LT5344B - Secure biometric verification of identity - Google Patents

Abstract

A high security identification card includes an on-board memory for stored biometric data and an on-board sensor for capturing live biometric data. An on-board processor on the card performs a matching operation to verify that the captured biometricdata matches the loccaly stored biometric data. Only if there is a positive match is any data transmitted from the card for additional verification and/or further processing. Preferably, the card is ISO Smart Card compatible. In one embodiment, the ISO SmartCard functions as a firewall for protecting the security processor used for storing and processing the protected biometric data from malicious external attack via the ISO SmartCard interface. In another embodiment, the security processor is inserted between the ISO SmartCard Interface and an unmodified ISO SmartCard processor and blocks any external communications until the user's fingerprint has been matched with a previously registered fingerprint. Real-time feedback is provided while the user is man

Description

The ultra-secure ID card has a built-in memory for storing biometrics and a sensor for reading biometrics. The card processor performs a comparison operation to verify that the biometric data being scanned matches the locally stored biometric data. Only in the case of a positive result is the scanned data or card data sent for further verification and / or further processing. Ideally, the card is an ISO SmartCard compatible card. In one embodiment, the ISO SmartCard acts as a firewall to protect the security processor used to store biometric data and protect against malicious external attacks via the ISO SmartCard interface. In another embodiment, the security processor is sandwiched between the ISO SmartCard interface and the unmodified ISO SmartCard processor and blocks any external communications until the user's finger is compared to a previously registered fingerprint. Real time feedback is provided while the user is manipulating his or her finger over the fingerprint sensor, thereby facilitating positioning of the finger over the sensor. The card can be used to provide a connection to the transaction network or to obtain permission for physical access to the secure area.

Globalization and, in particular, Internet technologies make it easier to access data, including financial, medical, personal data, and to conduct financial and other transactions quickly, where confidential data is updated or exchanged.

it is common to keep such data confidential with passwords, but most passwords use a birth date or a phone number that is easy to guess and therefore unsafe. In addition, even complex random passwords are often stolen. In this way, password data systems are not protected against criminal hacking, which puts the industry and the economy and even human lives at risk. Consequently, an improved way of securing data and protecting it against unauthorized access is required.

Biometrics can include precise details that are difficult to grab but easy to analyze (such as fingerprint details), or entire patterns that are easy to grab but difficult to analyze (such as distances between adjacent spiral strands of fingerprints).

Currently, encryption algorithms are being developed that require a digital key that is restricted to authorized users. Without a proper key, the encrypted data can only be decrypted into a proper format after a considerable amount of time and effort, and only when certain characteristics of the unencrypted data are known (or at least predictable).

Japanese patent application JP60-029868 of Feb. 15, 1985, to Tamio SAITO describes an identity verification system that uses an identity card with an integrated memory to register encrypted biometric cardholder data. The biometric data may be voice, fingerprint, physical appearance and / or bioassay data. Card data is retrieved and decrypted during use for comparison with the corresponding data taken from the card issuer. Such a system allows for a fairly accurate identification of the registered individual. However, since the biometric data is read and processed by an external device, it is difficult to protect the data stored on the card from tampering and / or theft.

An improved identity verification card with a data-driven multiprocessor chip is known, providing a security firewall that encrypts and insulates the biometric data stored in the card, thus significantly protecting against unauthorized tampering with the card. However, the actual comparison process was performed on the same external scanner terminal that reads live biometrics and is potentially not protected from malicious external actions.

The high security identification card described in the first embodiment has not only a local biometric storage memory, but also a local sensor for reading live biometric data. The remote authentication system has a secure database with biometrics. The card processor performs a preliminary check to verify that the biometric data being scanned matches the biometric data stored on the card. Only in case of a positive result, the scanned data or the data stored in memory is sent to the remote authentication system for further comparison and further processing. To protect against malicious attack, the data stored on the card is optimally different from the data stored remotely, and both the card and the remote data are compared using different comparison algorithms. Therefore, if an unauthorized intrusion attempt is made to the card or to the local terminal to which the card is connected, there is a good chance that the remote authentication system will be able to detect this intrusion attempt.

The card described in the second embodiment also has a local memory for storing biometrics, a local sensor for reading live biometrics, and a local processor. However, in this embodiment, the entire comparison process is performed on a local processor and both live-read data and other "private" information stored in the card memory are not accessible to any external process. In this case, only a confirmation message is generated if the newly scanned biometrics and the previously scanned biometrics match. This confirmation message allows the card to function in a similar way to a standard ISO SmartCard after the successful / unsuccessful introduction of a standard Personal Identification Number (PIN), but with the added protection of a more secure verification process. In either of these embodiments, the biometrics stored on the card and any associated decryption algorithm or key are optimally stored on the card at the time of issuance to the card in a manner that prevents access to the card, further improving the integrity of the card's biometrics process.

In one embodiment, the ISO SmarCard acts as a firewall to protect the security processor used to store and process biometric data from external hacking via the ISO SmartCard interface. In another embodiment, the security processor is sandwiched between the ISO SmarCard interface and the unmodified SmartCard processor and blocks any communication to the exterior until the user's fingerprint is matched with a previously registered fingerprint.

In one embodiment of the high security identification card with the card's fingerprint comparison feature, real-time feedback is provided, whereby the user manipulates a finger over the fingerprint sensor, thereby facilitating optical finger positioning above the sensor. This feedback not only facilitates computation, but also provides additional tools to distinguish between the inexperienced user and the dishonest user, and thus reduces the likelihood of the first and / or second cases. In another embodiment, the fingerprint sensor is provided on a carrier for added rigidity.

In one of the. The biometrics and / or cardholder identities scanned in the present variants are encrypted and entered into an operating network consisting of a financial institution and a separate authentication server before accessing confidential data or any automated process for performing a secure transaction. In another embodiment, the card output is used to physically enter the secure area. In either of these, successful and unsuccessful attempts can be logged either on the card, on the external security server, or both.

Figure 1 illustrates one embodiment of a SmarCard for verifying a person's identity.

