ES2346607B1 - KEYBANKING - Google Patents

Abstract

Device with fingerprint reader for Access in secure environments.

A USB device with a fingerprint reader for access in secure environments characterized by comprising reading means (2) for reading biometric information, means processing (3) to process the biometric information of according to a routine stored in a memory (4) and for obtain a set of biometric data associated with the information biometric read, encryption means (5) to verify the identity of the person from the biometric data set by comparing said data set with data stored biometrics existing in said encryption means (5) and generate a one-time password (OTP) as a credential of the verified identity that allows access to a repository of protected information that contains encrypted data associated with the validated person

Description

Device with fingerprint reader for Access in secure environments.

Technical sector

The invention falls within the technical sector of authentication processes through biometric systems, more specifically the system relies on the fingerprint to provide security and convenience to identification processes.

State of the art

Currently the processes that are carried out at over the internet are increasingly and is becoming a cost-effective environment for different attack systems computer.

In recent years it is getting a lot emphasis on hindering these attacks to secure these communications, some of the alternatives pass through passwords that are generated at the moment and only allow their use once (OTP) to access critical environments, other solutions are based on personal certificates that accredit the user who owns them, coordinate cards to validate processes and a multitude of systems that do not guarantee the identity of the user. Since recently, With the appearance of the digital ID, it is intended to validate these accesses or user verification processes through this system, the problematic of this solution is great, verification by an external entity of those certificates (delay of operations), need of a reader in each team from which requires access (does not allow mobility), is an official document so you cannot force its use in unofficial environments, etc.

In addition, and as a background to all these solutions that are appearing, none of these alternatives proposes a complete solution to identification processes via the Internet because for all of them the user needs to write some type of identifying data (which can be captured or impersonated), install some software or certificate on your own team which limits the place from which to access our environments and exposes security, or require the use of terminals additional that allow the use of these solutions.

With all this, it can be seen that solutions that currently exist in the market, not only not solve security problems, but also add difficulty of use

Description of the invention

For everything seen in the previous section, it would be desirable to obtain a solution that completely ends the insecurity and the difficulty of the processes through Internet, eliminating, as far as possible, the interaction of user, allowing safe use from any computer, that the process does not require the writing of any identification of the user to eliminate any type of computer attack on that meaning, do not install anything on the computer from which the communication so as not to expose the security and to guarantee the Security and mobility of processes. In short, a system easy, convenient and safe that will increase the use of the Internet for processes that currently have some risk due to theft of credentials as well as facilitating the hiring of services.

As a consequence of these needs, the The present invention is based on a USB device, standard system of communication, which gives mobility to the solution, with a fingerprint reader that verifies the identity of the Username.

In addition to this and to ensure process safety, simplicity of use and comfort, the device is equipped with a microprocessor and a memory where all the programs, drivers and other components necessary for the correct operation of the solution are executed. Thanks to these systems that run inside the terminal itself, the user must only insert the USB device into the port and he will generate all the communications
necessary instructions to allow the processes, without any interaction by the user or additional installation.

In the following points, several characteristics of the present invention.

1. Usb device (1) with fingerprint reader (2) digital that allows secure access to critical environments thanks to a microprocessor (3) one or more memories (4) and a chip cryptographic (5). In addition to this, the device has a additional component (6) with a screen (7), a power button (8), and a battery (9) that allows authentication without requiring that the device is connected to any computer.

2. Internally the device has a software installed in itself that performs the actions of the system. First of all the application that we are going to access generates a request to the device and when it detects that communication will indicate that the user slides his footprint along the reader, such as when connecting the device to the computer and receiving current, the system turns on, the same terminal starts the communication with the team, so the installation of the device is transparent to the user. The passage of the footprint by the reader (1) triggers a comparison process with the footprint (HASH algorithmic code) that is in a repository located on the cryptographic chip (5) duly protected and that has been entered at the time of device startup. Before a positive check, the software itself generates a password of a single use sending, in addition to that password, the fields, previously provided, which are required of the certificate, so that this way and without the need for the user to enter any data, the system can recognize the person using the device. In the event that several certificates coexist in the same device, the external request that starts the process at implicitly the required fields of the certificate only goes to look for the necessary for that process.

