LT5403B - Secure biometric verification of identity - Google Patents

Abstract

A high security identification card includes an on-board memory for stored biometric data and an on-board sensor for capturing live biometric data. An on-board processor on the card performs a matching operation to verify that the captured biometric data matches the locally stored biometric data. Only if there is a positive match is any data transmitted from the card for additional verification and/or further processing. Preferably, the card is ISO SmartCard compatible. In one embodiment, the ISO SmartCard functions as a firewall for protecting the security processor used for storing and processing the protected biometric data from malicious external attack via the ISO SmartCard interface. In another embodiment, the security processor is inserted between the ISO SmartCard interface and an unmodified ISO SmartCard processor and blocks any external communications until the user's fingerprint has been matched with a previously registered fingerprint. Real-time feedback is provided while the user is man

Description

Globalization and, in particular, Internet technologies make it easier to access data, including financial, medical, personal data, and to conduct financial and other transactions quickly, where confidential data is updated or exchanged.

it is common to keep such data confidential with passwords, but most passwords use a birth date or a phone number that is easy to guess and therefore unsafe. In addition, even complex random passwords are often stolen. In this way, password data systems are not protected against criminal hacking, which puts the industry and the economy and even human lives at risk. Consequently, an improved way of securing data and protecting it against unauthorized access is required.

Biometrics can include precise details that are difficult to grab but easy to analyze (such as fingerprint details), or entire patterns that are easy to grab but difficult to analyze (such as distances between adjacent spiral strands of fingerprints).

Currently, encryption algorithms are being developed that require a digital key that only an authorized user has. Without a proper key, the encrypted data can only be decrypted into a proper format after a considerable amount of time and effort, and only when certain characteristics of the unencrypted data are known (or at least predictable).

Japanese patent application JP60-029868 of Feb. 15, 1985, to Tamio SAITO describes an identity verification system that uses an identity card with an integrated memory to register encrypted biometric cardholder data. The biometric data may be voice, fingerprint, physical appearance and / or bioassay data. Card data is retrieved and decrypted during use for comparison with the corresponding data taken from the card issuer. Such a system allows for a fairly accurate identification of the registered individual. However, since the biometric data is read and processed by an external device, it is difficult to protect the data stored on the card from tampering and / or theft.

An improved identity verification card with a data-driven multiprocessor chip is known, providing a security firewall that encrypts and insulates the biometric data stored in the card, thus significantly protecting against unauthorized tampering with the card. However, the actual comparison process was performed on the same external scanner terminal that reads live biometrics and is potentially not protected from malicious external actions.

The high security identification card described in the first embodiment has not only a local biometric storage memory, but also a local sensor for reading live biometric data. The remote authentication system has a secure database with biometrics. The card processor performs a preliminary check to verify that the biometric data being scanned matches the biometric data stored on the card. Only in case of a positive result, the scanned data or the data stored in memory is sent to the remote authentication system for further comparison and further processing. To protect against malicious attack, the data stored on the card is optimally different from the data stored remotely, and both the card and the remote data are compared using different comparison algorithms. Therefore, if an unauthorized intrusion attempt is made to the card or to the local terminal to which the card is connected, there is a good chance that the remote authentication system will be able to detect this intrusion attempt.

The card described in the second embodiment also has a local memory for storing biometrics, a local sensor for reading live biometrics, and a local processor. However, in this embodiment, the entire comparison process is performed on a local processor and both live-read data and other "private" information stored in the card memory are not accessible to any external process. In this case, only a confirmation message is generated if the newly scanned biometrics and the previously scanned biometrics match. This confirmation message allows the card to operate in a manner similar to a standard ISO SmartCard; after the successful / unsuccessful introduction of a regular Personal Identification Number (PIN), but with the added protection afforded by a more secure verification process. In either of these embodiments, the biometrics stored on the card and any associated decryption algorithm or key are optimally stored on the card at the time of issuance to the card user in a manner that prevents access to the card, further improving the integrity of the biometric data stored on the card. the verification process.

In one embodiment, the ISO SmarCard acts as a firewall that protects the security processor used to store and process biometric data from external hacking via the ISO SmartCard interface. In another embodiment, the security processor is sandwiched between the ISO SmarCard interface and the unmodified SmartCard processor and blocks any communication to the exterior until the user's fingerprint is matched with a previously registered fingerprint.

One embodiment of the implementation of the high security identification card with the card's fingerprint comparison feature provides real-time feedback where the user manipulates a finger over the fingerprint sensor, thereby facilitating optical finger positioning over the sensor. This feedback not only facilitates computation but also provides additional tools to distinguish the inexperienced user from the rogue user and thus reduces the likelihood of the first and / or second occurrences. In another embodiment, the fingerprint sensor is provided on a carrier for added rigidity.

In one embodiment, the scanned biometric data and / or cardholder identity is encrypted and entered into an operating network consisting of a financial institution and a separate authentication server before accessing confidential data or any automated process for performing a secure transaction. In another embodiment, the card output is used to physically enter the secure area. In either of these, successful and unsuccessful attempts can be logged on either the card, the external security server, or both.

Figure 1 illustrates one embodiment of a SmarCard for verifying a person's identity.

Figure 2 is a diagram illustrating a process for assisting the user to place a finger over a fingerprint sensor.

Fig.3 is a functional block diagram of a biometric verification system capable of locating the identity of a person presenting an identification card both locally and remotely.

Fig.4 is a functional block diagram of a biometric verification card with different physical data paths for use in retrieving biometric data from a primary cardholder and transmitting the cardholder's identity to remote processing

Fig. 5 is an alternative embodiment of the biometric verification card of Fig. 4, which is for use with an unmodified ISO SmartCard processor.

Fig.6 is a diagram showing the relationship between a sample application and a sample verification card, where only the cardholder's identity is verified locally.

Figure 7 is a diagram similar to Figure 6 modified for use with the biometric verification card of Figure 5.

Fig. 8 shows a second embodiment of a SmartCard with biometric verification which can be connected to a local terminal either wirelessly or electrically.

Fig. 9 is a cross-sectional view of the card of Fig. 8.

Fig. 10 is a diagram of a fingerprint sensor.

Fig. 11 shows one embodiment of the sensor carrier of Fig. 10.

SmartCard

As used herein, the terms "smart card" or "intelligent card" generally mean any physical object which is small enough to be held in a hand, carried by a neck or otherwise, and which has a microprocessor, capable of storing, processing and sending digitally encrypted information related to a specific cardholder. One example of such a card is an ISO (International Standarts Organization) SmartCard, which is a regular credit card in size and shape but has a pulsed memory, user data storage, and a microprocessor that can be programmed with a powerful encryption algorithm that specifies whether the PIN (Persons Identification Number) obtained from the terminal corresponds to the PIN entered on the card, thus ensuring that the person presenting the card is the real cardholder than is possible with a verification system which simply visually verifies signatures and physical appearance similarity.

