NL1015501C2 - System for verifying data carrier objects, e.g. membership cards, access passes, etc., uses local scanner or other checking system, which is linked to a central verification station - Google Patents

Abstract

The intending user of a facility presents a membership card, pass or other data carrier (3) to a local automatic end station (2), data read from the carrier is encrypted and fed to a central station (1), where the data is decrypted (17) and compared with stored information in databases (7, 8, 9). If the data on the data carrier is authenticated, a signal is sent back to the end station, which allows the user access to the controlled application (23), e.g. a turnstile, computer terminal, etc

Description

Short designation: method for authentication and authorization of an object.

The invention relates to a method of authentication of an object, which can be a person or a device.

In a method known from practice for checking the authenticity or authenticity of an object, information characteristic of the object is sent between the object and a controlling authority, in particular a data processing station.

If it is desired that the object can be authenticated at several geographically dispersed location, on the one hand it is possible to perform the authentication at each location completely independently of another location. When authentication 15 uses data that cannot be accessed for the object, or at least unchangeable data, this requires that this data be stored at all locations. This prevents large-scale application of the method.

On the other hand, it is possible to store the data required for each authentication at a central location and to perform the authentication centrally or locally. This has the drawback that for each authentication related to the object, data is sent between the central location and a remote location where the object has registered. There is then a risk that the data related and transmitted to the object 25 may be intercepted and possibly modified by unauthorized persons. This method of authentication also offers the possibility of registering locations performed by the object from the central location and, possibly inherent to the locations, actions performed by the object. Although it is forbidden in most countries to carry out such registration, in particular where the objects are persons or objects belonging to the persons, for instance centrally registered vehicles, the fear that this prohibition will be violated will not be entirely dispelled. could be.

The object of the invention is to eliminate the objections mentioned and to provide an authentication method whereby an object can be authenticated at 1015501 2 different locations by means of data exchange to and from a central location without data related to the object during communication. , whether encrypted or not, is sent.

This object is achieved according to the invention by means of the method according to claim 1.

This allows the object to be verified anonymously for authenticity and another object, which may also be a person or device, can decide to perform certain actions with the registered object upon receipt of a positive authentication notification from the central location. or a right to release the notified object.

For example, if the registered object is a person and a data carrier is only provided to a certain category of persons, for example children, adults, students, the elderly and supporters of a certain football club, it is impossible for a person who is not certain group should be positively authenticated despite anonymity.

The invention also relates to a method for authorizing the object after authentication of an object, that is to say releasing a certain right to the object, which may consist of the right to have a data related to another object property.

Other features and advantages of the invention will become apparent from the following explanation of the method of the invention in combination with the accompanying drawings, in which:

Fig. 1 shows a diagram of an embodiment of a data processing system suitable for performing the method of authenticating an object according to the invention;

Fig. 2 shows an elaboration of FIG. 1 of a system suitable for authenticating and subsequently authorizing an object according to the invention; and

Fig. 3 shows another embodiment of FIG. 1 of a system 35 suitable for authenticating and subsequently authorizing an object according to the invention.

Fig. 1 shows a data processing system comprising a central station 1 and one or more terminals 1015501 3 2 connected to the central station, which may be wireless. The terminal 2, like a person or other mobile object relative to the terminal 2, forms an object that can be authenticated within the system, that is to say that its authenticity can be established.

5 A data carrier 3 is issued to the object. When the object is a device, such as the terminal 2, the data carrier 3 is an inseparable part of the object. If the object is a person, the data carrier 3 can be carried by the person and brought into communication with the terminal 2 when registering at the terminal 2. The data carrier 3 is, for example, a chip card. Because the principle for authentication of the different objects is the same, the explanation below will mainly be limited to the authentication of persons as objects.

Before authentication of a person can be effected, the system including data carriers 3 to be used in the system must be initialized. During initialization, a data and communication processing device 6 of the central station 1, or of course an associated slave data processing device, generates unique registration numbers which can be assigned to data carriers 3 and stores these registration numbers in a system database 7 of the central station 1. Furthermore, the data and communication processing device 6 generates a number of unique keys to be assigned to data carriers 3, hereinafter also referred to as authentication keys, of an encryption algorithm and stores these keys in a system database 8 of the central station 1. A system database 9 contains pairs of a registration number and a key assigned to respective valid data carriers 3. For different types of objects, the central station 1 can have a separate group of system databases 7-9 for each object type. Furthermore, the central station 1 may have a system database for storing the privileges of persons, in particular officials authorized to issue data carriers 3, and a system database for storing the powers of terminal 2. Furthermore, the central station 1 may have a system database for storing data about a session using an authorization stored in a system database 35, for example during the allocation or invalidation of registration numbers and keys. For simplicity of explanation of the invention, only the system databases 7, 8, 9 are shown.

