device is now controlled by the authentication control system, it is considerably more difficult for potential attackers to manipulate the comparison operation subsequent to the detection of the personal identification. It is also with this training possible to use standardized and thus universally applicable detection devices, since the concrete procedure statement is transmitted only with the authentication request and then executed by the authentication control system.

According to a further development, an alphanumeric identifier could be entered as a personal identifier. Such an alphanumeric identifier can be, for example, a combination of numbers, a so-called PIN code, which can be input via a standardized and thus widely used and cost-effective input means, for example by means of an alphanumeric keyboard. From the field of automatic cash dispensing devices, for example, an input device is known which has a plurality of selection keys and a number pad. An extended functionality, and thus an increased level of security, for example, offers an input device in which letters can also be entered in addition to numbers, as a result of which, for example, a so-called passphrase can also be entered.

A personal identification, which is retrieved from the memory of the person and entered via the input means, in particular, the risk that a potential attacker observes the person in the input and thus spied on the personal identifier. A significant increase in the security of authentication is achieved if a biometric feature is detected as a personal identifier, since biometric features are clearly attributable to a person and in particular can only be manipulated extremely difficult. Also, the risk of direct manipulation is significantly reduced in the detection, since together with the biometric feature, for example, vital signs can be detected and thus an extremely high authentication security is given.

Another possibility [to identify or authenticate a person with certainty is that the personal identifier is a sequence of actions in which the means of detection is operated by the person to be authenticated. For example, an operator action may be to enter an alphanumeric identifier in a particular predetermined sequence of each type. A further operator action could be, for example, that deliberately one or more type input errors occur, which are remedied by operating a deletion or correction function. For example, if a person is threatened and forced to enter the personal identifier, can this person consciously make one or no error at specified locations of the identifier, this deliberate misoperation being registered as a unique personal identifier, but not only carrying out an authentication of a person, but also triggering an alarm action, for example, since the person acts as a result of this deliberate misbehavior - on triggered. Likewise, a deliberate incorrect operation of the detection means can be detected and interpreted as a personal identifier, for example by a confirmation function is triggered before the complete input of the alphanumeric identifier. In any case, with the further development according to the invention, a person can initiate actions without a potential attacker thereby interpreting this seemingly accidental incorrect operation as a person-related identifier.

In a similar direction aims a further development, according to which a temporal sequence of the operator actions is detected when the personal identification. Again described using the example of the detection of an alphanumeric identifier, a person can enter the individual types in a specific chronological order. For example, at a certain point a longer pause between the input can be provided or it can be provided that the identifier must be specified within a certain maximum period of time. In the event of a threat, the person can deliberately not adhere to the specified time schedule in order to perform a seemingly successful authentication but trigger a corresponding alarm action in the background. Also, an attacker who has spied on a personal identifier will usually not recognize the underlying time sequences and thus a manipulation attempt would fail.

In particular, a multiplicity of possible authentication processes can thus be carried out or initiated with a personal identifier, in combination with a plurality of different operator actions and / or different time sequences. For example, by entering an alphanumeric identifier in combination with a corresponding operator action, it is possible for the authentication control system to initiate an automatic callback to a mobile communication device, which must be answered by the person to be authenticated in a well-defined manner. If the answering of the inquiry does not take place in the defined manner, for example because the person does not accept the callback, the authentication can apparently be carried out successfully, however, in the background a corresponding alarm action triggered. By means of a position determination by the mobile communication device, this can lead to a localization of the person concerned by the authentication device, so that the person can be targeted for assistance. Optionally, it may further be provided that the detection device also has a short-range communication device, so that for successful authentication of the user with the mobile communication device, which has a corresponding communication counterpart, must be within a well defined and especially small distance.

The personal identifiers described so far were all based on a conscious action by the person to be authenticated. In addition, there is still the possibility to detect an unconscious behavior of a person as a personal identifier by the detection device by means of an input-output device issues a personalized request and detects the reaction of the person on it. Such reactions can hardly be manipulated, since these are based on an unconscious reaction model of the person, which can not be spied on by a potential attacker, since this would usually already falsify the reaction model. For example, the capturing device may issue a prompt and offer several choices. Regardless of the currently presented prompt, the person will intuitively respond to a specific class of prompts at once, which is a high level of authentication in terms of security. The presented prompt is preferably selected from a supply of a plurality of possible different prompts.