Fig. 1 shows one embodiment of a SmartCard with biometric verification implemented therein. Card 1 is usually made of plastic and is similar to a regular credit card, measuring approximately 53.98 x 85.6 mm by ISO 7816 and having a thickness of approximately 0.76 mm or more.

Similar to a regular credit card, card 1 has a free top area 2 that extends across the entire length of the card to accommodate the magnetic stripe (as specified in ISO 7811-2 & 7811-6) on the back of the card where standard alphanumeric information can be recorded. about the cardholder and any associated account, ensuring that Card 1 can be read by a standard magnetic card reader. However, since any information recorded on magnetic tape can be easily changed, such magnetic tape is for limited use, where backward compatibility with older magnetic tape terminals is more important than the security that magnetic tape cannot provide to the system.

The top area 2 can also be used to provide various security features such as a fake color card holder image and / or a card issuer holographic mark. The lower area of Card 1 can be used in the usual way for information such as the cardholder's name, account (or card) number, expiration date, embossed (as defined in ISO 7811-1), so that Card 1 can be processed as usual printer.

The upper region 2 and the lower region 3 are separated by a central region 4, which is provided with a group of eight visible ISO SmartCard contacts 5, which provide a normal electrical connection between the card and the corresponding card reader contacts. They ensure the transmission of not only data, but also power, time and control signals between the reader and the card as specified in ISO 7816-3.

On the right side of area 4 is a sensor 6 which is used to scan the cardholder's fingerprint. Ideally, the card is provided with a unique ID code that is compatible with sensor 6 and other electronic components provided on the card, such as a standard IP and / or MAC address format code.

Also, the card shown in FIG. 1 is provided with a number of additional electronic components which, together with the contact group 5 and the sensor 6, provide the card with more functionality and, in particular, security than could otherwise be achieved.

In one embodiment of the invention, the ISO SmartCard-compatible processor 7 is directly coupled to the contact group 5, thereby enabling it to be connected to an unshown external ISO-compatible card reader not only to supply card electronics but also for data transfer between the card and any any external communications programs, security programs, transaction programs and / or other applications installed on the card reader or any computer device associated with the card reader.

Although in the embodiment described the data path between the card 1 and the external card reader is wired using the ISO specified SmartCard card contact equipment, it is obvious that other embodiments may employ other communication technologies such as USB or RS 232C or SPI (serial) connections via wireless RF (radio frequency), microwave and / or IR (infrared) communication channels.

In addition, while in the embodiment described the card is powered by a card reader, other cards may have a power source such as a solar battery or a battery incorporated in the card. Such an on-board power source is useful when, for example, the mechanical connection between the card 1 and a particular type of card reader is such that the user cannot access the fingerprint sensor 6 when the contacts 5 are connected to the respective connectors inside the card reader. Thus, the user's fingerprints must be read when card 1 is not directly connected to the card reader.

Security processor

As can be seen in the figure, the security processor (central processing unit CPU) 8 is connected between the ISO processor 7 (CPU) and the sensor 6 and is designed for the secure processing and storage of scanned data and as a firewall to prevent unauthorized access to data and programs recorded to its dedicated memory via an ISO processor 7 as described below. Such a firewall may be designed to pass only encrypted data using an encryption key based on a unique dedicated network address or otherwise unique to a particular card, such as data previously stored on a fingerprint pattern or a unique assigned device number such as a CPU (CPU) or fingerprint sensor number. In another embodiment, the firewall skips only data that has unique identification data from a previous transmission or data. In yet other embodiments, the firewall applies different keys to different operations and uses these keys to redirect data to the corresponding different partition of the processor or memory.

In another embodiment not shown, the protection processor 8 is directly connected to the ISO contacts 5 and acts as a protection filter between the ISO processor 7 and the ISO contacts 5. Such additional installation provides the additional protection provided by the protection processor 8 and sensor 6 without compromising any protective functions, which can already be incorporated into an ISO processor 7.

The security processor 8 optimally has a non-volatile semiconductor or non-semiconductor memory such as FRAM, OTP, E ² PROM, MRAM, MROM for storing previously scanned fingerprints and / or other biometric information. In other embodiments, some or all of the features of the security processor 8 may be implemented in the ISO processor 7 and / or some or all of the features of the ISO processor 7 may be implemented in the security processor 8. Such a combined implementation will maintain a firewall between various functions the device has a process in place that prevents any subsequent modification of the recorded programs. Alternatively, both processors 7, 8 may be separate processors in one multiprocessor device designed to protect each process from interference from any other process taking place in another processor. One example of such a multiprocessor device is the Sharp (Japan) manufactured DDMP (Data Driven Multiple Processor) device.

Although these various sensors, contacts, and other electronic components, as well as printed circuits or other electrical connections to which they are interconnected, are fully incorporated inside the housing of the card 1 in such a way as to protect against wear and external contamination, the optimum location 4, between the upper region 2 and the lower region 3 further protects them from possible damage by conventional magnetic tape counters, stamping machines, and printing devices that mechanically contact all of these regions.

LEDs

The LEDs 9a, 9b are controlled by the security processor 8 and provide the user with visual feedback. In this illustrated example, they are located in the lower region 3, preferably at the edge of the card furthest from the contacts 5. In any case, the LEDs 9a, 9b are positioned where they will not be damaged during stamping and where they will be visible when the card is inserted into a standard ISO SmartCard reader and / or when the user's finger is placed on the fingerprint sensor 6. For example:

In verification mode:

• blinking RED: waiting for finger placement • stopped blinking: finger on sensor • RED blinking once: cannot compare, moving finger • green blinking once: compared, OK, removable finger

In registration mode:

• GREEN blinking: waiting for finger placement • stopped blinking: finger placed on sensor • RED blinking once: cannot register, finger moving • GREEN blinking once: OK, removable finger

In delete mode:

• GREEN and RED blinking: ready to delete • GREEN blinking once: deleted

Ideally, the user is allowed to place his or her finger on the sensor multiple times for successful comparison or registration before transmitting a negative message. In one embodiment, a negative message is issued only if the user has removed his finger without receiving a green OK signal, or if a predefined time limit has been exceeded. Not only does this process teach the user to properly place their finger over the sensor, which not only simplifies computation, but also allows for more differentiated thresholds. This visual feedback allows you to psychologically distinguish between an inexperienced user (who will usually try as many times as he has properly placed his finger over the sensor) and a phony user (who usually does not pay attention and leaves until his malicious intentions are revealed). The end result is the significantly reduced likelihood of false negatives and / or false positives.