1015501 4

During the creation of a data carrier 3 and subsequent issue to a person, an integrated dual terminal or duo station (not shown) can be used through which both the person for whom the carrier 3 is intended and an officer with appropriate powers with the central station 1 can communicate. During the production, a unique characteristic of the person is recorded and stored in a data processing unit of the data carrier 3. The stored attribute can be compressed essential data of the actual attribute and can be encrypted by means of a key, hereinafter referred to as attribute key, stored in the data processing unit of the carrier. Furthermore, an available registration number is retrieved from the system database 7 and an authentication key from the system database 8 during the production and stored in the data carrier 3. The unique identifier of the person and the authentication key and, if applicable, the characteristic key are stored in the data processing unit of the data carrier 3 such that the characteristic and the keys cannot be read from outside the data carrier 3. During this session, the data and communication processing device 6 stores the registration number and the authentication key taken from the system databases 7, 8 in the pairing system database 9.

The registration number retrieved during the session, as well as the key, can be stored in the data processing unit of the data carrier 3. However, the registration number may also be registered in the data carrier 3 in other ways than electronically, even in a way that is legible to the human eye.

Unless otherwise stated, an authentication key is meant hereinafter and in the claims by "key".

The unique object characteristic is, for example, a fingerprint or an iris image of the person concerned or, when the object is a device, a unique number that can be removed irremovably.

Moreover, before the authentication system can be used, the central station 1 repeatedly performs a preparation step after the initialization phase explained above. To this end, the central station 1 comprises a clock 15, a challenge generator 16, 35 an encryption device 17 and an encryption result storage and verification device 18.

The clock 15 supplies one or more clock signals to the challenge generator 16, to the encryption result storage and verification device 18 and the data and communication processing device 6. At each of successive generation times, the challenge generator 16 generates a random challenge which, for example, consists of a random number of 124 bits. The challenge generator 16 supplies the 5 challenge to the encryption device 17. The data and communication processing device 6 meanwhile retrieves the keys assigned to data carriers 3 from the pairing system database 9 and delivers them to the encryption device 17. The encryption device 17 encrypts the generator 16 receive challenge with each of the keys retrieved from the system database 9 for generating central encryption results and delivers these results to the encryption result storage and verification device 18 where they are stored.

Depending on the type of object to be authenticated, different intervals between challenge generation times can be used, for example, one second for objects that are people and six seconds for objects that are end stations 2.

After the initialization and preparation of the system explained above, authentication of objects can take place.

When a person reports to a terminal 2 with his data carrier 3, it is locally verified in a first verification step whether the data carrier 3 belongs uniquely to the offering person. For this purpose the unique characteristic of the offering person is recorded and compared within a shielded environment, in particular of the data processing unit of the data carrier 3 itself, with the unique characteristic stored in the data carrier 3, possibly after prior decryption thereof.

When an equality is determined during the first verification step, a second verification step follows in which the authenticity of the carrier 3 is verified. To this end, the terminal 2 first asks the central station 1 a challenge, in particular the most recently generated challenge, and supplies a challenge received in response from the central station 1 to the data processing unit of the data carrier 3. The data processing unit of the data carrier 3 encrypts the challenge with the authentication key stored in the data carrier 3 to generate a local encryption

UOISSM

6 result and sends the local encryption result through the terminal 2 to the central station 1.

Subsequently, the data and communication processing device 6 of the central station 1 supplies the received local encryption result to the encryption result storage and verification device 18, together with a time code which indicates the generation time of the data delivered to the terminal 2 and the data carrier 3. proposes a challenge. To simplify communication, the time code is sent together with the challenge to the terminal 2 and from there 10 returned together with the local encryption result. Alternatively, the data and communication processing device 6 must maintain a record of the time codes associated with challenges sent to terminals 2.

The encryption result storage and verification device 18 compares a received local encryption result with the central encryption results stored for the associated time code and supplies a result of this comparison to the data and communication processing device 6. The data and communication processing device 6 supplies the comparison result, whether or not in adapted form, as authentication notification to the terminal 2. Depending on the comparison result, a presentation unit 20 of the terminal 2 can give an appropriate presentation. For example, the display unit 20 may simply consist of four illuminators, one illuminator of which indicates the terminal being in or out of operation, one of which indicates a waiting or processing state of an authentication session, and two illuminators that illuminate when the result of the comparison in the encryption result storage and verification device 18, respectively. was positive or negative and thus indicate whether the person resp. may or may not be authentic.

A positive authentication notification indicated by the presentation unit 20 of the terminal 2 can cause a manager of the terminal 2, for example a cashier of a theater or a receptionist of a hotel, to grant the person a specific right, for example to grant of a service, such as selling an admission ticket or booking an overnight stay, possibly with a discount if the data carrier 3 is of a certain type.