Figure 2 is a diagram illustrating a process for assisting the user to place a finger over a fingerprint sensor.

Fig. 3 is a functional block diagram of a biometric verification system capable of identifying a person presenting an identification card both locally and remotely.

Fig.4 is a functional block diagram of a biometric verification card with different physical data paths for use in retrieving biometric data from a primary cardholder and transmitting the cardholder's identity to remote processing

Fig. 5 is an alternative embodiment of the biometric verification card of Fig. 4, which is for use with an unmodified ISO SmartCard processor.

Fig.6 is a diagram showing the relationship between a sample application and a sample verification card, where only the cardholder's identity is verified locally.

Figure 7 is a diagram similar to Figure 6 modified for use with the biometric verification card of Figure 5.

Fig. 8 shows a second embodiment of a SmartCard with biometric verification which can be connected to a local terminal either wirelessly or electrically.

Fig. 9 is a cross-sectional view of the card of Fig. 8.

Fig. 10 is a diagram of a fingerprint sensor.

Fig. 11 is a representation of Fig. One embodiment of the sensor carrier of Fig. 10.

SmartCard

As used herein, the terms "smart card" or "intelligent card" generally mean any physical object that is small enough to be held in a hand, worn, necked or otherwise, and which has a microprocessor , which can store, process and send digitally encrypted information related to a specific cardholder. One example of such a card is an ISO (International Standarts Organization) SmartCard, which is a regular credit card in size and shape, but has a pulsed memory for storing user data and a microprocessor that can be programmed by a powerful encryption algorithm that points to or receives from the terminal, the PIN (Persons Identification Number) corresponds to the PIN on the card, ensuring that the person presenting the card is the actual cardholder than is possible with a verification system that simply visually checks the similarity between signatures and physical appearance .

Fig. 1 shows one embodiment of a SmartCard with biometric verification implemented therein. Card 1 is usually made of plastic and is similar to a regular credit card, measuring approximately 53.98 x 85.6 mm by ISO 7816 and having a thickness of approximately 0.76 mm or more.

Similar to a regular credit card, card 1 has a free top area 2 that extends across the entire length of the card to accommodate the magnetic stripe (as specified in ISO 7811-2 & 7811-6) on the back of the card where standard alphanumeric information can be recorded. about the cardholder and any associated account, ensuring that Card 1 can be read by a standard magnetic card reader. However, since any information recorded on magnetic tape can be easily changed, such magnetic tape is for limited use, where backward compatibility with older magnetic tape terminals is more important than the security that magnetic tape cannot provide to the system.

The top area 2 can also be used to provide various security features such as a fake color card holder image and / or a card issuer holographic mark. The lower area of Card 1 can be used in the usual way for information such as the cardholder's name, account (or card) number, expiration date, embossed (as defined in ISO 7811-1), so that Card 1 can be processed as usual printer.

The upper region 2 and the lower region 3 are separated by a central region 4, which is provided with a group of eight visible ISO SmartCard contacts 5, which provide a normal electrical connection between the card and the corresponding card reader contacts. They ensure the transmission of not only data, but also power, time and control signals between the reader and the card as specified in ISO 7816-3.

On the right side of area 4 is a sensor 6 which is used to scan the cardholder's fingerprint. Ideally, the card is provided with a unique ID code that is compatible with sensor 6 and other electronic components provided on the card, such as a standard IP and / or MAC address format code.

Also, the card shown in FIG. 1 is provided with a number of additional electronic components which, together with the contact group 5 and the sensor 6, provide the card with more functionality and, in particular, security than could otherwise be achieved.

In one embodiment of the invention, the ISO SmartCard-compatible processor 7 is directly coupled to the contact group 5, thereby enabling it to be connected to an unshown external ISO-compatible card reader not only to supply card electronics but also for data transfer between the card and any any external communications programs, security programs, transaction programs and / or other applications installed on the card reader or any computer device associated with the card reader.

Although in the embodiment described the data path between the card 1 and the external card reader is wired using the ISO specified SmartCard card contact equipment, it is obvious that other embodiments may employ other communication technologies such as USB or RS 232C or SPI (serial) connections via wireless RF (radio frequency), microwave and / or IR (infrared) communication channels.

In addition, while in the embodiment described the card is powered by a card reader, other cards may have a power source such as a solar battery or a battery incorporated in the card. Such an on-board power source is useful when, for example, the mechanical connection between the card 1 and a particular type of card reader is such that the user cannot access the fingerprint sensor 6 when the contacts 5 are connected to the respective connectors inside the card reader. Thus, the user's fingerprints must be read when card 1 is not directly connected to the card reader.

Security processor

As can be seen in the figure, the security processor 8 is connected between the ISO processor 7 and the sensor 6 and is designed for the secure processing and storage of the scanned data as well as a firewall preventing unauthorized access to data and programs stored on its dedicated memory via the ISO processor 7, as will be described below. Such a firewall may be designed to pass only encrypted data using an encryption key based on a unique dedicated network address or otherwise unique to a particular card, such as data previously stored on a fingerprint pattern or a unique assigned device number such as a CPU (CPU) or fingerprint sensor number. In another embodiment, the firewall skips only data that has unique identification data from a previous transmission or data. In yet other embodiments, the firewall applies different keys to different operations and uses these keys to redirect data to the corresponding different partition of the processor or memory.

In another embodiment not shown, the protection processor 8 is directly connected to the ISO contacts 5 and acts as a protection filter between the ISO processor 7 and the ISO contacts 5. Such additional installation provides the additional protection provided by the protection processor 8 and sensor 6 without compromising any protective functions, which can already be incorporated into an ISO processor 7.

The security processor 8 optimally has non-volatile semiconductor or non-semiconductor memory such as FRAM, OTP, E ² PROM, MRAM, MROM for storing previously scanned fingerprints and / or other biometric information. In other embodiments, some or all of the features of the security processor 8 may be implemented in the ISO processor 7 and / or some or all of the features of the ISO processor 7 may be implemented in the security processor 8. Such a combined implementation will maintain a firewall between various functions the device has a process in place that prevents any subsequent modification of the recorded programs. Alternatively, both processors 7, 8 may be separate processors in one multiprocessor device designed to protect each process from interference from any other process taking place in another processor. One example of such a multiprocessor device is the Sharp (Japan) manufactured DDMP (Data Driven Multiple Processor) device.