Fig. 2 illustrates an exemplary process for assisting the user to place his finger on the sensor 6. In the position containing the unit 10, the red LED 9b flashes. When the finger is detected (block 11), the LED stops blinking and the image quality test (block 12) is performed (elongated areas corresponding to finger skin bumps and indentations are detected). If the quality is poor (NOT on branch 13), one blink of red LED 9b instructs the user to move their finger to another position (block 14); otherwise, (YES at branch 15), a second test (block 16) is performed to determine if the same finger used to register the user is placed in the same location so that a relatively simple comparison algorithm can verify that the live data is within certain limits. memory data such that the live finger is the same finger that was recorded (YES at branch 17) and activates the green LED 9a (block 18) for a period (block 19) sufficient to verify that the comparison was done successfully and the user can now remove their finger. Alternatively, if the comparison did not meet the set limits (NE branch 20), a single blink of the red LED 9b instructs the user to reposition the finger and the process is repeated.

Examples of network structures

Figure 3 illustrates one possible embodiment of a biometric verification system capable of performing both a local and a remote person presenting a secure identification card. It consists of three main components: Client Terminal 21, Application Server 22 and Authentication Server 23. Client Terminal 21 reads and processes live fingerprints, encryption-processed data, and securely, optimally over the Internet, using an IP / TCP addressing scheme and communication protocol , communicates with an application and authentication server protected from unauthorized access by conventional IP firewalls 24. In other embodiments, firewalls 24 may have filters and encryption / decryption devices that encrypt verified transmitted data into authorized data and that decrypt the received data before being verified. , whether this is actually authorized data using, for example, an encryption algorithm such as DES128. By these means, firewall 26 can distinguish authorized data from potentially malicious not only the message header, but also the message content.

Client Terminal 21 may be implemented as a dedicated network device or may be implemented in a program installed on a programmable desktop or portable computer or other workstation or PC having standard Windows XXX, OS X, Solaris XX, Linux, or Free BSD operating systems. Ideally, client terminal 21 has up-to-date "negative" databases (such as a list of lost or stolen cards, card or card group constraints) that provide additional safeguards.

The application server 22 performs transactions or otherwise responds to instructions from a remote user at the user terminal 21 after the authentication server 23 has confirmed the identity of the user. The authentication server 23 securely communicates with both the client terminal 21 and the application server 22 for storing authentic fingerprint data and other information related to previously registered users in comparison with the encrypted live data received from the client terminal 21, and informing the application server 22 whether or not the specified fingerprints are identical to the stored fingerprints.

More specifically, the client terminal 21 additionally has two main components: a fixed card reader 25 having a web browser terminal 26, a card reader interface 5a (which can be a simple USB cable with electrical connectors at the back for connection to ISO SmartCard card contacts 5). ) and a portable SmartCard component Γ. In one embodiment, the portable component 1 'may comprise a SmarCard 1 as described above having a fingerprint sensor 6, a security processor 8 and an ISO SmartCard card processor 7.

Application server 22 further includes a web server interface having a firewall 24 and a web browser 27, as well as a transaction module 28 and a validation module 29. In the event that the application server and application module 28 are devices that are not intended to communicate externally via IP / TCP protocol , firewall 24 may be replaced by a corresponding protocol converter having a validation module 29 and a fixed IP address. The application server may be managed, for example, by a third party that seeks to provide the service to an authorized user online.

The authentication server 23 further includes a web server interface 30, a processing module 31 having a fingerprint comparison algorithm 32, and a database 33 for storing fingerprints and other authentic information collected from users at the time of their registration with the system, solely for system operation. For security reasons, each personal data is not stored on the application server as a simple sequence of information, but each entry is recorded individually and any required indexes or relationships linking these records are only accessed with the appropriate key that forms part of the personal private data authentication server.

Place

In certain embodiments, the fixed scanner 25 and / or the portable card 1 "may include a built-in Global Positioning Satellite (GPS) receiver 34, which may provide useful information about the current position of the scanner and card at or about a specific action was taken. In particular, position data from the GPS receiver 34 may be used to deactivate the scanner and / or card (permanently or temporarily) if any of it is moved to an unauthorized location. Alternatively, positioning can be done automatically by other means than GPS, such as using PHS (Japanese cell phone) caller location technology or positioning sensors that respond to local changes in the earth's electromagnetic fields. If the card has a GPS receiver, the various GPS components, including the antenna, signal amplifier, A / D converter and digital processor for calculating position, form part of a single integrated circuit or are separate devices mounted on a single card that is integrated with the card body, built into or laminated with it.

Structure of an ISO card with a built-in comparison function

ISO processor interfaces

Fig.4 is a functional block diagram of an exemplary ISO SmartCard-compatible biometric verification card 1 or T with different physical data paths for use in the initial processing of the cardholder's biometric data and the cardholder's identity check for remote processing.

In addition to the ISO processor 7, security processor 8, fingerprint sensor 6, LEDs 9a, 9b and optional GPS receiver 34 described above, when only the ISO processor 7 is directly connected to the card reader 25 via ISO SmartCard pins 5, a separate charging is shown here. terminal 35 and a temporary connection 36 associated therewith, which provides a direct connection to the security processor 8 during initial user registration. It should be noted that the ISO processor 7 communicates with the protection processor 8 via the I / O ports 37, 38, while the temporary charging connector 36 is connected to a separate I / O port 39. The protection processor is optimally programmed so that any important and related with security, the data or software is only accessible from port 39 and not from ports 37 and 38, thus preventing any possible malicious attempts to access this important data after the connection 36 is disconnected.

Most popular ISO processors have at least two I / O ports, some have at least three. Only one of these ports (l / O 1) is used to connect a standard SmartCard serial data connector 5 to an external ISO-compatible card reader 25. One or two additional l / O ports optimally provide dedicated wired communication between the ISO processor 7 and the security processor 8, which acts as a hardware barrier to block any malicious attempts to reprogram the security processor 8 or access any important information that may have been previously retrieved by sensor 6 or otherwise stored in processor 8. In this particular case, where the ISO processor has more than two l / o lines, more than two static status information can be provided in dedicated communication path between ISO processor and security processor such as 1) Ready, 2) Busy 3) Error, and 4) Done even when protection the processor is completely disconnected from the power supply. Of course, even if there is only one l / O port, these four conditions can be transmitted dynamically as serial data.