1015501 7

Furthermore, the terminal 2 can further forward the authentication notification to an application device 23. The possibly unmanned application device 23 can be very diverse, for instance an access mechanism, such as a turnstile, a durable device, such as a computer, a play device. or amusement device, or, when the terminal 2 is mobile, a vehicle immobilizer.

When a positive authentication of the object, in particular, a person, has been obtained in the manner explained above, it can be decided to release a remotely stored or monitored right of the object for the object. Figures 2 and 3 show elaborations of the system of figure 1 with which this is possible.

In the diagram of Fig. 2, the central station 1 has an internal central attribute register bank 26 consisting of one or more registers assigned to respective attributes and / or subscribed entities. The attributes can contain properties of objects and rights assigned to objects. The properties can be of various kinds, from very limited to extensive, for example a year of birth, a nationality, the validity of a document, such as a driving license, and fines still to be paid. Furthermore, the attributes can include rights with which a certain object can exercise a certain right after authentication, for example for requesting one or more properties of another object. As a result, it is possible for an end station 2 about the person to be explicitly informed, i.e. no longer, whether the authenticated person has reached a minimum age required to enter a casino, drives the person with a valid driver's license or, at border control, still have to pay fines. For this it is necessary that in advance an attribute is related to a registration number stored in the system database 9 and thus to a specific data carrier 3. The relationship can be made by authorized persons, thus authenticated within the system, if the object is identifiable, for instance when during the creation of the data carrier 3 for a person personal data are linked to the registration number and stored in the internal central attribute register bank 26. In this connection it is noted that during the phase of creating a data carrier 3 no authentication phase for authenticating the object for which the data carrier 3 is intended is required. The only authentication that may take place during the creation phase takes place in the usual manner between the object and the creating authority, for example by the submission of a passport by a person applying for a data carrier to an official. During any authentication of the object thereafter, no object-related information is exchanged except when expressly authorized to do so from the internal central attribute register bank 26.

Under certain circumstances, it may be desirable that an attribute of an object be read from the internal central attribute register bank 26 by an authenticated other object only if the former object is authenticated during the same session. For this purpose, a duo terminal 20 can be used, as explained earlier for issuing a data carrier 3. Another application can be at a border crossing when a local application device 23 is entitled to a certain attribute of a crossing the border crossing. and consult an authorized person, for example, the unpaid fines given to the person, where the local application device 23 of the central station 1 only receives a notification and shows the customs officer about the fact to the service officer-20, after which the official together can request the full details of the attribute with the passing person through a duo terminal. As a result, the details of the consulted attribute do not have to become visible to other persons passing through the local application device 23, while the officer 25 via each desired station of several duo terminals after authentication of himself and of the person the details of the relevant attribute. A similar procedure using a duo terminal can be used in access control for sports stadiums. Yet another application of the attribute register bank 26 and a duo terminal may consist of consulting one or more attributes of a third person who is not necessarily informed about this consultation, by two investigating officers who are authorized during the same session.

In the system according to the scheme of Fig. 3, the internal central attribute register bank 26 of the central station 1 has been replaced by an external central attribute register bank 27 located outside the central station 1 and which belongs to an application device 28, which for example 2 .1015501 9 shared by a number of local stations is the central computer of a financial institution, such as a bank or insurance company.

When a person wishes to execute a transaction at such an institution and authenticates himself via a local terminal 2, the institution will usually still want to have more certainty about the identity of the person than the data carrier 3 provides, for example by means of imprint. To this end, the institution and the central station (or administrators thereof) may have agreed that the central station in such situations acts for the authorized central person opposite the external central application device 28 in the manner as the data carrier 3 previously opposite the central station 1 did and the external central application device 28 takes over the role of the central station 1. In other words, after initial registration of the person with said institution, the external central application device 28, or a similar device, provides a second key allocated by this device to the data carrier 3, after which the central station 1 provides this second key in a separate register, for example of the system database 7 or of the internal central attribute register bank 26 of figure 3, in relation to the data carrier 3. After the central station 1 has authenticated the data carrier 3 during a later session, the central station 1 reports this directly or via the local terminal 2 to the external central application device 28, in response to which this device 28 presents another (second) challenge to the central station i, which then encrypts the second challenge with the second key of the data carrier 3 authenticated during this session and sends the result of this encryption to the external central application device 28. The external central application device 28 performs a specific encryption and compares the result with the encryption result received from the central station 1. When an equality is thereby established, the external central application device 28 is completely sure of the correct relationship between the person, the data carrier 3 and attributes stored in the external central attribute register bank 27, such as an account number 35 or the name and address of the person. . The initial storage of the second key in the central station 1 can be done in various ways, for instance by using a duo terminal 2 1015501 10 which can be operated by the person and an employee of the institution.