A significant increase in the security of authentication is obtained when the security hierarchy model is transmitted from an authentication system to the authentication control system, since thus a separation of the authentication from the provision of a service to be used is achieved. In particular, it is advantageous that the authentication system can be arranged, for example, within a highly secure area, while for a service provisioning system generally lower security requirements are required. In particular, it is thus prevented that access to the authentication control system can be achieved by manipulating a service provisioning system in order to misuse it in another one To gain access to another, for example higher-security service provisioning system.

With regard to a possible individual adaptation of the method according to the invention to the individual personal identifiers and to the individual behaviors, a development is advantageous, according to which the security hierarchy profile is created in a training phase, wherein personal identifiers are recorded as reference features and stored in a storage means , Preferably, this storage means will be arranged in the authentication system, whereby an arrangement in the service providing system is also possible. The detection of personal identifiers in a training phase has the further advantage that the detection device used for this purpose can be arranged in a security environment particularly protected environment or further a corresponding legal environment can be created in order to form the detected identifiers legally binding. In particular, it is important in the training phase that the identity of the person is unambiguously determined and thus the detected identifiers can be unambiguously assigned to this person. For example, this authentication can be carried out by means of an identification document which is submitted to a legal authority, such as a notary, who checks the document for validity by means of a control device, for example a passport reader, and then records personal identifications and deposits them legally binding in a storage means , The thus detected reference features can now be deposited in the production of the authentication control system in this, but it is also possible to deposit them in an external memory module, which is arranged integrated with the authentication control system. Also, the reference features can be transmitted via a communication link to the authentication control system.

For the expansion of the possibilities for personal authentication or to increase the security of such an authentication, it is advantageous if a conscious behavioral pattern is detected as a personal reference feature, in which a specific sequence of operator actions is detected at the detection device. For an alphanumeric identifier, for example, it is possible to specify the identifier in the specified order, but it is also possible to enter the identifier in the reverse or different manner and specify, for example, by a deliberate incorrect input to be able to trigger a specific behavior. In particular, by combining a security-relevant weak personal identifier with a conscious behavioral pattern as a personal identifier, a substantial increase in authentication security can be achieved. In particular, conditional functions of the authentication control system can therefore also be defined in order to be able to trigger safeguards in the event of an abuse attempt.

Likewise, an unconscious behavior pattern can be detected as a personal reference feature, in which the person is presented with a plurality of choices by means of an input and output device and the selection made in each case is recorded. The options are preferably selected from a supply of simple situational feature descriptions and presented to the user, for example on a display device and detects the reaction by means of a keyboard or an input means. The choice is made such that a clear and unambiguous selection is ensured.

In particular, it is advantageous if a reaction profile is created from the selected selection results, since the reaction of the user to a selection option can be determined on the basis of this reaction profile if this option is presented to the user during the later authentication for the use of a service. In particular, such an unconscious behavior pattern can not essentially be manipulated so that a particularly high level of security can be achieved when acquiring an unconscious behavior pattern as a personal identifier. Such a development is also of particular advantage in that a potential attacker can not essentially capture such a reaction profile by spying.

According to a further development, reference features are stored in the memory unit of the authentication control system, which has the advantage that it can be operated without connection to a central authentication system and thus can carry out a completely independent and reliable personal authentication. This development is particularly advantageous if, for example, a reliable personal authentication is required for a so-called single-user system, in which the service provision system and the personal authentication system are located in one place and no communicative Connection with a remote system is required. With this development, in particular so-called "stand alone" - systems can be formed, which provide sufficient access protection, for example, by appropriate mechanical security or protective measures and offer a high degree of authentication security due to the high security against manipulation.

Another advantage is a further development, according to which an authentication request is generated after the expiration of a timer on the service providing system or on the authentication control system, since a renewed authentication can thus be triggered in a targeted manner. After a successful authentication, a user can make use of the service provided, in particular until the logoff from the service providing system or the authentication control system. However, as the duration of use increases, the risk of manipulation by unauthorized third parties increases. In particular, the degree of reliable authenticity of the logged-in user, plotted over the useful life, drops sharply, in most cases even nonlinearly. With the development can now be ensured that at regular or optional predetermined time intervals, the user is required a re Authentifϊkation, so that a state is prevented in which a user is logged on the service provisioning system for a long time. The claimed authentication request can now be transmitted by the service provision system and thus corresponds to a request as it is obtained for the initial authentication according to the inventive method steps. Furthermore, the authentication request can also originate from the authentication control system itself, but the processing of the request is the same as if it had arrived from the service providing system. For example, a renewed authentication request by the authentication control system has the advantage that this system can take into account the locally prevailing security environment and, for example, in a non-secure environment, allows only a short validity period of the authentication without this being specifically stored on the service provisioning system would.