Although these various sensors, contacts, and other electronic components, as well as printed circuits or other electrical connections to which they are interconnected, are fully incorporated inside the housing of the card 1 in such a way as to protect against wear and external contamination, the optimum location 4, between the upper region 2 and the lower region 3 further protects them from possible damage by conventional magnetic tape counters, stamping machines, and printing devices that mechanically contact all of these regions.

LEDs

The LEDs 9a, 9b are controlled by the security processor 8 and provide the user with visual feedback. In this illustrated example, they are located in the lower region 3, preferably at the edge of the card furthest from the contacts 5. In any case, the LEDs 9a, 9b are positioned where they will not be damaged during stamping and where they will be visible when the card is inserted into a standard ISO SmartCard reader and / or when the user's finger is placed on the fingerprint sensor 6. For example:

In verification mode:

• blinking RED: waiting for finger placement • stopped blinking: finger on sensor • RED blinking once: cannot compare, moving finger • green blinking once: compared, OK, removable finger

In registration mode:

• GREEN blinking: waiting for finger placement • stopped blinking: finger placed on sensor • RED blinking once: cannot register, finger moving • GREEN blinking once: OK, removable finger

In delete mode:

• GREEN and RED blinking: ready to delete • GREEN blinking once: deleted

Ideally, the user is allowed to place his or her finger on the sensor multiple times for successful comparison or registration before transmitting a negative message. In one embodiment, a negative message is issued only if the user has removed his finger without receiving a green OK signal, or if a predefined time limit has been exceeded. Not only does this process teach the user to properly place their finger over the sensor, which not only simplifies the calculation, but also allows for more differentiated thresholds. This visual feedback allows you to psychologically differentiate an inexperienced user (who will usually try as many times as he or she has properly placed his or her finger over the sensor) with the phony (who usually does not pay attention and leaves until his or her malicious intentions are revealed). The end result is the significantly reduced likelihood of false negatives and / or false positives.

Fig. 2 illustrates an exemplary process for assisting the user to place his finger on the sensor 6. In the position containing the unit 10, the red LED 9b flashes. When the finger is detected (block 11), the LED stops blinking and the image quality test (block 12) is performed (elongated areas corresponding to finger skin bumps and indentations are detected). If the quality is poor (NOT on branch 13), one blink of red LED 9b instructs the user to move their finger to another position (block 14); otherwise, (YES at branch 15), a second test (block 16) is performed to determine if the same finger used to register the user is placed in the same location so that a relatively simple comparison algorithm can verify that the live data is within certain limits. memory data such that the live finger is the same finger that was recorded (YES at branch 17) and activates the green LED 9a (block 18) for a period (block 19) sufficient to verify that the comparison was done successfully and the user can now remove his finger. Alternatively, if the comparison did not meet the set limits (NE branch 20), a single blink of the red LED 9b instructs the user to reposition their finger and the process is repeated.

Examples of network structures

Figure 3 illustrates one possible embodiment of a biometric verification system capable of performing both a local and a remote person presenting a secure identification card. It consists of three main components: Client Terminal 21, Application Server 22 and Authentication Server 23. Client Terminal 21 provides live scanning and processing of user fingerprints, encryption processed data, and secure optimum access via the Internet using IP / TCP addressing scheme and communication The protocol communicates with the application and authentication servers protected from unauthorized access by conventional IP firewalls 24. In other embodiments, firewalls 24 may have filters and encryption / decryption devices that encrypt verified transmitted data, converting it into authorized data, and decrypting the received data. before making sure it is actually authorized data, using an encryption algorithm such as

DES128. By these means, firewall 26 can distinguish authorized data from potentially malicious not only the message header, but also the message content.

Client Terminal 21 may be implemented as a dedicated network device or may be implemented in a program installed on a programmable desktop or portable computer or other workstation or PC having standard Windows XXX, OS X, Solaris XX, Linux, or Free BSD operating systems. Ideally, client terminal 21 has up-to-date "negative" databases (such as a list of lost or stolen cards, card or card group constraints) that provide additional safeguards.

The application server 22 performs transactions or otherwise responds to instructions from a remote user at the user terminal 21 after the authentication server 23 has confirmed the identity of the user. The authentication server 23 securely communicates with both the client terminal 21 and the application server 22 for storing authentic fingerprint data and other information related to previously registered users, comparing the stored data to the encrypted live data received from the client terminal. 21, and application server 22 for informing whether the specified fingerprints match or do not match the stored fingerprints.

More specifically, the client terminal 21 additionally has two main components: a fixed card reader 25 having a web browser terminal 26, a card reader interface 5a (which can be a simple USB cable with electrical connectors at the back for connection to ISO SmartCard card contacts 5). ) and the Portable SmartCard Component T. In one embodiment, the Portable Component T may be a SmarCard 1 described above having a fingerprint sensor 6, a security processor 8, and an ISO SmartCard card processor 7.

The application server 22 further has an Internet server interface having a firewall 24 and a web browser 27, as well as a transaction module 28 and a validation module 29. In case the application server and application module 28 are devices that are not intended to communicate externally with the IP. / TCP protocol, firewall 24 can be replaced by a corresponding protocol converter having a validation module 29 and a fixed IP address. The application server may be managed, for example, by a third party seeking to provide the service to an authorized user over the Internet.

The authentication server 23 further includes an Internet server interface 30, a processing module 31 having a fingerprint comparison algorithm 32, and a database 33 for storing fingerprints and other authentic information collected from users at the time they register with the system, for system operation only. For security reasons, each personal data is not stored on the application server as a simple sequence of information, but each entry is recorded individually and any necessary indexes or relationships linking these records are only accessed with the appropriate key that forms part of the personal private data authentication server.