This process is repeated at the time of signature digital, that certificate that is located inside the chip cryptographic (5) will be required by the application to which we have accessed, at a certain time, the process will try collect the certificate inside the device, but when accessing that request to the device, as any access is protected with the fingerprint, the system will indicate that in order to sign digitally requires the passage of the fingerprint through the reader (2) and its subsequent verification. That verification will trigger, thanks to software developed for this purpose, the process of firm.

Before a negative verification of the footprint, the system will not execute any program associated with the process of authentication and may execute another intended for this purpose, such as It can be to issue a report, device formatting, blocking, etc.

3. In addition to the device's own part, described in point 1 and of the internal software you need for the correct operation, described in point 2, the system needs a software on the host or server side. In the case of the single-use password that gives access to different environments, it it will require software that verifies those codes and validates the process. Special software will also be needed to manage the certificate generation processes within the chip (5) and that Enter those fingerprints (HASH) on the devices. On the other hand, In addition to this software required in the host environment, the solution requires a remote management system for those devices that allow certain actions such as formatting, blocking, update, etc ...

4. Another important aspect in the use of Device is telephone banking. Thanks to the screen, to the battery and the button available to the device and all its software associated, the user will be able to access their environment through the credentials that the system will give you, always generated with the fingerprint slippage by the reader and its validation that will trigger a verification process in the host environment that check the validity of those credentials issued by the device to ensure your safety.

5. The system will work as a means of payment verifying the processes with the passage of the footprint, this and by your internal software will generate a necessary user verification For any payment process.

6. Regarding access to different applications or to the operating system itself, the device can function as triggering part of that accreditation process. The software internal, after verification of the user's fingerprint, will communicate with the system to send the user's credentials and thus access, without requiring any type of additional accreditation

7. The device can function as container of mobile user profiles, being able to introduce these profiles and provide users with the ability to use different computers with the same credentials, programs, settings, rights, etc ..., as if in Your own team.

8. Due to the internal design of the device, in he can accommodate one or more environments that will have the effect of operating systems operated within the device itself, being able to access them from the real team and being able to interact with both at the same time, taking into account that introduced within the virtual environment you will always be protected with the footprint and can be accessed from any computer provided be connected

9. In addition to these uses, the device always may be used as a data container protected with the fingerprint.

Brief description of the figures

Fig. 1 shows an embodiment of the invention as a device with USB connection (1) that integrates a reader of fingerprint (2) with a microprocessor (3) and some memories (4) and also incorporates a cryptographic chip (5). The device optionally shows status indicators (10).

Fig. 2 shows the components in detail above and their relationship.

Fig. 3 shows an embodiment of the invention as a device with USB connection and viewfinder (6) that integrates a fingerprint reader (2) with a microprocessor (3), memories (4) and incorporates a cryptographic chip (5), also incorporates a screen (7) as a viewfinder.

Detailed description of one embodiment

The present invention relates to a new device that through a fingerprint reader, a microprocessor and a memory, will allow secure access to computer environments that require authentication of the user, electronic signature of documents using a chip cryptographic that guarantees its validity and a software associated with everything This allows the operation of the device without the need for install anything on the computer it connects to.

In addition to these basic functions, the device has an additional option providing it with a screen and a power button, which through a battery provides the functionalities necessary for other authentication processes No need to be connected to any equipment.

The device consists of four parts differentiated:

-

Reader Fingerprint: With this system we ensure that the person who use the device is who claims to be uniquely.

-

Microprocessor with memory: Thanks to This device can be installed, in itself, everything necessary for proper operation without running nothing on the computer where you connect and perform actions so autonomous without user interaction.