Furthermore, according to a further development as a personal identifier, an image of the person can also be recorded. Thus, for example, an optical visual comparison is possible, in particular unambiguous or characteristic features can be determined by means of known image analysis methods from the acquired image. Images after an internationally recognized standard, for example according to the ICAO (International Civil Aviation Organization), can be clearly analyzed analytically and thus compared with a high reliability factor with a reference feature.

Another factor to increase the security of authentication is obtained when the captured image is transmitted to a mobile Kommunikationsvorrichrung. For example, a group of individuals can be defined individually for each user whose members are willing to perform a visual visual authentication of a person and to confirm the authenticity of the same. Automated authentication systems carry out the authentication of a person according to strictly defined rules; an individual evaluation of the environment or the situation is omitted. With this development, a human weighting factor is now introduced, in particular an assessment of the situation is possible in which the Authentifϊkationsanfrage takes place. For example, a person may be forced to authenticate and thus possibly enter a correct personal identification. With the further development, the image is transmitted by means of a data service such as. MMS to a mobile communication device, whereupon the recipient can recognize that the person is threatened and thus subsequently can trigger measures to protect the threatened person. The inclusion of a personal network achieves a significant increase in authentication security, since every person in this network, as an authenticating entity as well as an entity to be authenticated, strives for high security and thus pays particular attention to a reliable implementation of authentication. For example, such an authentication method can be handled or charged via a bonus system.

For a better understanding of the invention, this will be explained in more detail with reference to the following figures.

Each shows in a highly schematically simplified representation:

1 shows the method according to the invention with reference to an exemplary device;

2 shows a flow chart of the method according to the invention; Fig. 3 shows another possible system for carrying out the method according to the invention.

By way of introduction, it should be noted that in the differently described embodiments, the same parts are provided with the same reference numerals or the same component names, wherein the disclosures contained in the entire description can be mutatis mutandis to the same parts with the same reference numerals or component names. Also, the location information chosen in the description, such as top, bottom, side, etc. related to the immediately described and illustrated figure and are to be transferred to the new situation mutatis mutandis when a change in position. Furthermore, individual features or combinations of features from the different exemplary embodiments shown and described may also represent separate, inventive or erfϊndungsge- Permitted solutions.

All statements on ranges of values in the description of the present invention should be understood to include any and all sub-ranges thereof, e.g. the indication 1 to 10 should be understood to include all sub-ranges, starting from the lower limit 1 and the upper limit 10, i. all subregions begin with a lower limit of 1 or greater and end at an upper limit of 10 or less, e.g. 1 to 1.7, or 3.2 to 8.1 or 5.5 to 10.

1 shows the method steps according to the invention on the basis of an exemplary device for carrying out the method. This device comprises at least one authentication control system 1, which is communicatively connected to a detection device 2, and wherein the detection device 2 has a plurality of detection means 3. The authentication control system 1 is connected to at least one service provisioning system 5 via a communication network 4, optionally an authentication system 6 is present, which is communicatively connected to the authentication control system 1 and / or the service provisioning system 5.

In particular, the method according to the invention is used to ensure, for a requested service of a service provider, that the user who requested the service is uniquely and unmistakably authenticated and identified. Of Furthermore, with the method according to the invention, an individually definable authentication of a person with regard to the detection reliability is possible. In particular, this is important because the service may be a financial transaction, for example, or includes legally binding transactions. The user will therefore initiate a corresponding procedure at the service provider, whereby this service request is not the subject of the invention and therefore will not be explained further here. By way of example, such a service request could be triggered by the fact that a user on a request device, which may be, for example, part or addition of the capture device 2, carries out a control action which is transmitted to a service provisioning system 5 and triggers the corresponding operations there. With regard to the reliability of the authentication of a person, the first step should always be to work with the highest possible level of security. Since personal characteristics to achieve this level of security are complex and difficult to detect under certain circumstances, it is of particular advantage if the characteristics to be recorded are matched to the required security level of the requested service and thus uncritical for safety

Services, including weaker personal identifiers. The method according to the invention now offers the possibility of being able to provide integrated different authentication levels and a correction of defects in the event of an incorrect comparison check.