Place

In certain embodiments, the fixed scanner 25 and / or the portable card 1 "may include a built-in Global Positioning Satellite (GPS) receiver 34, which may provide useful information about the current position of the scanner and card at or about a specific action was taken. In particular, position data from the GPS receiver 34 may be used to deactivate (permanently or temporarily) the scanner and / or the card if any of it is moved to an unauthorized location. Alternatively, positioning can be done automatically by other means than GPS, such as using PHS (Japanese cell phone) caller location technology or positioning sensors that respond to local changes in the earth's electromagnetic fields. If the card has a GPS receiver, the various GPS components, including the antenna, signal amplifier, A / D converter and digital processor for calculating position, form part of a single integrated circuit or are separate devices mounted on a single card that is integrated with the card body, built into or laminated with it.

Structure of an ISO card with a built-in comparison function

ISO processor interfaces

Fig.4 is a functional block diagram of an exemplary ISO SmartCard-compatible biometric verification card 1 or T with different physical data paths for use in the initial processing of the cardholder's biometric data and the cardholder's identity check for remote processing.

In addition to the ISO processor 7, security processor 8, fingerprint sensor 6, LEDs 9a, 9b and optional GPS receiver 34 described above, when only the ISO processor 7 is directly connected to the card reader 25 via ISO SmartCard pins 5, a separate charging is shown here. a terminal 35 and a temporary connection 36 associated therewith, which provides a direct connection to the security processor 8 during initial user registration. It should be noted that the ISO processor 7 communicates with the protection processor 8 via the I / O ports 37, 38, while the temporary charging connector 36 is connected to a separate I / O port 39. The protection processor is optimally programmed so that any important and related with security, the data or software is only accessible from port 39 and not from ports 37 and 38, thus preventing any possible malicious attempts to access this important data after the connection 36 is disconnected.

Most popular ISO processors have at least two I / O ports, some have at least three. Only one of these ports (l / O 1) is used to connect a standard SmartCard serial data connector 5 to an external ISO-compatible card reader 25. One or two additional l / O ports optimally provide dedicated wired communication between the ISO processor 7 and the security processor 8, which acts as a hardware barrier to block any malicious attempts to reprogram the security processor 8 or access any important information that may have been previously retrieved by sensor 6 or otherwise stored in processor 8. In this particular case, where the ISO processor has more than two l / o lines, more than two static status information can be provided in dedicated communication path between ISO processor and security processor such as 1) Ready, 2) Busy 3) Error, and 4) Done even when protection the processor is completely disconnected from the power supply. Of course, even if there is only one l / O port, these four conditions can be transmitted dynamically as serial data.

The possible commands and data that can be transmitted between the ISO CPU and the protection CPU via the ISO interfaces I / O2 and I / O 3 are as follows:

• Commands to register or determine the user identity under which the protection CPU will send the logging or authentication result to local storage and / or forward to remote customization.

• Fingerprint information as a template (link) can be sent from the protection CPU to the ISO CPU for storage in the ISO SmartCard memory for subsequent transmission for remote use.

The charging connector 36 provides a direct connection to the security CPU 8, which bypasses any firewall provided for the ISO connector and associated dedicated I / O ports 37 and 38, while maintaining communication between the ISO CPU 7 and the ISO reader 25 so that power is provided to the protection CPU 8. This is primarily used during the initial card registration for a specific user and should protect against unauthorized access.

Fig. 5 shows an alternative embodiment of the biometric verification card of Fig. 4, which is intended for use with an unmodified ISO smartcard CPU. Specifically, the ISO CPU 7 'is no longer required to perform any network interface functions between the card reader 25 and the protection CPU 8', either during normal use or charging, and as such may be any ISO approved chip, in no way modified and used only in a way that is absolutely accessible to both the card reader 25 and any external application. In this embodiment, the security CPU 8 'acts as a transparent barrier between the ISO CPU 7' and any external application if the scanned fingerprint matches the stored data and blocks all communications if the scanned fingerprint data does not match the stored data.

Card initialization and data protection

In one embodiment, the original card has a protruding extension of the printed circuit, which allows it to be directly connected to the security CPU as well as to parts of the ISO interfaces and / or to any individual card memory. This direct connection interface is only used for card testing and fingerprint logging and has a signal that allows the registration process to take place. After registration is complete, the schema extension is mechanically cut off so that no subsequent registration can be made, and the protection CPU memory can only be accessed through the ISO CPU and the aforementioned firewall between the ISO CPU and the protection CPU.

Fuse

In another embodiment, the security CPU has the kind of memory that becomes unavailable after fingerprint registration. One example of such memory is the single-use PROM (OTP) memory, which is similar in design to EEPROM but UV resistant and therefore cannot be erased. Another example is Flash ROM memory, which is made read-only after the registration procedure, for example by supplying sufficient current to the authorization, address or data signal path, forming a physical break ("fuse") in this signal path.

An example of an authentication process

In one embodiment of the invention, the authentication process comprises scanning physical data of fingerprints using, for example, optical pressure, conductivity, capacitance, acoustic, elastic, or photographic technologies in a client terminal used by a person to contact the application server, which is subsequently transmitted. (ideally encrypted forms) to a separate fingerprint authentication server. The Fingerprint Authentication Server compares the scanned fingerprint data with the logged user fingerprint data in the file using the authentication software and, if the data overlap, sends the step-by-step instructions to the application server.

In another embodiment, the user accesses a secure fingerprint authentication server network browser containing fingerprint data files, wherein all fingerprints are pre-registered with personal data such as name, address and date of birth. The secure fingerprint authentication server, which is accessed by the user through a secure protocol such as the HTTPS format, then sends instructions to the client terminal to retrieve the user's fingerprints. Responding to the instructions displayed by the client terminal browser, the user places the selected finger on the fingerprint sensor, and the fingerprint scanner on the client terminal reads the fingerprints digitally, such as 25-70 microns pixels in a 12.5-25mm ² area 8 bit gray image.