The possible commands and data that can be transmitted between the ISO CPU and the protection CPU via the ISO interfaces I / O2 and I / O 3 are as follows:

• Commands to register or determine the user identity under which the protection CPU will send the logging or authentication result to local storage and / or forward to remote customization.

• Fingerprint information as a template (link) can be sent from the protection CPU to the ISO CPU for storage in the ISO SmartCard memory for subsequent transmission for remote use.

the charging connector 36 provides a direct connection to the security CPU 8, which bypasses any firewall provided for the ISO connector and associated dedicated I / O ports 37 and 38, while maintaining communication between the ISO CPU 7 and the ISO reader 25 so that power is provided and security CPU 8. This is primarily used during primary card sign-up for a specific user and should protect against unauthorized access.

Fig. 5 shows an alternative embodiment of the biometric verification card of Fig. 4, which is intended for use with an unmodified ISO smartcard CPU. Specifically, the ISO CPU 7 'is no longer required to perform any network interface functions between the card reader 25 and the protection CPU 8', either during normal use or charging, and as such may be any ISO approved chip, in no way modified and used only in a way that is absolutely accessible to both the card reader 25 and any external application. In this embodiment, the security CPU 8 'acts as a transparent barrier between the ISO CPU 7' and any external application if the scanned fingerprint matches the stored data and blocks all communications if the scanned fingerprint data does not match the stored data.

Card initialization and data protection

In one embodiment, the original card has a protruding extension of the printed circuitry that allows it to be directly connected to the security CPU, as well as to parts of the ISO interfaces and / or any individual card memory. This direct connection interface is only used for card testing and fingerprint logging and has a signal that allows the registration process to take place. After registration is complete, the schema extension is mechanically cut off so that no subsequent registration can be made, and the protection CPU memory can only be accessed through the ISO CPU and the aforementioned firewall between the ISO CPU and the protection CPU.

Fuse

In another embodiment, the security CPU has the kind of memory that becomes unavailable after fingerprint registration. One example of such memory is a single-use PROM ("OTP") memory, which is similar in design to EEPROM but UV resistant and therefore cannot be erased. Another example is Flash ROM memory, which is made read-only after the registration procedure, for example by supplying sufficient current to the authorization, address or data signal path, forming a physical break ("fuse") in this signal path.

An example of an authentication process

In one embodiment of the invention, the authentication process comprises scanning physical data of fingerprints using, for example, optical, pressure, conductivity, capacitance, acoustic, elastic, or photographic technologies in a client terminal used by a person to contact an application server for subsequent transmission ( optimally encrypted forms) to a separate fingerprint authentication server. The fingerprint authentication server compares the scanned fingerprint data with the registered user fingerprint data in the file using the authentication software, and if the data overlap, the authentication server sends instructions to perform the action to the application server.

In another embodiment, the user accesses a secure web browser of the fingerprint authentication server, which contains fingerprint data files, where all fingerprints are pre-registered with personal data such as name, address and date of birth. The secure fingerprint authentication server, which is accessed by the user through a secure protocol such as HTTPS format, then sends instructions to the client terminal to retrieve the user's fingerprints. Responding to the instructions displayed by the client terminal browser, the user places the selected finger on the fingerprint sensor, and the fingerprint scanning application located on the client terminal digitally reads the fingerprints, such as 25-70 microns pixels in a 12.5-25mm ² area 8 bit gray image.

The secure fingerprint authentication server accepts fingerprint data along with the user ID as well as the Internet IP address and / or the fingerprint sensor unique code (MAC address) and / or "cookie" and / or unique code or other information identifying the an individual or terminal (e.g., details from a previous conversation between the client terminal and the secure fingerprint authentication server), whereupon it compares the received fingerprint data with the fingerprint data contained in the file, which is a pre-recorded fingerprint data with user ID, personal information such as name, address, date of birth, criminal record, driver's license, social security number, etc., using an authentication program, this may be a detailed or quick comparison of the Fourier transformation.

At the beginning of the authentication process, the network server 27 instructs the user to place his or her finger on the fingerprint scan sensor 6 with image or sound and press the mouse or keyboard button to initiate the fingerprint scan program on the security processor 8. The scanned user fingerprint data is then sent in encrypted format , using secure RSA encrypted transmission protocol HTTPS) to the fingerprint authentication server 23 web server 30 via the client processor 21's ISO processor 7 and network browser 26. If the scanned data matches the corresponding data in the database 33, the fingerprint authentication server 23 gives the user access to client terminal 21 and application server 22.

An example of an optimal embodiment using a three-step authentication protocol and a one-time password as a random character encryption sequence will now be described with reference to FIG. 3:

• The client terminal 21's network browser 26 directs to the application server 22's network interface 27 to request an application process (module) 28.

• In response, application server 22's network interface 27 provides LOG-IN information and corresponding application process 28 instructions.

• The client terminal 21 instructs the ISO processor 7 to activate the security processor 8.

• ISO processor 7 activates protection processor 8.

• The security processor 8 waits for the fingerprint data from the fingerprint sensor 6 and, when the appropriate data has been received, to output a digital fingerprint pattern that is transmitted to the web browser 26 via the ISO processor

7th

• The web browser 26 sends an encrypted version of the provided fingerprint pattern to the authentication server 23 along with information relating to the used card T and the card reader 25 such as user ID, client terminal 21 address and / or sensor 6 ID code (MAC address). .

• The network interface 30 of the authentication server 23, upon receiving the provided fingerprint pattern along with other information from the client terminal 21, transmits this information to the fingerprint comparison processor 31.

• The fingerprint comparison processor 31, controlled by the comparison program 32, uses the received user ID or other user descriptive information to find the corresponding fingerprint pattern in the database 33 and compares the scanned fingerprint pattern to a specific fingerprint pattern.

• The result (matched or not) is stored in the access archive along with other information identifying terminal 21, user ID, card T and requesting application process 28, and the response is returned to the authentication server network interface 30.

• If the result is matched, the authentication server network interface 30 generates a one-time character string request password which is passed to the client terminal 21 and uses this query character string as a random character code to encrypt the associated information, which it stores as a corresponding response to the request for action.

Client terminal 21 uses an accepted query character sequence as a random character code for encrypting an unencrypted copy of previously stored related information, which it then passes to application server 22 network interface 27 as part of its response to the Log-ln (sign up) process.

• The application server 22's network interface 27, after converting the random character-related information, forwards it to an application process 28, which associates it with an attempt to register from the client server and forwards a matched result to the received related information that has been converted to the client terminal. using the query sequence provided by the authentication server as a response to the request.

The network interface 30 of the authentication server 23, after receiving a response from the application server, forwards the request to the authentication process 31, which compares it with a previously stored copy of the expected response to the request to determine whether the user is actually identified.