In a first step of the method according to the invention, an authentication request 7 is transmitted to the authentication control system 1 by a service provisioning system 5. By analyzing the transmitted authentication request 7, the authentication control system 1 determines a required authentication level 9. This authentication level determines what level of detection security the personal identification to be acquired must have in order to be able to use the requested service. In particular, the authentication stage 9 thus determines which detection means 3 of the detection device 2 must be activated in the next method step according to the invention in order to detect a personal identifier. For a service with a low security relevance, a personal identifier can be detected, for example, as an alphanumeric identifier, which is entered via an alphanumeric input means 10, for example a keyboard. For higher-quality services, biometric features can be detected, for example For example, an image of the person's face or an image of the iris can be detected by means of an optical image capture device 11; with a so-called fingerprint scanner 12, the finger minutiae can also be detected. The detection device 2 can also have an audiovisual input-output device 13 in order, for example, to be able to detect an unconscious and / or a conscious user behavior as a personal identifier.

The detected user-related identifier is compared with one or more corresponding reference features, wherein this corresponding reference feature 14 can be arranged in a memory means 15 of the authentication control system 1. However, the reference feature 14 can also be arranged in a memory means 16 of the authentication system 6, this design having the advantage that the authentication system 6 can be designed to be particularly secure or specially protected and thus offers a very high security against manipulation. The arrangement of the reference features 14 in the storage means 15 of the authentication control system 1 has the advantage that the authentication control system can perform the comparison of the detected identifier with the reference feature itself and thus the authentication or identification of a person without additional systems is possible.

The comparison of the detected identifier with the corresponding reference feature will for the most part be successful, in which case an enable signal 17 is output by the authentication control system 1 to the service providing system 5.

The essential difference of the method according to the invention over known methods now lies in the further steps that are performed when the comparison of the detected identifier with the corresponding reference feature fails. In known methods, in this case the authentication would be aborted and the user denied access to the service providing system 5. Therefore, to be able to authenticate again, the user would have to initiate a renewed service request 7. On the other hand, the method according to the invention has the particular advantage that, in the event of a faulty comparison, a further detection means 3 of the detection device 2 is automatically activated in order to repeat the corresponding method steps according to the invention and in particular to detect a further person-related identifier. Since an authentication level 9 has been determined from the transmitted authentication request 7, the required reliability of the detected personal identifier is thus also established. Due to statistically independent occurrences, it may happen that the comparison fails, although it is not a manipulation attempt. By means of the method according to the invention, it is now provided, for example, that a person-related identifier with one or more further features or with a next higher security level is detected in order to thus remedy the failed comparison. For example, entering an alphanumeric identifier may result in unintentional misentry, which will cause the subsequent comparison to fail. In a further development, the user could be requested to enter the identifier again. According to the invention, however, it can be provided, in particular, that a further detection means 3 of the detection device 2 is activated by the authentication control system 1 and then the corresponding method steps are carried out again.

In particular, therefore, by detecting a higher-value personal identifier, ie an identifier with a higher authentication level 9, an erroneous comparison of a lower valued detected personal identifier can be resolved, it being particularly advantageous if the match criteria of the comparison are individually customizable, so a higher-value personal Must have a lower level of matching to correct a poorer comparison of a lower-value personal identifier than would be required for a comparison operation corresponding to the higher level of authentication. It is also possible for a number of lower-value identifiers to replace a higher-value identifier if, in terms of safety, they are equivalent in their total to this, which can be determined in advance. The method according to the invention can now, in particular, repeat a personal identification number as often as higher authentication levels are available. If the comparison of a personal identification with a stored reference feature repeatedly fails, the authentication control system 1 issues an error identification signal as an alarm signal. This alarm signal can be transmitted to the service provision system 5, for example, but it is also possible to transmit to the authentication system 6 or an optionally present alarm control system. This alarm signal can now be evaluated in such a way that the currently running personal authentication is aborted and, for example, an alarm is given to a security control device, which triggers corresponding security measures, for example, a corresponding security personnel are alerted. However, the alarm signal can also be evaluated in such a way that the authentication request was apparently successful and thus a potential attacker is misled to the effect that the latter is of the opinion that the manipulation attempt was successful, while in the background corresponding alarm or security measures to be hit.

2 shows a simplified representation of the sequence of the method according to the invention.