The application device 28 can be arranged at (great) distance from the terminal 2, in which case it is advantageous if the application device 28 transfers the information released from the external central attribute register 27 to a further terminal 2 sends application device 29, from which, for example, an account holder or bank employee can return information. The application device 29 may also be of a kind like the above-described application device 23 and may be used for access control, such as for football supporters whose allowances are stored in the external central attribute register bank 27 of a computer device managed by a sports union.

1015501

Claims (10)

A method of authenticating an object, comprising: a) performing an initialization step, comprising the sub-steps of: a1) generating and storing a number of unique keys and a number of unique registration numbers in a central station shielded from the object ; a2) storing in a data carrier a unique characteristic of the object, such that the stored characteristic cannot be read from outside the data carrier; a3) storing in the data carrier a unique key not previously stored in a data carrier, such that the stored key cannot be read from outside the data carrier; A4) registering a unique registration number in the data carrier; a5) storing in the central station the pair of the key and the registration number stored in the data carrier such that the key and the registration number are related to each other and repeating steps a3) and a4) for the key and the pair's registration number is prevented; b) performing a central preparation step at the central station at any one of consecutive predetermined times, comprising the sub-steps of: bl) generating a random challenge; b2) encrypting the challenge using the key of each key registration number pair of step a5) to generate respective central encryption results; b3) storing the respective central encryption results related to the particular challenge generation time; c) performing a local verification step upon logging in for authentication of the object in a local station, comprising the sub-steps of: cl) obtaining a current unique feature of the object; 1015501 c2) comparing the unique characteristic stored in the data carrier with the current unique characteristic; c3) when determining an equality in step c2), requesting from the central station a challenge that was used to carry out step b); c4) encrypting a queried challenge obtained in step c3) within a protected environment with the key stored in the data carrier for generating a local encryption result; C5) sending the local encryption result to the central station; d) performing a central verification step at the central station, comprising the sub-steps of: dl) comparing the local encryption result obtained in step c5) with the central encryption results associated with the generation time of the step c3 ) obtained requested challenge; d2) supplying to the local station a comparison result obtained in step d1) that equals a positive authentication message and otherwise a negative authentication message. 2. Method according to claim 1, characterized in that the object is a person and the object characteristic is a unique body characteristic of the person. Method according to claim 1, characterized in that the object is a terminal (2), the data carrier (3) is housed in the terminal and the object characteristic is a unique terminal characteristic assigned to the terminal. Method according to a preceding claim, characterized in that the object characteristic is stored encrypted in the carrier (3) and in step c2) the encrypted object characteristic by means of an appropriate attribute key that cannot be accessed from outside the carrier within a protected environment decrypted. 1015501 A method according to any preceding claim, characterized in that the central encryption results are stored for at least a period of time in which steps c1 to dl) are performed. 5 Method according to any preceding claim, characterized in that in step b1) a time code for the determined generation time of the challenge is generated, the time code in step c3) is sent together with the requested challenge to the local station (2) and 10 in step c5) the time code is sent together with the local encryption result to the central station (1). A method for authorizing an object after authentication of the object according to any of the preceding claims, comprising: e) relating the central encryption results to the registration numbers during step d); f) storing in a preparation step in one or more attribute registers (26, 27) the attributes associated with the object, which may include properties of the object and rights assigned to the object to consult the properties of other objects, wherein the attributes of an object is related to the registration number of the object; g) in response to determining an equality in the attribute registers in step d1) supplying the registration number of the object to access one or more of the attributes of the object; h) releasing or having released a right assigned to the object of the attributes of the object; i) sending to the object a result obtained after exercising the right of step h). Method according to claim 7, characterized in that the attribute registers (26) are maintained in the central station (1). Method according to claim 7, characterized in that the attribute registers are registers (27) of an external application station (27, 28) common to several local stations (2) outside the central station (1), the authentication notification of step d2) from 1015501 the central station (1) is sent to the external common application station (27, 28) and from the external common application station (27, 28) the result of the exercised right is sent to the object. 5 Method according to claim 7, characterized in that the attribute registers are external attribute registers (27) of an external application station 10 (27, 28) common to several local stations (2), outside the central station (1), wherein during another initialization step by the common application station (27, 28. a second key is assigned to the data carrier (3), the common application station (27, 28) sends the second key to the central station (1), the central station (1 ) stores the second key in relation to the registration number of the data carrier (3), the common application station (27, 28) generates another, second challenge after authentication of the data carrier (3) by the central station (1) and to the central station (1), the central station (1) encrypts the second challenge with the second key 20 and supplies a result of the encryption to the application station, the common appl ication station performs a corresponding encryption and compares the result thereof with the encryption result received from the central station (1), and when the common application station (27, 28) determines an equality, the common application station (27, 28) one or more of releases the attributes stored in the external central attribute registers (27) for the data carrier (3). .1 o 15 5 01. t