Any identified user information obtained from this comparison is then returned to the application process 28 via the authentication server network interface 30 and the application server 22 validation module 29.

• The validation module 29 uses authentication to verify the user identity set in the initial attempt to register.

• Once the user identity has been verified, the application process 28 contacts the client terminal 21's network browser 26 directly through the application server 22's network interface

27th

Fig. 6 shows an alternate version of the authentication process wherein the comparison is performed by the security CPU on the ISO compliant card shown in Fig. 4 and no external authentication server is used 23. The left side of Fig.6 shows the functions performed by application server 22 and the right side shows functions performed by ISO SmartCard 1.

When the SmartCard is inserted into the card reader 25, the RST reset signal is sent from the card reader to both the ISO CPU (START unit 40) and the security CPU 8 (fingerprint verification unit 41), and both receive power from the card to the VCC. The ISO CPU then responds with an ATR (Answer-to-Reset) message and communicates with the PPS (Protocol and Parameter Selection) as needed (Block 42). At the same time, the guard CPU goes into standby mode and waits for fingerprint data and, when the data is received from sensor 6, performs an authentication process (block 43).

When the application process 28 sends the initial request to the ISO CPU 7 (block 44), the ISO CPU requests (block 45) the protection processor about the authentication status. If the answer is positive, the ISO CPU responds to the application module request by executing a command (block 46). Otherwise (after receiving an error message or receiving no response from the protection CPU 8), it does not respond but waits for a new initial request (block 44b).

If the fingerprints were verified and the first response was received on time and the application module 28 was found to be responsive to it (block 47), the request response process continues (blocks 48, 49, 50) until the predefined verification is exceeded. a break in which no requests were received from the application module (block 51) or the application module did not receive the expected response (block 52).

Figure 7 is a diagram similar to Figure 6 but modified for use with the biometric verification card of Figure 5. The left side of Fig. 7 shows the functions performed by application server 22, the next column represents the reader 25, the other column represents the ISO contacts 5, the other column shows the functions performed by the security CPU 8, and the right side shows the functions performed by unmodified ISO SmartCards CPU 7:

• When the SmartCard is inserted in the card reader or the application activates the card reader, the reset signal 53 from the card reader 25 is sent to the security CPU 8.

• Immediately after the reset CPU receives the reset signal 53, it sends the corresponding reset signal 54 to the ISO CPU

7. At the same time, the security CPU is waiting for the fingerprint data from the fingerprint sensor.

• Upon receipt of the reset signal 54, the ISO CPU prepares an ATR response 55 and then communicates with the PPS (protocol and parameter selection) as needed.

• When the security CPU 8 receives an ATR (Reset Positioning Signal) signal from the ISO CPU, it transmits it to the card reader (block 56), including any related commands.

• At the same time, if the security CPU receives the fingerprint data, it starts the authentication process described above. If the authentication test is positive (PASS), this status is maintained for a period of time. If the result is negative (FAIL), the security CPU 8 is waiting for new fingerprint data.

• When the command is executed, command 57 is sent to the security CPU, which sends command 58 to the ISO CPU and also sends its exact response 59 to the card reader only if the security CPU status is still positive (PASS) or if the last correct response was a larger set of data bits (test block 60).

Otherwise (no branch 61), the guard CPU generates a fake request 62 and sends it to the ISO CPU and also sends the received ERR response 63 to the application process 28 via the card reader 208, thereby maintaining proper synchronization between the sequence numbers in the requests and responses.

Encryption and protection

Before transferring data to any external network, all relevant data and / or authentication results are encrypted, if possible, using DES or TwoFish encryption. The encryption key is based on scanned or saved fingerprint data, user ID code, unique code assigned to the sensor, memory address, adjacent data in memory, other functionally related data, previous conversion (transaction), IP address, terminal code, or password provided. Alternatively, important data can be transmitted over the Internet using the secure HTTPS protocol.

For better security, a virtual private network interface, such as DĖ hardware encryption and decryption hardware, can be inserted between the secure fingerprint authentication server and the network connection point, and between the application server and the network connection point, respectively. If you use such a Virtual Network Interface or Virtual Private Network (VPN), important data is additionally protected by an additional layer of encryption, such as DS 128 (commonly used in VPN VPN) and RSA (used by HTTPS).

For extra security, all communications can be wrapped with additional layers of security. Specifically, message headers in the bottom layer can be encrypted in the top layer.

Wireless

In other embodiments, a dual interface can be provided for both contact (ISO 7816) and wireless (ISO 1443 A or B) operation and, ideally, has a multiaxial power supply that operates between ISO 7816 contact, ISO 1443 A, ISO 1443 B, ISO 15693 and HID wireless systems (among others) on one card. The card may also provide the ability to use other wireless technologies, such as Bluetooth (short-range) or mobile (medium-range) or microwave (long-range).

Figure 8 shows a SmartCard for biometric verification that can be connected to a local terminal wirelessly or electrically. For the most part, its structure and construction is similar to the card described above in Figure 1, and like elements are denoted by the same numerals. The ISO CPU 7 is located in a different location below the contacts 5 but performs a similar function as described above.

The ISO antenna 64 has two loops, typically mounted at the peripheral edge of the card 1, and provides ISO compatible wireless communication with ISO CPU 7 for data transmission and power supply, similar to the electrical connector 5. In addition, the security antenna 130 (installed, as described in the example, inside the antenna 64 and consisting of a single loop only), provides a separate power supply for the protection CPU 8 via a DC-DC voltage regulator 66. Since there is no direct wireless connection other than the ISO CPU 7, there is no risk of distorting important data stored on the CPU 8 . Alternatively, as mentioned above, with respect to embodiments having only wired connections to an external scanner and an external network, dual processor operation may be combined or external communication may be provided via a security CPU 8 rather than an ISO CPU 7, in this case the respective wireless protectors the means must be incorporated into the card structure so modified.

Fig. 9 is a cross-sectional view of the card of Fig. 8. Most of the described components are located in the central core 67, and only the contacts 5 extend through the top protective layer 68. The functional surface of the sensor 6 is accessed through the top window in top layer 68 and bottom window in PCB 69 mounted between top layer 68 and center core. 67 and providing an electrical connection between the various electronic components and an electrostatic discharge contact covering the active region of the sensor 6.

The lower layer 70 and the magnetic strip 71 are also visible.