An authentication request 7 is transmitted to the authentication control system 1 by a service provisioning system 5. This authentication request 7 comprises, for example, an identifier of the requesting service providing system 5 and, in particular, identifies an identifier which makes it possible to determine the corresponding authentication stage 9. In the method step of determining the authentication stage 19, the authentication request 7 is analyzed or prepared in such a way that, for example, the corresponding authentication stage 9 is determined by comparison with a stored security hierarchy profile 20. For as universal a usability as possible of the method according to the invention, the authentication request 7 will preferably be non-specific and thus, for example, only transmit a genetic service description or security request. The concrete implementation of the required security level of the authentication request 7 is preferably done by the authentication control system 1 in particular the relationship is established, which personal identifier must be detected by the detection device 2 in order to at least reach the specified by the security hierarchy profile 20 authentication level ,

After the authentication stage 9 has been determined 19, a detection means 3 of the detection device 2 is activated in the next method step 21, wherein the authentication step determines which detection means has to be activated in order to be able to detect a person-related feature of the corresponding security level or reliability. This already shows one of the essential advantages of the method according to the invention, as compared with a device which is used to carry out the method according to the invention. fahrens is formed, personal identifiers can be detected in such a way that a different level of security is reached.

The activated detection means 3 of the detection device 2 detects in a further method step 22 a personal identifier, which is compared in a subsequent comparison step 23 with a stored, corresponding reference feature 24. The reference feature 24, but in particular a plurality of reference features, is stored in a storage means, which is preferably arranged in the authentication control system 1. However, the memory with the reference features can also be arranged with an external authentication system. This reference feature 24 provides a

Key to, for example, to access a service delivery system. Therefore, it is of particular importance that the access to these reference features is secured in such a way that manipulation is largely prevented and thus the authenticity of the reference features is reliably given, which is very important in particular for comparison 23.

If the comparison 23 of the recorded personal identification with the stored reference feature was successful, a so-called release signal 17 is transmitted to the requesting service providing system, whereupon the latter can provide the desired service on the basis of the identified identity and authenticity of the person. If the comparison fails, ie the personal identifier does not match the reference feature 25, it is now possible to initiate a renewed authentication pass compared with known methods using the method according to the invention. For this purpose, it is determined in a comparison operation 26 whether the ascertained authentication permits a renewed passage of the authentication steps. If, for example, a security-related high authentication level has been determined, a faulty comparison, for example, can not be remedied by a higher-level authentication level. In this case, it may be provided to recapture the personal identifier and to perform the comparison again, or to sum up several, less secure, security-related identifiers. If it again comes to a faulty comparison can be provided that an error signal 27 is issued and the authentication of the person thus failed. Together with the authentication request 7, a security code can be transmitted, which flows directly into the Authentifϊzierungskennzahl 9. Furthermore, the authentication key can be determined by an allocation table in which an association is established between a service providing system or a class of service provisioning systems and a corresponding authentication stage. With the security hierarchy profile 20, however, a much finer gradation of the authentication level and the procedure defined thereby is possible. For an authentication level, for example A to E, several options can now be defined which on the one hand define the requirements for the detection of the personal identifier and, on the other hand, the behavior of the method according to the invention in the case of an unsuccessful comparison of the detected identifier with the stored reference feature. For example, it may be determined by which detection means of the detection device are required to achieve a specific level of authentication. Thus, for example, a personal identification with a specific detection means can be detected and thereby meets the required security requirements. However, it is also possible that, for example, one or more detection means can be combined with a safety-related lower detection reliability so as to achieve the required detection reliability. As already mentioned above, a security-related higher-value personal identifier can also be detected so as to ensure the required authentication level. It can also be determined via the security hierarchy profile 20 how exactly the correspondence of the personal identifier with the reference feature must be carried out during the comparison 23 or which degree of matching must at least be achieved. It can also be determined via the security hierarchy profile 20 which detection means of the detection device is permitted for which authentication level and for which authentication level a renewed authentication is permitted.

The method according to the invention thus represents an extension of the known 3-factor authentication methods. These methods use or use, for example, the following feature classes as a person-related identifier:

What I am: A characteristic of the person: physical characteristics such as voice, fingerprint, iris, palm, face; What I know: A feature that only the person knows: a code / password and / or passphrase; personal information and preferences;

What I have: A feature the person possesses: a key card or a token, in particular any device which is designed to deposit a key feature or which itself is a key feature; a bank or credit card or ID.