-

Chip Cryptographic: With this cryptographic chip based on all safety standards such as Common Criteria V2.2 level EAL 4+ and 5+ by CCN, the X509 standard of digital certificate formats, the FIBS standard level 4, etc ..., processes will be able to be carried out of digital signature legally.

-

Option additional: System independent of the base device, which by a screen, a power button and a battery, provides the functionalities required for other authentication processes without Need to be connected to any equipment.

       \ vskip1.000000 \ baselineskip
    

Possible uses of the device:

-

Access secure to bank websites without installing anything in the equipment. The operation would consist of accessing the website, select secure access, insert the device into the port USB and pass the fingerprint through the reader. This will generate within device the necessary processes for, through a communication secure, allow access to the user's personal environment without This has entered no personal data.

-

Firm electronic documents. Any electronic signature process will be can be done only with the step of the mark by the reader and his subsequent verification, because the internal software will recognize that request and will trigger the necessary processes for that signing process through certificates located on their own cryptographic chip

-

Access to telephone banking. Through the additional option provided by the device and thanks to the screen available, we can access to our banking environment by telephone and securely due to a internal key generation process that will be triggered with the passage of the footprint by the reader and its subsequent check.

-

Means, medium of payment in electronic commerce.

-

Access to applications prior to the process of verifying the fingerprint by the device.

-

Access to operating systems after fingerprint verification process by the device

-

Container of the mobile profiles of the users. With this system the user could take his profile of user from one computer to another without losing data and with all its Personal characteristics.

-

Computer environment container real or virtual Due to the internal design, the device may contain van operating system with which to interact from the real one, being able to coexist two differentiated environments and being able to develop safe activities that require mobility from the environment resident.

-

Data container protected with the paw print.

       \ vskip1.000000 \ baselineskip
    

Glossary

one

USB device

2

fingerprint reader

3

microprocessor

4

memories

41

RAM

42

Flash memory

5

cryptographic chip

6

additional component "to adapt" to USB device with a screen

7

screen

8

power button

9

drums

10

LED status indicators.

Claims (10)

1. Device with fingerprint reader for access in secure environments characterized by comprising:

-

some connection means to an external device,

-

some reading means (2) for reading biometric information from a person,

-

some processing means (3) configured to process the biometric information according to a routines stored in a memory (4) and to obtain a set of biometric data associated with the biometric information read,

-

some encryption means (5) configured to verify the identity of the person from the biometric data set using the comparison of said data set with biometric data stored in said encryption means (5),

-

the encryption means (5) configured to generate a password for Unique use (OTP) credential of the verified identity that allows the access to a repository of protected information contained in these encryption means (5) and containing encrypted data associated with the validated person

         \ vskip1.000000 \ baselineskip
      

2. Device according to claim 1, characterized in that the protected information repository of the encryption means contains biometric information previously obtained in the registration and registration of a person. 3. Device according to any one of the preceding claims, characterized in that the encryption means are based on at least one of the following security standards:

-

common criteria V.2.2 level EAL 4+,

-

common criteria V.2.2 level EAL 5+,

-

X509 of digital certificates,

-

FIBS level 4.

         \ vskip1.000000 \ baselineskip
      

Device according to any one of the preceding claims, characterized in that the encrypted data contained in the repository of the encryption means (5) comprises a digital signature certificate. 5. Device according to any one of the preceding claims, characterized in that the connection means comprise a USB connector. 6. Device according to any one of the preceding claims, characterized in that it further comprises a screen for displaying information related to the validation of the person. 7. Device according to any one of the preceding claims, characterized in that it comprises a battery. 8. Device according to any one of the preceding claims, characterized in that during its connection with an external equipment, the verification operations are carried out locally through the internal components of the device itself. Device according to any one of the preceding claims, characterized in that the encrypted data contained in the repository of the encryption means (5) comprise a plurality of fields associated with at least one profile of the person. 10. Device according to any one of the preceding claims, characterized in that the processing means are configured to communicate, after the identity validation, the credentials obtained and / or data contained in the encryption means with a remote server of Safe Mode.