Secure Fingerprint Authentication Server accepts fingerprint data along with user ID as well as Internet IP address and / or fingerprint sensor unique code (MAC address) and / or "cookie" and / or unique code or other information, identifying an individual or terminal (e.g., details from a previous conversation between the client terminal and the secure fingerprint authentication server), after which it compares the received fingerprint data with the fingerprint contained in a file that is pre-recorded with the user ID, personal information such as name, address, date of birth, criminal record, driver's license, Social Security number, etc., using an authentication program, this can be a detailed or quick comparison of the Fourier transformation.

At the beginning of the authentication process, the network server 27 instructs the user to place his or her finger on the fingerprint scan sensor 6 with image or sound and press the mouse or keyboard button to initiate the fingerprint scan program on the security processor 8. The scanned user finger data is then sent in encrypted format ( such as using secure r

RSA encrypted transmission protocol HTTPS) to the Fingerprint Authentication Server 23 Network Server 30 via the client processor 21's ISO processor 7 and network browser 26. If the scanned data matches the corresponding data in the database 33, the Fingerprint Authentication Server 23 gives the user access to client terminal 21 and application server 22.

An example of an optimal embodiment using a three-step authentication protocol and a one-time password as a random character encryption sequence will now be described with reference to FIG. 3:

• The client terminal 21's network browser 26 directs to the corresponding application server 22 network interface 27 to request an application process 28.

• In response, application server interface 22 of the server 22 provides LOGIN information and corresponding application process 28 instructions.

• The client terminal 21 instructs the ISO processor 7 to activate the security processor 8.

• ISO processor 7 activates protection processor 8.

• The security processor 8 waits for the fingerprint data from the fingerprint sensor 6 and, when the appropriate data has been received, to output a digital fingerprint pattern that is transmitted to the web browser 26 via the ISO processor

7th

• The web browser 26 sends an encrypted version of the provided fingerprint pattern to the authentication server 23 along with information related to the used card 1 'and card reader 25 such as user ID, client terminal 21 address and / or sensor 6 ID code (MAC). address).

• The network interface 30 of the Authentication Server 23, upon receiving the provided fingerprint pattern along with other information from the client terminal 21, forwards this information to the fingerprint comparison processor 31.

• The fingerprint comparison processor 31, controlled by the comparison program 32, uses the received user ID or other user descriptive information to find the corresponding fingerprint pattern in the database 33 and compares the scanned fingerprint pattern to a specific fingerprint pattern.

The result (matched or mismatched) is stored in the access archive along with other information identifying the terminal 21, the user ID, the card 1 'and the requesting application module 28, and the response is returned to the authentication server network interface 30.

• If the result matches, the authentication server network interface 30 generates a one-time character string request password that is passed to the client terminal 21 and uses this query character string as a random character code to encrypt the associated information, which it stores as a corresponding response to the request. for future action.

• The client terminal 21 uses the accepted query character sequence as a random character code to encrypt an unencrypted copy of previously stored related information, which it then transmits to the web server 27 of the application server 22 as part of its log-in logging process.

• The application server network interface 27 of the server 22, after receiving the converted random character related information, forwards it to the application module 28, which links it to an attempt to register from the client server and forwards the related information received to the client terminal for confirmation. random characters using the query sequence provided by the authentication server as a response to the request.

The network interface 30 of the authentication server 23, upon receiving a response from the application server, forwards it to the authentication process 31, which compares it with a previously stored copy of the expected response to the request to determine whether the user is actually identified.

Any identified user information obtained from this comparison is then returned to the application process 28 via the authentication server network interface 30 and the application server 22 validation module 29.

• The validation module 29 uses authentication to confirm the user identity set in the initial attempt to register.

After authentication of the user identity, the authentication module 28 communicates directly with the client terminal 21's network browser 26 through the network interface 27 of the application server 22.

Figure 6 provides an alternative embodiment of the authentication process wherein the comparison is performed by the security CPU on the ISO compatible card shown in Figure 4 and no external authentication server is used.

23. The left side of Fig. 6 shows the functions performed by Application Server 22 and the right side shows the functions performed by the ISO SmartCard 1.

When the SmartCard is inserted into the card reader 25, the RST reset signal is sent from the card reader to both the ISO CPU (START unit 40) and the fingerprint CPU 8 (fingerprint verification unit 41) and both receive power from the VCC. card reader 25. The ISO CPU then responds with an ATR (Answer-to-Reset) message and communicates with the PPS (Protocol and Parameter Selection) as needed (Block 42). At the same time, the fingerprint CPU goes through (waiting state and waiting for fingerprint data, and performing the authentication process when the data is received from sensor 6 (block 43)).

When the application module 28 sends the initial request to the ISO CPU 7 (block 44), the ISO CPU requests (block 45) the protection processor about the authentication status. If the answer is positive, the ISO CPU responds to the application module request by executing a command (block 46). Otherwise (after receiving an error message or receiving no response from the protection CPU 8), it does not respond but waits for a new initial request (block 44b).

If the fingerprints were verified and the first response was received on time and the application module 28 was found to be responsive to it (block 47), the request response process continues (blocks 48, 49, 50) until the predefined verification is exceeded. a break in which no requests were received from the application module (block 51) or the application module did not receive the expected response (block 52).

Figure 7 is a diagram similar to Figure 6 but modified for use with the biometric verification card of Figure 5. The left side of Fig. 7 shows the functions performed by application server 22, the next column represents the reader 25, the other column represents the ISO contacts 5, the other column shows the functions performed by the security CPU 8, and the right side shows the functions performed by the unmodified ISO SmartCard. Card CPU 7:

• When the SmartCard is inserted in the card reader or the application activates the card reader, the reset signal 53 from the card reader 25 is sent [protection CPU 8].

• Immediately after the reset CPU receives the reset signal 53, it sends the corresponding reset signal 54 to the ISO CPU

7. At the same time, the security CPU is waiting for the fingerprint data from the fingerprint sensor.

• Upon receipt of the reset signal 54, the ISO CPU prepares an ATR response 55 and then communicates with the PPS (protocol and parameter selection) as needed.