Known methods for authenticating a person are usually based on the verification of a feature by comparison with a stored reference feature. In the case of a faulty comparison, the authentication process is usually repeated, whereby the authentication process is aborted in the event of a new faulty comparison, and thus the user is denied access to the requested service. Furthermore, the detection devices for carrying out the known authentication methods are usually designed to be able to detect only one feature or a feature class; an exchange or change of features or feature classes is for the most part not possible.

In addition to the three known factors or feature classes, the method according to the invention now offers two additional classes which can be detected as an independent personal identifier and / or are used in combination with one or more features of the known classes. A new feature class as used in the method according to the invention is characterized by a conscious behavior of the person in the presentation or input of a feature. As previously mentioned, conscious action may be to make pauses and breaks in the capture process, or to make deliberate misses, or to change the order of input, for example, by using a skip function in the capture process Input of the identifier. Thus, for example, the correct input of a personal identification code (PIN) can be characterized in that exactly one wrong entry with subsequent correction is provided. If a person is threatened, this can, for example, enter the identifier without error, which can be clearly recognized as an alarm signal by the authentication control system on the basis of the stored security hierarchy profile. This conscious behavior in the acquisition of a personal identifier extends the achievable security levels of the known three factors or feature classes for the authentication of a person Person quite considerably. In particular, the detection of a conscious behavior has the very special advantage that such a personal identifier is essentially not spied on by a potential attacker, since such behavior or action is difficult to distinguish from a normal behavior of a person. For example, a potential attacker would interpret a misentry as coincidental and thus not recognize that this seemingly random misentry is part of a personal identifier. Also, several types of misspells could be activated by the user, so that each would be valid in the authentication process and could be entered by the user in a different or a combination.

In particular, the user himself can specify, for example via a configuration tool, which types of personal identifiers are grouped as a selection option at the detection device (2). Furthermore, the user can specify an association between one or more service provisioning systems and such an authentication group, so that, for example, several such groups are presented to the user during authentication, whereby only one is valid or permitted for authentication on the requested service. Thus, by the definition of such an initial login profile already another personal identifier can be formed, since the user can, for example, deliberately select the wrong group in the event of a threat and thus can again trigger alarm or security measures.

In addition to a conscious behavior as a feature class for the authentication of a person, the method according to the invention offers a further feature class with which an unconscious behavior of the person for the authentication of the same can be used. While the features of the known three classes can be spied on and, if necessary, reproduced, and this is also possible under very specific circumstances for the fourth class, this is hardly possible with unconscious behavior, since such a behavioral pattern is very specific to each person and thus would already be falsified by a spy attempt. Such an unconscious behavioral pattern can be determined in a training phase by detecting the reaction or the behavior of the person on a multiplicity of standardized, in particular psychological foundations, questions or selection options. To develop a personal behavioral pattern, a number of different cher test or evaluation methods known, which will not be discussed here. In particular, a person becomes authenticated by their behavior, whereby this basic behavior is deeply anchored in the subconscious of the person and thus an extraordinarily high authentification security is given.

A class of personal identifications may also consist of using the type of the selected authentication class, controlled for example by the security hierarchy profile, as a personal identifier. For example, an incorrect authentication class or authentication level can be specified by the authentication control system for the service requested by the user, for example, in which a security-relevant low-value identifier is to be detected for the request of a financial transaction service. For correct authentication of the person, for example, this person would have to abort the authentication process and trigger it again, or refuse the specified authentication class and request a new, in particular safety-grade, higher-grade class.

Furthermore, an additional hierarchy level can be introduced with a user grouping, whereby a user can optionally allocate or log off from a group. Such a grouping can now be designed such that specific features are stored for each group that are known to the individual user. The grouping is preferably carried out in such a way that the individual group members essentially know each other and thus also have knowledge of person-specific details that are in any case not available to a potential attacker. For example, a group-related identifier could be that the authenticating user must specify the identifier of a mobile communication device of a user of the group.

The method according to the invention now offers a significant increase in the individually adaptable security level in the authentication of a person, in particular with regard to the possibility of triggering actions, without having to specify a multiplicity of different personal identifiers. The greater the number of different personal identifiers that a person needs to remember, the greater the risk that the potential multiplicity will be ignored and only a few people related identifiers are used. Thus, a potential attacker usually has quite easily to spy on these identifiers and thus to gain access to a variety of different services. With the method according to the invention, it is now possible, with a small number of personal identifiers, in combination with the further authentification or feature classes, to incur a very special increase in identification security and, at the same time, the chance of consciously listening to the personal identifiers by third parties to minimize.