Fingerprint sensor

Fig. 10 is a diagram of the sensor 6, in which the array 72 of the sensor elements 73 is formed of rows 74 and columns 75. As shown in fig. 10, each element 73 has an active inlet 76 and a transducer 77. Fingerprints are formed by finger skin bumps and indentations. Each sensor element transducer 77 is mechanically and / or electrically actuated, with one of these finger skin bumps directly touching the element 73 of the matrix 72, which produces a fingerprint image of changes in the micro-pressures formed by the bumps and recesses across the sensor surface. Although each transducer 77 is depicted as a separate capacitor of variable capacitance, there are various types of transducers that can respond to a single protrusion of human skin. In this particular pressure-sensitive thin-film piezo-converter, the film is deformed in the immediate vicinity of the element and generates a charge which is stored in the capacitor connected to the element. The capacitor voltage is a function of the mechanical voltage formed by the deformation of the piezo-material, which in turn is a function of what is above the element: protrusion or recess. When the signal from the linked column driver 78 indicates that the cell input 76 is ON and the linked queue driver 79 is grounded, a voltage is generated at the end of the output line 80 that is converted to an 8-bit digital signal in the output driver 81. detection, the piezoelectric material may be formed on an elastic material such as polyimide or may simply be a polyimide piezoelectric material. Other analog converter technologies that can be implemented in a similar structure include variable resistances and variable capacitances. Alternatively, each element may consist of a single digital switch that provides only one bit of information. In this case, additional bits of information may be generated by placing more elements in the same area or by selecting each element at a higher frequency. Such an alternative embodiment does not require any A / D converters.

In the embodiment shown, the sensor is only 0.33 mm thick and is sufficiently wear resistant to be mounted on the SmartCard and is not affected by static electricity, wearer's skin elements or conditions (moisture, dryness, heat, cold). Typical sensor 6 elements have a length of 25 to 70 microns and a typical width of 25 to 70 mm. The sensor in this example has a scanning range of 12.5 x 25 mm and has an sensitivity of 8 bits. Such a sensor can be fabricated as a matrix of TFT (thin-film transistor) and pressure-sensitive capacitor formed, for example, from a thin-layer piezoelectric material such as titanium barium oxide or strontium barium oxide and has an upper electrode that covers and protects the entire scanning area. If mechanical action is applied, the corresponding charge is generated and stored in a thin-layer piezo-capacitor. Alternatively, the pressure-sensitive sensor may be made as a TFT (thin-film transistor), a thin-film capacitor, a pressure-sensitive capacitor formed, for example, from a sheet of pressure-conducting material such as rubber, dispersed in carbon fiber, metal (such as copper, tin or silver). ) coated carbon fiber or fiberglass based on paper or an elastic material (such as silicone) dispersed in metal and a matrix of top electrode sheet that covers the entire scanning area.

By the row and column drivers 79, 78, the specific fingerprint sensor element 73 transmits electrical data to the output circuit 81, thereby converting the physical user fingerprint input to analog electrical data. The A / D converter in the output circuit 81 then converts the analog electrical signal to a digital electrical signal. Each thin-film transistor optionally connects a common line-to-line voltage across the capacitor coupled to it so that the voltage of each capacitor can be read and the deformation of each element can be measured. Ideally, the entire column of thin-film transistors is connected simultaneously, so that multiple elements (e.g., 8) in a selected column can be scanned in parallel at different interconnections of rows. Combining multiple rows and columns reduces the number of connections, and parallel scanning of multiple elements from different rows in the same column reduces the scan time for the entire matrix. The output voltage of the sensor can be amplified by another amplifier. The output of such an amplifier can be used to convert an analog signal into a digital one (in an A / D converter).

The substrate may be glass (such as alkaline glass), stainless steel, aluminum, ceramics (such as aluminum oxide), paper, glass-epoxy resin composite, but thin-layer crystalline silicone is preferred. The thin-layer semiconductor may be made of amorphous silicone, polysilicon, diamond or any other thin-layer conductive material. The piezoelectric material can be a piezoelectric ceramic such as lead-zirconate-titanate (PZT) films, which is preferably in the range of 0.1 to 50.0 microns, or a thin-film polymeric piezoelectric polyimide. Ti / Ni / Cu, Al, Cr / Bi / Au, Ti / Ni / Au, Al / Au, W / Cu, W / Au, W / Au materials may be used for interconnections.

Fig. 11 shows the construction of a sensor formed on crystalline silicone. Crystalline silicone has excellent electrical properties and facilitates integration of the required drivers and output circuits into the sensor matrix, but the relatively large and thin sheet of silicone will shrink and last when pressed on its surface. The carrier shown gives the structure more rigidity than a silicone sheet of the same thickness.

As shown, the monolithic silicone sheet 82 is approximately 0.1 mm thick and is surrounded by a uniform thickness glass-epoxy resin frame 83 mounted on a base plate 84, also made on a 0.05 mm glass-epoxy resin structure. Frame 83 and substrate 84 can be easily fabricated using conventional printed circuit board (PCB) technology. Specifically, the upper and lower surfaces of the base 84 are coated with a thin layer of copper 85 separated by a core of glass-epoxy resin. Frame 83 has a plurality of solder points 86 on its periphery for connection to a security processor 8. Thin silicone sheet 82 is glued with epoxy resin to frame 83 and substrate 84, and the active areas are electrically connected to respective electrical paths in frame 82 by conventional wiring 87 at open silicone. 82, encircling the upper protective electrode 88 by portions 89 of its outer edge.

Comparison algorithms

For on-card processing, where processing is limited and where only a simple 1: 1 comparison with a single sample is performed, the fingerprint comparison program may be based on a relatively simple comparison of the details obtained from the two patterns. For example, a gray fingerprint image can be reduced to two values - white and black - and the spatial bumps are converted into two-dimensional thin lines (vectors). The accuracy of the method depends, among other problems, on image blur, sticking, distortion, lack of partial line segments and other effects. Although the method of detail scanning is in principle not very accurate, it requires less computational resources and is compatible with most existing databases.

Processing at a remote authentication server with higher processing power may also require more accurate estimation, such as a POC (Phase Only Correlation) comparison algorithm. POC is an identification algorithm based on macroscopic comparison of full images. In contrast, POC compares a wide range of structural information - from detail to full image. Thus, the POC can provide greater accuracy with respect to various interferences such as adhesion and partial interruptions. In principle, the POC mode is unaffected by factors such as displacements in determining the position of the finger and differences in brightness, and is fast (autonomous comparison takes about 0.1 second) and very accurate. For example, a POC program can perform a space-frequency comparison of two fingerprint patterns using a planar first Fourier transform (“2DFFT”). 2DFFT converts a matrix of digital data expressing the physical planar distribution of a fingerprint into a frequency domain, in other words an inverse space distribution where a denser pattern has a higher frequency of space. The swivel transformation can be used to compare the pattern in the frequency domain. Another advantage of POC pattern comparison is the comparison of detail vectors because it is not misled by common defects in the recorded fingerprint pattern, which is accepted by the POC as interference, but interpreted by the detail analysis as meaningful data.