• When the security CPU 8 receives an ATR (Reset Positioning Signal) signal from the ISO CPU, it transmits it to the card reader (block 56), including any related commands.

• At the same time, if the security CPU receives the fingerprint data, it starts the authentication process described above. If the authentication test is positive (PASS), this status is maintained for a period of time. If the result is negative (FAIL), the protection CPU 8 waits for new fingerprint data.

• When the command is executed, command 57 is sent to the security CPU, which sends command 58 to the ISO CPU and also sends its exact response 59 to the card reader only if the security CPU status is still positive (PASS) or if the last correct response was a larger set of data bits (test block 60).

Otherwise (no branch 61), the fingerprint CPU generates a fake request 62 and sends it to the ISO CPU and also transmits the received ERR response 63 to the card reader 28, thereby maintaining proper synchronization between the sequence numbers in the requests and responses.

Encryption and protection

Before transferring data to any external network, all relevant data and / or authentication results are encrypted, if possible, using DES or TwoFish encryption. The encryption key is based on scanned or saved fingerprint data, user ID code, unique code assigned to the sensor, memory address, adjacent ^ data in memory, other functionally related data, previous conversion (transaction), IP address, terminal code, or password provided. Alternatively, important data can be transmitted over the Internet using the secure HTTPS protocol.

For better security, a virtual private network interface, such as DĖ hardware encryption and decryption, can be inserted between the secure fingerprint authentication server and the network connection point, and between the application server and the network connection point, respectively. If you use such a virtual network interface or VPN (Virtual Private Network), important data is additionally protected by an additional layer of encryption, such as DES 128 (commonly used in VPN VPN) and RSA (used by HTTPS).

For extra security, all communications can be wrapped with additional layers of security. Specifically, message headers in the bottom layer can be encrypted in the top layer.

Wireless

In other embodiments, a dual interface can be provided for both contact (ISO 7816) and wireless (ISO 1443 A or B) operation and, ideally, has a multiaxial power supply that operates between ISO 7816 contact, ISO 1443 A, ISO 1443 B, ISO 15693 and HID wireless systems (among others) on one card. The card may also provide the ability to use other wireless technologies, such as Bluetooth (short-range) or mobile (medium-range) or microwave (long-range).

Figure 8 shows a SmartCard for biometric verification that can be connected to a local terminal wirelessly or electrically. For the most part, its structure and construction is similar to the card described above in Figure 1, and like elements are denoted by the same numerals. The ISO CPU 7 is located in a different location below the contacts 5 but performs a similar function as described above.

The ISO antenna 64 has two loops, usually mounted at the peripheral edge of the card 1, and provides ISO compatible wireless communication with the ISO CPU 7 for data transmission and power supply, similar to the electrical connector 5. In addition, the security antenna 65 (installed, as described in the example, inside the antenna 64 and consisting of a single loop only), provides a separate power supply for the protection CPU 8 via a DC-DC voltage regulator 66. Since there is no direct wireless connection other than the ISO CPU 7, there is no risk of distorting important data stored on the CPU 8 . Alternatively, as mentioned above, with respect to embodiments having only wired connections to an external scanner and an external network, dual processor operation may be combined or external communication may be provided via a security CPU 8 rather than an ISO CPU 7, in this case the respective wireless protectors the means must be incorporated into the card structure so modified.

Fig. 9 is a cross-sectional view of the card of Fig. 8. Most of the described components are located in the central core 67, and only the contacts 5 extend through the top protective layer 68. The functional surface of the sensor 6 is accessed through the top window in top layer 68 and bottom window in PCB 69 mounted between top layer 68 and center core 67 which provides for a ²¹ EN 5344 B, an electric connection between the various electronic components and electrostatic discharge contact, covering the active area of the sensor 6.

The lower layer 70 and the magnetic strip 71 are also visible.

Fingerprint sensor

Fig. 10 is a diagram of sensor 6 in which a matrix 72 of sensor elements 73 is formed of rows 74 and columns 75. As shown in Fig. 10, each element 73 has an active input 76 and a transducer 77. Fingerprints are formed by finger skin bumps and indentations. Each sensor element transducer 77 is mechanically and / or electrically actuated, with one of these finger skin bumps directly touching the element 73 of the matrix 72, which produces a fingerprint image of changes in the micro-pressures formed by the bumps and recesses across the sensor surface. Although each transducer 77 is depicted as a separate capacitor of variable capacitance, there are various types of transducers that can respond to a single protrusion of human skin. In this particular pressure-sensitive thin-film piezo-converter, the film is deformed directly adjacent to the element and generates a charge which is stored in a capacitor connected to the element. The capacitor voltage is a function of the mechanical voltage formed by the deformation of the piezo-material, which in turn is a function of what is above the element: protrusion or recess. When the signal from the linked column driver 78 indicates that the cell input 76 is ON and the linked queue driver 79 is grounded, a voltage is generated at the end of the output line 80 that is converted to an 8-bit digital signal in the output driver 81. detection, the piezoelectric material may be formed on an elastic material such as polyimide or may simply be a polyimide piezoelectric material. Other analog converter technologies that can be implemented in a similar structure include variable resistances and variable capacitances. Alternatively, each element may consist of a single digital switch that provides only one bit of information. In this case, additional bits of information may be generated by placing more elements in the same area or by selecting each element at a higher frequency. Such an alternative embodiment does not require any A / D converters.

In the embodiment shown, the sensor is only 0.33 mm thick and is sufficiently wear resistant to be mounted on a SmartCard and is not affected by static electricity, user skin elements or conditions (humidity, dryness, heat, cold). Typical sensor 6 elements have a length of 25 to 70 microns and a typical width of 25 to 70 mm. The sensor in this example has a scanning range of 12.5 x 25 mm and has an sensitivity of 8 bits. Such a sensor can be fabricated as a matrix of TFT (thin-film transistor) and pressure-sensitive capacitor formed, for example, from a thin-layer piezoelectric material such as titanium barium oxide or strontium barium oxide and has an upper electrode that covers and protects the entire scanning area. If mechanical action is applied, the corresponding charge is generated and stored in a thin-layer piezo-capacitor. Alternatively, the pressure-sensitive sensor may be made as a TFT (thin-film transistor), a thin-film capacitor, a pressure-sensitive capacitor formed, for example, from a sheet of pressure-conducting material such as rubber, dispersed in carbon fiber, metal (such as copper, tin or silver). ) coated carbon fiber or fiberglass based on paper or an elastic material (such as silicone) dispersed in metal and a matrix of top electrode sheet that covers the entire scanning area.