The very essential advantage of the method according to the invention lies in the fact that the authentication of a person can be carried out by detecting personal identifiers that are essentially not spied on by a potential attacker. Furthermore, an endangered person has the opportunity to consciously make a wrong selection or input, without this being apparent to an attacker, so as to initiate security measures if necessary. Of particular advantage is further that the authentication based on the detection of personal identifiers is designed so flexible that the required security level of authentication is not only possible through the detection of a personal identifier provided, but also higher-security ge and / or more safety-related lower-value personal identifiers can be used. To circumvent the authentication method according to the invention, therefore, a potential attacker would have to spy on a plurality of different identifiers, which is extremely unlikely and usually stands in no relation to the achievable benefit or the risk of detection of the manipulation attempt.

Furthermore, this method enables different secure authentications within the same environment, for example in an establishment with a POS device (point of sale). For the execution of a transaction with a low volume or with a low monetary value, the collection of a low-security personal identifier suffices. In contrast, for a large transaction volume or for a large monetary value, the collection of a security-related high-quality personal identifier may be required. The rules for such a determination of the security levels can be stored on the service providing system and / or on the authentication control system. Furthermore, these security levels can be combined with other rule according to the invention, further, a random number generators may be present, with the optional Sampling in which a user with a higher security level must authenticate himself than would be required for the requested service. It can therefore happen that the same user has to follow two different authentication processes when processing the same transaction in the same establishment.

Fig. 3 shows another possible device for carrying out the method according to the invention. In this case, the authentication control system and the authentication system are integrated into an authentication control system 28, which thus comprises all essential safety-critical devices for carrying out the method according to the invention. In particular, it is thus achieved that no security-relevant data such as, for example, reference features are stored on the detection device 2 and that, furthermore, the comparison check can be carried out in a particularly secure authentication control system 28. For this purpose, the detection device 2 has a communication interface 29, via which a communication connection with the authentication control system 28 can be established. To carry out the detection of the personal identification, it may be provided, for example, that the control instructions stored by the authentication control system 28 are transmitted to the acquisition device 2 and temporarily stored there in an execution module 31 and from this for controlling the detection means of the detection device 2 are executed. By way of example, the execution module 31 may be designed such that it carries out a signature check of the transmitted control instructions 30, as a result of which a deliberate manipulation of the detection apparatus is prevented as far as possible by introducing an incorrectly signed control instruction.

In particular, this training has the advantage that technically very simple and thus cost-effective detection devices 2 can be used, since the control of the process, as well as the performance of the comparison operation of the detected personal identifier with stored reference features 14 is performed by a central authentication control system 28 and thus the detection device no essential safety-critical and manipulatable components.

The authentication request is transmitted in this training by the service providing system 5 to the authentication control system 28. This leads then the method steps according to the invention and transmitted on successful authentication of the person a release signal to the requesting service providing system. 5

The embodiments show possible embodiments of the requirement-based personal identification method, it being noted at this point that the invention is not limited to the specifically illustrated embodiments thereof, but rather also various combinations of the individual variants are possible with each other and this possibility of variation due to the teaching of technical action representational invention in the skill of those skilled in this technical field. So are all conceivable embodiments, which are possible by combinations of individual details of the illustrated and described embodiment variant, includes the scope of protection.

FIG. 3 shows a further embodiment of the requirement-based personal identification method which is possibly independent of itself, again using the same reference numerals or component designations for the same parts as in the preceding FIGS. 1 and 2. To avoid unnecessary repetition, reference is made to the detailed description in the preceding figures.

For the sake of order, it should finally be pointed out that, for a better understanding of the structure of the requirement-based personal identification method, these or their components have been partially displayed out of scale and / or enlarged and / or reduced in size.

The task underlying the independent inventive solutions can be taken from the description.

