NO318168B1 - Combined access and input device - Google Patents

Description

This invention generally relates to access and input devices for providing access and allowing user input into access-restricted devices, apparatus, devices, systems or networks.

In particular, the invention relates to a portable and an embedded access or input device and methods of using these to achieve a high level of security.

Automated access from a device or terminal to another device or a network/server computer is subject to authentication by authorized users. Such automated access eliminates manual authentication of the user by human recognition, and must in some form rely on electronic identification of the user.

One way to solve such electronic identification of the user is to issue a secret password to the user. Another method is to issue a physical authorization token (eng.: a token) to the user. In both cases, the system relies on the assumption that the person who knows such a password, or alternatively bears such a physical sign/mark, has proven his identity, on the assumption that this has authenticated the authorized user. This is not the case, as passwords, or badges, can be intentionally handed over to a third party, or inadvertently and illegally acquired by such a third party. Despite these obvious limitations of such identification using something you know (eg a password) or something you wear {eg a sign/badge) this method is still the dominant method of user identification for networks/servers, etc. because this is practical, but mainly because no better alternative is yet commercially available on a larger scale.

An alternative identification method is by something you are, that is, some form of secure identification by biometrics, such as fingerprints. Although biometrics is gaining ground, this is happening slowly and is not being used on a larger scale. There are several reasons for this late growth in biometric identification for access to networks and servers: a. Biometrics must gain wide acceptance among the public. This will be the case as soon as the advantage of biometric identification is greater than the assumed disadvantages. This includes a lack of knowledge about, and a lack of available biometric solutions. Very few users will acquire biometric solutions by themselves, if such biometrics do not form part of an overall solution that provides significant benefits for the user in the form of increased usability and accessibility. Basically, this factor will be resolved when

factors (b) and (c) are resolved.

b. The unit cost of biometric sensors still needs to be reduced, in order to achieve broad commercial solutions. This partly awaits cost-effective designs, which are continuously being developed, but are mainly dependent on volume. This factor will accordingly be resolved when

factor (c) is resolved.

c. The main obstacle to secure access authentication using biometrics is that the systems and solution providers must build biometric access control into their systems. The main obstacle to this is that there are still no generally accepted international standards for biometrics. A system or a solution provider must therefore choose between several alternative upcoming biometric standards, with the risk of choosing the wrong one, or one of the standard proposals that will not be the dominant winner. Most major system vendors are reluctant to make a choice on this basis, due to the serious consequences of a wrong choice: - The costs involved in modifying software on servers etc. are significant, especially if the non-winning standard is chosen, and the software modification process must be repeated in the near future. The price for biometric hardware comes in addition to this. - The negative PR effect from choosing the non-winning biometric standard can be serious, and should not be underestimated. - The time to market will be significantly extended if a non-winning biometric standard is chosen. This

is further exacerbated by the lead this will give to any major competitors who have chosen the winning biometric standard from the start. This can disrupt the entire ranking between major solution providers.

Previous known attempts to solve this problem have been to impose biometric standards. However, there are currently several alternative standards battling side-by-side with no clear winner yet. Some known attempts to solve the problems have been to use extracted biometric details to form encryption keys. Such a solution is described in US Patent 5,995,630 as it requires identical biometric representation at the receiving end (eg a network server). A similar approach is described in US Patent 5,991,408. However, neither solves the problem of avoiding the need to choose a biometrics standard, as they both pose an even more serious problem that will delay biometrics implementation even more, namely proprietary solutions. Other attempts to solve the problem are focused on improving communication security using the concept of encryption systems with public keys, such as, for example, European patent EP 0 225 010 Bl. Although such systems improve the security of network communications over insecure communication lines, public key encryption systems do not prove that the bearer of the electronic certificates (checksums for keys and other identity properties) is actually the right person. In addition, these solutions still require a PIN code for the user to access the PKI system with electronic certificates. This means that yet another PIN code must be remembered by the user. In addition, system security is no better than the protection of this PIN code. As a countermeasure against cracking the PIN codes, the industry tends to create longer and longer PIN codes, making it even more difficult for the user to remember them. The natural response for users is to write down their PINs, leaving a potentially wide-open security hole.

Similarly, the two current main directions in the prior art to try to solve the problems (biometric encryption, and biometric representation on servers, on the one hand, and the concept of public key cryptosystems on the other) do not really solve the above problems of network communication, and especially not for safe access to devices and appliances.