By row and column drivers 79, 78, a specific fingerprint sensor element 73 transmits electrical data to an output circuit 81, thereby converting the physical input of the user's fingerprint into analog electrical data. The A / D converter in the output circuit 81 then converts the analog electrical signal to a digital electrical signal. Each thin-film transistor optionally connects a common line-to-line voltage across the capacitor coupled to it so that the voltage of each capacitor can be read and the deformation of each element can be measured. Ideally, the entire column of thin-film transistors is connected simultaneously, so that multiple elements (e.g., 8) in a selected column can be scanned in parallel at different interconnections of rows. Combining multiple rows and columns reduces the number of connections, and parallel scanning of multiple elements from different rows in the same column reduces the scan time for the entire matrix. The output voltage of the sensor can be amplified by another amplifier.

The output of such an amplifier can be used to convert an analog signal into a digital one (in an A / D converter).

The substrate may be glass (such as alkaline glass), stainless steel, aluminum, ceramics (such as aluminum oxide), paper, glass-epoxy resin composite, but thin-layer crystalline silicone is preferred. The thin-layer semiconductor may be made of amorphous silicone, polysilicon, diamond or any other thin-layer conductive material. The piezoelectric material can be a piezoelectric ceramic such as lead-zirconate-titanate (PZT) films, which is preferably in the range of 0.1 to 50.0 microns, or a thin-film polymeric piezoelectric polyimide. Ti / Ni / Cu, Al, Cr / Bi / Au, Ti / Ni / Au, Al / Au, W / Cu, W / Au, W / Au materials may be used for interconnections.

Fig. 11 shows the construction of a sensor formed on crystalline silicone. Crystalline silicone has excellent electrical properties and facilitates integration of the required drivers and output circuits into the sensor array, but the relatively large and thin sheet of silicone will shrink and crack as the surface is pressed. The carrier shown gives the structure more rigidity than a silicone sheet of the same thickness.

As shown, the monolithic silicone sheet 82 is approximately 0.1 mm thick and is surrounded by a uniform thickness glass-epoxy resin frame 83 mounted on a base plate 84, also made on a 0.05 mm glass-epoxy resin structure. Frame 83 and substrate 84 can be easily fabricated using conventional printed circuit board (PCB) technology. Specifically, the upper and lower surfaces of the base 84 are coated with a thin layer of copper 85 separated by a core of glass-epoxy resin. Frame 83 has a plurality of solder points 86 on its periphery for connection to a security processor 8. Thin silicone sheet 82 is glued with epoxy resin to frame 83 and substrate 84, and the active areas are electrically connected to respective electrical paths in frame 82 by conventional wiring 87 at open silicone. 82, encircling the upper protective electrode 88 by portions 89 of its outer edge.

Comparison algorithms

For on-card processing, where processing is limited and where only a simple 1: 1 comparison with a single sample is performed, the fingerprint comparison program may be based on a relatively simple comparison of the details obtained from the two patterns. For example, a gray fingerprint image can be reduced to two values - white and black - and the spatial bumps are converted into two-dimensional thin lines (vectors). The accuracy of the method depends, among other problems, on image blur, sticking, distortion, lack of partial line segments and other effects. Although the method of detail scanning is in principle not very accurate, it requires less computational resources and is compatible with most existing databases.

Processing at a remote authentication server with higher processing power may also require more accurate estimation, such as a POC (Phase Only Correlation) comparison algorithm. POC is an identification algorithm based on macroscopic comparison of full images. In contrast, POC compares a wide range of structural information - from detail to full image. Thus, the POC can provide greater accuracy with respect to various interferences such as adhesion and partial interruptions. In principle, the POC mode is unaffected by factors such as displacements in determining the position of the finger and differences in brightness, and is fast (autonomous comparison takes about 0.1 second) and very accurate. For example, the POC program can perform a spatial frequency comparison of two fingerprint patterns using a planar first Fourier transform (2DFFT). 2DFFT converts a matrix of digital data expressing the physical planar distribution of a fingerprint into a frequency domain, in other words an inverse space distribution where a denser pattern has a higher frequency of space. The swivel transformation can be used to compare the pattern in the frequency domain. Another advantage of POC pattern comparison is the comparison of detail vectors because it is not misled by common defects in the recorded fingerprint pattern, which is accepted by the POC as interference, but interpreted by the detail analysis as meaningful data.

In special cases, the hybrid mode can provide more accuracy and security than any single mode. For example, the detail methodology can be used at the scan site, and the POC methodology can be used at a remote server. Alternatively, the comparison process may analyze both details and gaps to produce a combined result that includes both results.

Application

The technology described above provides a high level of security for a variety of application functions, both commercial and governmental. Depending on the need, several secure recovery functions may co-exist and operate on the same card and / or server. In one embodiment, a single card may have up to 24 independent and secure reuse functions. For example, technology will provide / discipline access (physical and / or logical), pinpoint the exact location and / or movement of a person while performing other secure functions completely and securely separated from one another.

Intended use functions and locations include:

• Airport ID / Entrance

Building security entrance to hotel room and bill payment Hospital

Online games

Downloaded entertainment

birth certificate

Computer access

Driver's license - TWIC

Electronic wallet

Urgent medical information

Permit to work with explosives

Authorization to enter government and military facilities

HAZMAT License

Medical Care and Discount Card

Parking

Passport

Pilot license

Port ID / Entrance

Insurance policy

Social Security Certificate

Trusted Traveler Card

Visa or entry / exit permit

Voter Registration Card • Allowances and Food Card

In many of the cases listed, the card memory also provides secure protection for the various types of private information that the registered cardholder can access when he or she proves his or her identity. Such private information is:

• Administrative information such as name, address, date and place of birth, nationality, religion, affiliation, social security number and immigration information such as visa type, validity, nationality, etc.