Above all, the individual embodiments shown in FIGS. 1 to 3 can form the subject of independent solutions according to the invention. The relevant tasks and solutions according to the invention can be found in the detailed descriptions of these figures. REFERENCE NUMBERS

1 authentication control system 2 detection device

3 detection means

4 communication network

5 Service Provisioning System 6 Authentication System

7 Authentication request

8 Transmission of the authentication request

9 Authentication level 10 Alphanumeric input means,

keyboard

11 Optical image capture device

12 Fingerprint scanner 13 Audiovisual input device

14 reference feature

15 storage means 16 storage means

17 enable signal

18 delivery of a release signal

19 Determine Authentication Level 20 Security Hierarchy Profile

21 Activate a detection means

22 Entering a personal ID 23 Comparison with reference feature

24 stored reference features

25 Incorrect match

26 Comparison 27 Error signal

28 authentication control system

29 communication interface

30 control instructions 31 execution module

Claims

Patent claims

1. Requirement-based personal identification method comprising the steps:

- Receiving an authentication request (7) from a service providing system (5) by an authentication control system (1);

- Determining the required authentication level (9) by the authentication control system (1) by analyzing the authentication request (7);

- Activation (21) of a detection means (3) of a detection device (2);

- detecting (22) a personal identifier by the detection means (3); - comparing (23) the detected identifier with a corresponding reference feature (14) stored in a memory unit (15, 16);

In the case of agreement: issuing a release signal (17) to the service providing system (5);

- If there is a mismatch (25): activate another detection means (3) of the detection device (2) and repeat the corresponding method steps.

2. A request-based personal authentication method according to claim 1, characterized in that upon repeated erroneous coincidence, an error flag signal (27) is output as an alarm signal.

3. Request-based personal authentication method according to one of claims 1 or 2, characterized in that with the authentication request (7) a security code is transmitted, which determines the authentication level (9).

4. Request-based personal authentication method according to one of claims 1 to 3, characterized in that with the authentication request (7) a reference sentence (14) of a person-related feature is transmitted.

5. request-based personal authentication method according to one of claims 1 to 4, characterized in that the determination of the authentication stage (19) by comparing the authentication request (7) with a stored security hierarchy profile (20).

6. Request-based personal authentication method according to claim 5, characterized in that the security hierarchy profile (20) establishes an association between detection means (3) and authentication stage (9).

7. request-based personal authentication method according to one of claims 1 to 6, characterized in that the authentication request (7) a flow statement is transmitted.

8. request-based Personenauthentifϊkationsverfahren according to any one of arrival- Proverbs 1 to 7, characterized in that the Authentifϊkations-control system (1) the

Functionality of the detection device (2) controls.

9. request-based Personenauthentifϊkationsverfahren according to any one of claims 1 to 8, characterized in that an alphanumeric identifier is detected as a personal identifier.

10. Request-based personal authentication method according to one of claims 1 to 9, characterized in that a biometric feature is detected as a personal identifier.

11. Request-based personal authentication method according to one of claims 1 to 10, characterized in that a control action is detected as a personal identifier with which the detection means (3) is operated by the person to be authenticated.

12. Requirement-based personal authentication method according to one of claims 1 to 11, characterized in that a temporal sequence is detected during the detection of the personal identifier.

13. Request-based personal authentication method according to one of claims 1 to 12, characterized in that the detection device (2) by means of an output device (13) outputs a personalized request, for example. An input request with multiple choices, and the person's response is recorded as a personal identifier.

14. Requirement based person authentication method according to any of arrival _r speaking 1 to 13, characterized in that the security hierarchy profile (20) by an authentication system (28) is transmitted to the authentication control system (1).

15. The request-based personal authentication method according to one of the claims 1 to 14, characterized in that the security hierarchy profile (20) in a

Training phase is created, wherein personal identifiers are detected as reference features (14) and stored in a storage means (15, 16).

16. The request-based personal authentication method according to claim 15, characterized in that a conscious behavior pattern is detected as a personal reference feature by detecting a specific sequence of operations on the detection device (3).

17. Requirement-based personal authentication method according to claim 15 or 16, characterized in that an unconscious behavior pattern is detected as a personal reference feature by the person gets a plurality of choices displayed by means of an input-output device and the selection made in each case is detected.

18. requirement-based personal authentication method according to claim -17, characterized in that from the selected selection results, a reaction profile is created.

19. Requirement-based personal authentication method according to one of the claims 1 to 18, characterized in that reference features (14) in the memory unit (15) of the authentication control system (1) are deposited.

20. Request-based personal authentication method according to one of claims 1 to 19, characterized in that after expiration of a timer on the service providing system (5) or on the authentication control system (1), an authentication request is generated. O

21. Requirement-based personal authentication method according to one of claims 1 to 20, characterized in that a personal image of the person is recorded.

22. A request-based personal authentication method according to claim 21, characterized in that the captured image is transmitted to a mobile communication device.