Apparent competitors to the portable embodiment of the present invention are the so-called USB dongles with built-in memory (up to 1 Gb). Some of these USB dongle memory devices are also equipped with fingerprint sensors to prevent unauthorized access to the information stored on board the USB dongle. While these devices may physically look somewhat similar to one of the preferred embodiments of the present invention, there is no similarity in their functionality at all. The USB dongles currently on the market are purely portable storage devices, while the present invention focuses on secure communication triggered by an authorized fingerprint on such portable devices.

On this basis, major solution providers hesitate to take an early step, even though there is a general consensus that biometric access control is much more secure, and applicable, than password-based or badge-based access control. However, as market leaders hesitate to bring biometric access methods widely offered to the market, the lack of availability to the general public will continue to hold back the growth of biometric access control systems.

It is one object of the present invention to overcome the above limitations by providing a portable access control device to be connected to, and to allow access only by authorized users to, an access-restricted apparatus, device, network or system, for example a computer terminal, an online bank or an Intranet for a company or public management organization that includes an interface device, whether electronic or mechanical or both, to connect the device to the access-restricted device, such as a computer terminal port.

It is a second object of the present invention to overcome the above limitations by providing a built-in access device for integration into peripherals of networked computers or communication terminals, to allow only authorized users access to all types of proprietary networks (LAN, WAN, etc) typically represented by online banking applications, intranets for companies or public enterprises, and the like.

It is a third object to provide a method of using a portable access device or an embedded access device to provide a superstructure from biometric input to a computer, to secure communication protocol responses, to a non-biometric network.

It is yet another object to provide a portable or embedded access device and methods of using the same that provide improved security compared to current technology.

It is a further object of the present invention to provide a portable or built-in access device and methods for using such that do not require a transmission of biometric fingerprint information over otherwise open and insecure parts of communication systems when using such devices.

It is yet another object of the present invention to provide a portable or built-in access device and methods of using such that do not depend on the development of international biometric standards.

It is a further purpose of the invention to provide a combined access control and user input device or device and the use of such a device which can be a built-in part of independent devices with one or another form of access control which also satisfies the purposes set out above.

It is yet another object of the invention to provide a method for improved secure access control and user input in stand-alone devices having a built-in access control or user input device as given above.

The purposes of the invention as stated above are achieved with a portable device as given in independent claim 1.

Preferred embodiments of the portable device are given in the independent claims 2-6.

The purposes of the invention are also achieved with a built-in access control device as given in independent claim 7.

Preferred embodiments of the built-in access control device are given in the independent claims 8-9.

The purposes of the invention are also achieved with a method for using a portable access control device according to claim 1 or a built-in access control device according to claim 7 in a manner as given in independent claim 10.

Preferred embodiments of the method are given in the independent claims 11-17.

The purposes of the invention are also achieved with a built-in access control and user input device or apparatus which has the features given in independent claim 18.

Preferred embodiments of the embedded access control and user input device or apparatus are provided in the dependent claims 19-21.

The purposes of the invention are also achieved with a method for secure access control and user input in stand-alone devices as given in independent claim 22.

The invention will now be explained in detail with reference to the accompanying drawings, wherein

Fig. la Shows a network (N) or a system using one

fingerprint sensor according to prior art. Fig. 1b shows a network (N) or a system of devices that use a biometric device according to the invention. Fig. 2a shows a first embodiment of an integrated circuit which

is an integral part of the invention.

Fig. 2b shows a second embodiment of an integrated circuit which is

an integral part of the invention.

Figs. 3a,3b Show a portable access device according to up the invention in the form of a USB dongle. Figs. 4a, 4b show a portable access device according to the invention in the form of a PCMCIA card. Figs. 4c Shows a PCMCIA card where the integrated fingerprint sensor is protected under a sliding cover, for mechanical protection of the sensor. Fig. 5 illustrates how an access device according to the invention can be built in as part of the keyboard or mouse in a computer terminal or laptop computer. Fig. 6 illustrates how an access control and user input device or device according to the invention can be placed as a built-in part of a hotel safe. Fig. 7 illustrates how an access control and user input device or apparatus according to the invention can be placed as a built-in part of a medicine cabinet. Fig. 8 illustrates how an access control and user input device or device according to the invention can be used in a portable door control unit for applications in the electronic systems in cars. Fig. 9 illustrates how an access control and user input device or apparatus according to the invention can be built into the gear lever or steering wheel of a car.

The traditional approach to biometrics, as in current methods, is illustrated in Figure IA. The user places or swipes his finger (A) over the access/input device with a fingerprint sensor (B). The entire image from the sensor (B) is transferred from the access/input device to the processor (C) (for example a PC) where implemented Software module(s) (D) captures the sensor signals and processes them to reconstruct a 2-dimensional fingerprint image, and then extracts the details of the fingerprint, and finally either performs a matching locally at the PC (C) or transmits the interpreted fingerprint features to a server in a network (E).