In special cases, the hybrid mode can provide more accuracy and security than any single mode. For example, the details methodology can be used at the scanning site and the POC methodology can be used at the remote server. Alternatively, the comparison process may analyze both details and gaps to produce a combined result that includes both results.

Application

The technology described above provides a high level of security for a variety of application functions, both commercial and governmental. Depending on the need, several secure recovery functions may coexist and run on the same card and / or on the same server. In one embodiment, a single card may have up to 24 independent and secure reuse functions. For example, technology will provide / discipline access (physical and / or logical), pinpoint the exact location and / or movement of a person while performing other secure functions completely and securely separated from one another.

Intended use functions and locations include:

Airport ID / entrance Building security entrance [hotel room and bill payment Hospital

Online games

Downloaded entertainment

birth certificate

Computer access

Driver's license - TWIC

Electronic wallet

Urgent medical information

Permit to work with explosives

Authorization to enter government and military facilities

HAZMAT License

Medical Care and Discount Card

Parking

Passport

Pilot license

Port ID / Entrance

Insurance policy

Social Security Certificate

Trusted Traveler Card

Visa or entry / exit permit

Voter Registration Card

Allowances and Food Card

In many of the cases listed, the card memory also provides secure protection for the various types of private information that the registered cardholder can access when he or she proves his or her identity. Such private information is:

• Administrative information such as name, address, date and place of birth, nationality, religion, affiliation, social security number and immigration information such as visa type, validity, nationality, etc.

• Financial information such as Electronic Wallet, Visa, MasterCard, American Express, etc. credit card information, bank information such as bank name, bank balance, money order information, IRS number, bankruptcy records, etc.

• Physiological and health information such as personal biometric information such as height, weight, fingerprints, iris information, retinal information, arm size, bone structure, voice, DNA, blood type, medical examination results, medical history, prescription medication, insurance information, psychological and physiological responses to certain factors, etc.

• Criminal information such as crime, misconduct, violation of the rules.

• Critical information such as cemeteries, relatives and other contact information, attorney, religious information.

• Education, work history, including graduates, degree workplaces.

• Data access history (keeps track of access to data on the card and off-card).

• ID information such as fingerprints, processed fingerprints, fingerprint processing results.

• Passwords such as permanent password, temporary password and / or one-time password.

• Encryption keys such as public key, private key and / or one-time key.

An example of a card registration system will now be described.

The applicant shall complete the application and provide it with a photograph and a fingerprint. To verify a person's true identity, the documents and information provided by him or her are cross-checked with information in state and commercial databases.

Once the identity has been verified, the applicant goes to the issuing station where the cardholder's information, which may be required, is recorded on the card. The applicant places his finger on the card sensor. When the finger is properly placed on the sensor and the fingerprint is recorded on the card, the card extension receives an electrical charge that burns certain fuses and no one else can record anything in the area. After that, the joint is cut / cut (much like the umbilical cord). Now the card can only be read or recorded via an ISO contact reader or ISO wireless system.

Using a network authenticated server, some or all of the data stored on the card is transmitted in encrypted form to a remote server along with additional data that is not normally stored on the card, but may be required in certain high security applications.

Claims (58)