• Financial information such as Electronic Wallet, Visa, MasterCard, American Express, etc. credit card information, bank information such as bank name, bank balance, money order information, IRS number, bankruptcy records, etc.

• Physiological and health information such as personal biometric information such as height, weight, fingerprints, iris information, retinal information, arm size, bone structure, voice, DNA, blood type, medical examination results, medical history, prescription medication, insurance information, psychological and physiological responses to certain factors, etc.

• Criminal information such as crime, misconduct, violation of the rules.

• Critical information such as cemeteries, relatives and other contact information, attorney, religious information.

• Education, work history, including graduates, degree workplaces.

• Data access history (keeps track of access to data on the card and off-card).

• ID information such as fingerprints, processed fingerprints, fingerprint processing results.

• Passwords such as permanent password, temporary password and / or one-time password.

• Encryption keys such as public key, private key and / or one-time key.

An example of a card registration system will now be described.

The applicant shall complete the application and provide it with a photograph and a fingerprint. To verify a person's true identity, the documents and information provided by him or her are cross-checked with information in state and commercial databases.

Once the identity has been verified, the applicant goes to the issuing station where the cardholder's information, which may be required, is recorded on the card. The applicant places his finger on the card sensor. When the finger is properly placed on the sensor and the fingerprint is written to the card, the card's continuation receives an electrical charge that burns certain fuses and no one else can write anything to the area. After that, the joint is cut / cut (much like the umbilical cord). Now the card can only be read or recorded via an ISO contact reader or ISO wireless system.

When using a network authenticated server, some or all of the data stored on the card is transmitted in encrypted form to a remote server, along with additional data not normally stored on the card, which may be required for certain applications requiring high security.

Claims (28)

DEFINITION OF INVENTION 1. A smart identification card with integrated memory, characterized in that it has: a built-in memory for storing information, a built-in sensor for reading live biometrics, a microprocessor for comparing the biometric data read at a predetermined threshold with the corresponding stored information and generating a verification message only if the data is within a predetermined threshold, means for forwarding a verification message to an external network. 2. The identification card of claim 1, wherein the card is ISO SmartCard compliant. 3. An identification card according to any one of claims 1 to 2, further comprising an ISO SmartCard processor. 4. An identification card according to one of claims 1 to 3, characterized in that it has a security processor used for storing and processing the protected biometric data, which is functionally separated from the firewall by the ISO SmartCard processor. 5. The identification card of claim 4, wherein the security processor has a first connector used for data entry during the data entry process and a second connector connected to an external network. 6. The identification card of claim 3, wherein: the card comprises an upper magnetic strip region and a lower relief region; the biometric sensor is a fingerprint sensor; and a security processor, an ISO SmartCard processor, and a fingerprint sensor are located in the middle area between the top area and the bottom area. 7. The identification card of claim 1, wherein the sensor is a fingerprint sensor that reads biometric data - fingerprints - from a user's finger placed on the sensor. 8. The identification card of claim 7, wherein the fingerprint sensor has a crystalline silicone sheet mounted on a base plate. 9. The identification card of claim 8, wherein the base plate comprises a layer of glass-epoxy resin sandwiched between two metal layers. 10. The identification card of claim 9, wherein the base plate is reinforced with a carrier frame surrounding the silicone sheet. 11. The identity card of claim 1, wherein the card further comprises a means for restricting its use to a predetermined location. 12. The use of an identification card according to claim 1 for secure biometric verification of identity by using stored data in a memory, characterized in that it generates a verification message which contains extracts from the information stored in the memory. 13. The use of claim 12, further comprising generating a verification message having at least extracts from the scanned biometric data. 14. The use of claim 13, further comprising transmitting a verification message to a remote authentication system for additional verification. 15. The use of claim 14, wherein the remote authentication system stores information data that is different from locally stored information data. 16. The use of claim 14, wherein the card microprocessor uses a different comparison algorithm than that used by the remote authentication system. 17. The method of claim 12, wherein the entire comparison process is performed by a card processor and does not transmit any scanned data to the network. Use according to claim 12, characterized in that both the biometric data originally scanned and any other private information stored in the card memory is kept inaccessible to any external process. Use according to one of claims 12 to 18, characterized in that all external data to and from the security processor passes through the ISO SmartCard processor. Use according to one of claims 12 to 18, characterized in that all external data to and from the ISO SmartCard processor passes through the security processor. Use according to one of claims 12 to 20, characterized in that it permanently disconnects the first connection after completing the data entry process. Use according to one of claims 12 to 21, characterized in that the security processor used for storing and processing the protected biometric data is functionally separated by a firewall from an ISO SmartCard processor. Use according to one of claims 12 to 22, characterized in that it uses real-time feedback while the user manipulates his finger over the fingerprint sensor, thereby facilitating optimal finger positioning over the sensor. Use according to one of claims 12 to 23, characterized in that the comparison process uses a hybrid comparison algorithm which takes into account both individual details and the overall spatial representation of the scanned biometric data. 25. Use according to one of claims 12 to 24, characterized in that at least some of the scanned biometric and information data is transmitted to a separate authentication server for secure user identity verification before being granted direct access to the application server for performing secure financial transactions on behalf of that user. 26. The use of claim 25, wherein, in response to a comparison request for a specific attempt to register at a specific server that issues a positive comparison result at the authentication server, activates a secure three-step authentication protocol in which the sequence of query characters is sent from the authentication server. the station to the identity card, then the identity card uses a sequence of query characters and a comparison request to generate a response, which it then forwards to the application server, v the application server then forwards the response to the request to the authentication server, which verifies that the response to the request is valid. Use according to one of claims 12 to 26, characterized in that it utilizes the card's output to obtain physical access to the secure area. 28. The use of claim 27, wherein the card stores records of successful and unsuccessful attempts to gain access.