In an access-restricted device, device, network or system (N), for example a computer terminal, an online bank, or an Intranet for a company or a public enterprise, a portable access device is preferably placed to give only authorized users access as shown schematically in Figure IB. A biometric processor {F1) may be integrated with the sensor (B) or alternatively placed as a separate integrated circuit (F2) next to or closely coupled to the sensor (B), or alternatively embedded in a PC or its peripherals (F3). The sensor (B) and biometric processor (F; pointing to Fl, F2 or F3) can work in stand-alone mode

(for example in a hotel safe without a network connection)

or may be connected to another device (C) and optionally connected to a network (E). The biometric processor as an integrated circuit is exemplified in Figures 2A and 2B. The advantages of this configuration are several. As the biometrics processor (F) is directly connected to the sensor (B), the biometrics processor (F) can be specially adapted to optimize the interaction between the sensor (B) and the biometrics processor (F). Such special adaptation of the biometrics processor (F) to the sensor

(B) combined with a direct connection to, or integration into, the sensor (B) enables it to be included

methods and procedures that significantly limit interception of the signals between the sensor (B) and the biometrics processor {F). It further significantly reduces the network traffic between the sensor (B)/biometric processor (F) and the other network-connected processors {C and N). However, the main advantage is that the biometrics processor can transform biometrics from the sensor

(B) to general communication security measures in a network, such as including Secure Key Generation (SKG) as a basis

for encryption into the biometrics processor (F). By this method, biometric sensors (B) can be connected to a network (C and N) in a secure way according to existing infrastructure, without the need for the supplier of the network system architecture to make any decision about which biometric standard will develop in the future as the winning standard. In this method, the biometric processor (F) becomes a superstructure between the biometric sensors (B) and the current network infrastructure (E).

A biometric sensor in the form of a fingerprint sensor (5) is connected to a biometric processor in the form of an integrated circuit - IC (1) which is the core device of the invention. Two versions of the IC are shown in Figures 2A and 2B. The details for the IC one will now be explained.

The sensor (5) is connected to a fingerprint sensor signal recording and preprocessing block (5C) via a first interface block (5A) as well as a wake-up circuit (5B), the function of the latter being to start up all the other blocks on the IC (1). When a finger is detected on the surface of the sensor (5), the output signals from the sensor (5) will rise above a preset threshold, triggering the pickup circuit (5B) to start up the rest of the IC (1) in a preset sequence. The first blocks to boot up are the Image Capture and Pre-Processing Block (5C) as well as the High Speed Bus (3) and the Volatile Memory (6 or 6C), all of which are connected to the High Speed Bus (3). The pre-processing block is designed to perform the initial, labor-intensive processing of the raw images captured from the sensor (5). The temporary results are stored in the volatile memory (6A or 6C) which is connected via the high-speed bus (3) to a first memory interface block (6B or 6D). The volatile memory (6A or 6C) thereby provides working memory that is available to other modules on the IC (1).

Meanwhile, the remaining blocks on the IC (1) are booted up in a preset sequence, starting with the central processor (2) which is a powerful processor, such as ARM 9, or equivalent. The processor unit (2) is also connected to the high-speed bus (3) to allow communication with the other components or modules on the chip. When the pre-processing block (5C) has crushed the raw images recorded to a temporary stage of significantly compressed information, i.e. a data set of reduced size, called temporary fingerprint data. The temporary fingerprint data is fed to the central processor (2) for final reduction of the captured fingerprint image to compact representations, so-called details. Such details are distinct points where fingerprint lines (grooves) start or stop, or branching points of grooves and can be described using at least one vector comprising X and Y coordinates, and the direction of the individual details, stored as an alphanumeric string in non-volatile memory (7, 7A, or 7C). The non-volatile memory (7, 7A or 7E) connected to the high-speed bus (3) via a second memory interface block (7B or 7D) is typically used for storing program code, such as administrative software, custom security output responses, secret information such as seeds and key numbers for encryption, electronic certificates and fingerprint representations in the form of so-called details. These fingerprint representations (main details) are compared by means of the central processor (2) with main fingerprint representations stored in non-volatile memory (7, 7A, or 7C). If a positive match is established, the chip can continue to generate a secure key (SKG) either processed using an algorithm on the central processor (2). based on a seed pre-stored in the non-volatile memory (7, 7A or 7C), or alternatively built into the hardware block (8A). If the same SKG algorithm is run on two separate computers (for example a server (30) and the central processor (2) on the IC (1) it will give the same key, or password, when the identical algorithm on both the two separate the computers are fed with the identical seed. While the algorithms are normally assumed to be known, and may be the same for all the computers in a network (N), or for a subset of users, the seed is individual and secret and known only to the system administrator and the user. SKG- the algorithm may be designed to produce a pseudo-random identical key on both computers (2 and 30) which is either valid for a time frame, or alternatively changes for each transaction, this may require the present key number as well as previous key numbers to be stored in the non-volatile memory (7, 7A, or 7C). Secret information such as seeds, key numbers, IP addresses, etc. can either be scrambled using block (8) and stored in a regular Flash memory ( 7), or securely stored in Smart card environments (7A or 7C). When a key is generated, as above, the administrative software, stored in the non-volatile memory, can then