DEFINITION OF INVENTION 1. A smart identification card containing: a built-in memory for storing information data; a built-in sensor for reading live biometrics; it is equipped with a microprocessor for comparing the biometric data scanned at a predetermined threshold with the corresponding information stored in the memory and for generating a verification message only if the data is within a predetermined threshold; and means for transmitting the verification message to an external network, characterized in that the verification message has at least extracts from the scanned biometric data. 2. The identity card of claim 1, wherein the verification message is transmitted to a remote authentication system for additional verification. 3. The identity card of claim 2, wherein the remote authentication system has remote information that is different from locally stored information. 4. An identification card according to claim 2, characterized in that the card microprocessor uses a different comparison algorithm than that used by the remote authentication system. 5. The identification card of claim 1, wherein said card is ISO SmartCard compliant. 6. The identification card of claim 5, wherein said processor is a security processor used for storing and processing protected biometric data and further comprising an ISO SmartCard processor. 7. The identification card of claim 6, wherein the security processor is functionally separated by a firewall from an ISO SmartCard processor. 8. The identification card of claim 6, wherein all external data to and from the security processor passes through an ISO SmartCard processor. 9. The identification card of claim 6, wherein all external data to and from the ISO SmartCard is passed through a security processor. 10. An identification card according to claim 6, characterized in that the security processor has a first connector used for data entry during the data entry process and a second connector connected to the external network. 11. The identification card of claim 10, wherein the first connection is permanently disconnected upon completion of the data entry process. 12. The identification card of claim 6, wherein: the card comprises an upper magnetic stripe region and a lower embossed region; the biometric sensor is a fingerprint sensor; and a security processor, an ISO SmartCard processor, and a fingerprint sensor are located in the middle area between the top area and the bottom area. 13. The identification card of claim 1, wherein the biometric data comprises fingerprint data and the sensor is a fingerprint sensor which reads data from a user finger placed on the sensor. An identification card according to claim 13, further comprising: Indicator finger position for real-time feedback while the user manipulates their finger over the fingerprint sensor, thereby facilitating optimal finger positioning above the sensor. 15. Identification card according to claim 13, characterized in that the comparison process uses a hybrid comparison algorithm which takes into account both individual details and the overall spatial representation of the scanned biometric data. 16. The identification card of claim 13, wherein the fingerprint sensor has a layer of crystalline silicon deposited on a base plate. 17. Identification card according to claim 16, characterized in that the base plate has a layer of glass epoxy resin sandwiched between two metal layers. 18. Identification card according to claim 16, characterized in that the base plate is reinforced with a carrier frame which surrounds the silicon layer. 19. The identification card of claim 1, wherein the card further comprises a restriction means for using the card at a predetermined location. 20. An authentication card according to claim 1, characterized in that at least some of the scanned biometric and information data is transmitted to a separate authentication server for secure user identity verification before being granted direct access to the application server for performing secure financial transactions on behalf of that user. 21. The authentication card of claim 1, wherein, in response to a comparison request for a specific attempt to register to a particular application server that issues a positive comparison result on the authentication server, a secure three-step authentication protocol is activated in which the sequence of query characters is sent from the authentication server. to the ID card, the ID card then uses a sequence of query characters and a comparison request to generate a response, which it then forwards to the application server, then the application server forwards the response to the request to the authentication server, which verifies that the response to the request is valid. 22. The identification card of claim 1, wherein the card output is used to receive physical reception in a secure area. 23. Identification card according to claim 22, characterized in that the records of successful and unsuccessful connection attempts are served by the card. 24. The identification card of claim 1, wherein said means comprises at least one of: an electrical contact interface device; and a wireless forwarding interface device. 25.Intelligent identification card containing: a built-in sensor for reading live biometrics; a first processor coupled to said sensor, a first processor having memory for storing said data, a first processor equipped with said first processor, comparing the scanned biometrics with a predetermined threshold, and verifying said data; generating a message only if the data overlaps within a predetermined threshold; a second processor mounted thereon coupled to said first processor for performing the functions of an identity card, a verification message activating said second processor therein; and interfacing with an external network connected to one of said first processor or said second processor. 26. The identification card of claim 25, wherein said second processor is an ISO SmartCard processor. 27. The identification card of claim 26, wherein said first processor is functionally separated by a firewall from an ISO SmartCard processor. 28. The identification card of claim 26, wherein all external data is transferred to and from a first processor provided therein via an ISO SmartCard processor. 29. The identification card of claim 26, wherein all external data is transferred to and from an ISO SmartCard processor via a first processor therein. 30. The identification card of claim 29, wherein the first processor is provided with a first connector used for data entry during the entry process and a second connector connected to an external network. An identification card according to claim 25, further comprising: a location detector installed therein, an identification card for determining the current location; and a device that restricts the use of the card depending on the defective location. 32. The identification card of claim 31, wherein said location detector is provided with: Global Positioning Satellite (GPS) signal receiver. The smart identification card of claim 25, further comprising: Indicator finger position for real-time feedback while the user manipulates their finger over the fingerprint sensor, thereby facilitating optimal finger positioning above the sensor. 34. The identification card of claim 25, wherein said interface has at least one of: a wireless interface coupled to said second processor provided therein; and a wired electrical interface coupled to said second processor provided therein. 35. The identification card of claim 34, wherein said wireless interface is compatible with an ISO antenna used for both data and power transmission. 36. The identification card of claim 34, wherein said interface further comprises: a security antenna which is connected via said power circuit to said first processor mounted therein, said security antenna only supplying power to said first processor mounted therein. 37. The identification card of claim 36, wherein said security antenna also supplies power to said sensor via said power circuit. 38. A method of identifying a user of a smart identification card, a smart identification card having a memory for storing information therein and a biometric sensor mounted therein, the method having: scanning live biometric data using a sensor therein, comparing, within a predetermined threshold, the biometric data scanned with the corresponding information stored in the memory stored therein; generating a verification message only if there is a threshold overlap; and transmitting the verification message to an external network, wherein the verification message has at least extracts from the scanned biometric data. The method of claim 38, further comprising: forwarding the verification message to the remote authentication system for additional verification. The method of claim 39, further comprising: storing information in a remote authentication system that is different from information stored on the ID card. 41. The method of claim 39, wherein the comparison algorithm used in the identification card is different from the comparison algorithm used in the remote authentication system. 42. The method of claim 38, further comprising: transferring at least some scanned biometric and informational data to a separate authentication server, secure user identity verification before granting direct access to the application server, secure financial transactions on behalf of that user. The method of claim 38, further comprising: accepting a comparison request for a specific attempt to register with a particular application server; and secure running of the three-step authentication protocol, if a positive comparison result in the comparison request response is issued, an authentication protocol having: sending a sequence of query characters from the authentication server to the identity card: generating a query response based on the query character sequence and the comparison request on the identity card; request response forwarding to the application server forwarding the request response from the application server to the authentication server and verifying on the authentication server whether the request response is valid. 44. A smart identification card user identification method, a smart identification card having a memory stored therein for storing information data, a biometric sensor security processor and an ISO card processor, comprising: scanning live biometric data using a sensor installed therein, comparing the biometric data scanned using a security processor with relevant information stored in the memory stored therein, within a predetermined threshold; generating a verification message using a security processor only if there is a threshold overlap, Verification message activating ISO card processor; and Activating the ISO card processor if the user identity is verified. The method of claim 44, further comprising: entering data during the entry process through the first connection to the security processor; and permanently disconnecting the first connection after completing the data entry process. 46. The method of claim 44, wherein all external data to and from the ISO card passes through a second connector of the security processor. 47. The method of claim 44, wherein all external data to and from the security processor passes through an ISO card processor. 48. The method of claim 44, wherein the biometric data includes fingerprint data and the sensor is a fingerprint sensor that reads data from a user's finger placed on the sensor. The method of claim 48, further comprising: providing real-time feedback of the finger position while the user manipulates his finger over the fingerprint sensor, thereby facilitating optimal finger positioning above the sensor. 50. The method of claim 44, wherein the comparison process uses a hybrid comparison algorithm that takes into account both individual details and the overall spatial representation of the scanned biometric data. The method of claim 44, further comprising: providing real-time feedback of the finger position while the user manipulates his finger over the fingerprint sensor, thereby facilitating optimal finger positioning above the sensor. 52. The method of claim 44, wherein said transmitting a verification message has at least one of: transmitting via a wireless interface connected to an ISO card processor; and transmission through a wired electrical interface connected to an ISO card processor. 53. The method of claim 52, wherein said wireless interface is compatible with an ISO antenna used for both data and power transmissions. 54. The method of claim 52, further comprising: supplying power to the security processor via the security antenna and the power circuit connected to the security processor, the card is provided with a security antenna and power circuit. The method of claim 54, further comprising: power transmission through the installed biometric sensor via the security antenna and power circuit. 56. A smart identification card user identification machine, a smart identification card having a memory stored therein for storing information data and a biometric sensor mounted therein, the apparatus having: a device for scanning live biometrics using a sensor therein, a device for comparing the scanned biometrics within a predetermined threshold with corresponding information stored in the memory stored therein; a device for generating a verification message only if the data is within a predetermined threshold; and a device for transmitting the verification message to the external network, wherein the verification message has at least extracts from the scanned biometric data. 57. A smart identification card user identification machine, a smart identification card having a memory stored therein for storing information data, a biometric sensor security processor and an ISO card processor, comprising: comparing the biometric data using a security processor, within a predetermined threshold, with the corresponding reference data stored in the memory stored therein; a device for generating a verification message using the security processor only if the data is within a predetermined threshold, a verification message activating the ISO card processor; and an ISO card processor that activates the device if the user identity is verified. 58. The apparatus of claim 57, further comprising: Indicator finger position for real-time feedback while the user manipulates their finger over the fingerprint sensor, thereby facilitating optimal finger positioning above the sensor.