(7, 7A or 7C) and run on the central processor (2) combine the information to be part of a secure communication between the IC (1) and the network server {30). The information to be encrypted may include User ID, password and other information. Encryption is performed in hardware blocks (8 or 8B or 8C). The rules for secure communication enforced in the current network (N) are built into the administrative software running on the central processor (2) , and can be adapted to include PKI biometric verification and handshake sequences. Encryption blocks (8, 8B or 8C) can also be used to encrypt general information transactions between the IC (1) and the network server (30), if desired. Access to such extended encryption will be granted to the user pending a positive match of his fingerprint with an authorized fingerprint representation from tables of compact details, pre-stored in the non-volatile memory {7, 7A or 7C). The IC {1) also includes hardware and/or software required to supply output signals to a number of other interface blocks (9A, 9B, 9C or 9D) to transfer data to other devices and networks (N) external to the IC {1). In the present invention, the IC (1) is adapted to supply data to the external access-restricted device, device or system. This second interface block may include hardware and software to support a USB (9A), Ethernet (9B), GPIO (9C), PCMCIA/UART (9D) and/or Smart Card (7C) interfaces. With the exception of the USB and Ethernet interfaces, the other interface blocks are served by a bus {4) with a lower bandwidth and capacity than the high-speed bus (3) . The two buses (3 and 4) are connected by a bus bridge (11C). The hardware blocks that do not depend on high speed are connected to the later bus (4). The hardware blocks on the IC {1) are designed to perform their respective tasks in a minimum amount of time, and to interact with each other with a minimum of delay and queuing. In addition to the hardware blocks, the central processor (2) which executes the administrative software provides a high degree of flexibility by adapting the programming to secure communication with external devices and networks (N).

Thereby, the IC (1) is designed as a multipurpose tool that can operate a fingerprint sensor (5) in stand-alone mode, but it can also communicate with external devices and networks (N) by bridging the biometrics from the sensor (5) to a non- biometric representation into the network (N) and on its server(s) {30). The IC (1) transforms the fingerprints, under the current secure communication rules, into a common representation by, for example, password and User ID on a server (30).

The main difference between the IC (1) in Figure 2A and 2B is that the version in Figure 2B has volatile memory (6C) and non-volatile memory (7A) as integrated blocks in the IC (1), thereby reducing the need for data exchange with external memory and thereby further increasing security and the device's operating speed by keeping almost all data processing of fingerprints, and automatically triggered security responses from these, internally inside the IC (1).

The use of the IC (1) for authenticating an authorized user to provide access to an Intranet comprising a server (30) in a network (N) will first be explained for the option where the IC (1) is a portable device to be plugged into a terminal (31) in the network, either as a USB dongle, as illustrated in Figures 3A and 3B, or as a PCMCIA card, as illustrated in Figures 4A and 4B.

In one embodiment of the invention, the portable device has an IC (1) which is mounted on a small printed circuit board PCB (12B), which also holds a fingerprint sensor (5). The PCB (12B) is connected to at least one of a USB interface (12C) or a PCMCIA mechanical interface (13B). Surface electronic components for carrying at least one of the mechanical USB interface (12C) and the mechanical PCMCIA interface (13B) are mounted on the PCB (12B). An SDRAM chip (6), usually with at least 4MB capacity, is also mounted on the same PCB (12B). Furthermore, a non-volatile serial Flash chip (7), usually with at least 256 Kbyte capacity, is also placed on the same PCB (12B). In this embodiment, all previous components and chips are protected inside an enclosure (12A or 13C).

In another alternative embodiment of the invention, the portable device has an enclosure designed with a recess which thereby enables a finger (A) to be placed on, or swiped over, the sensor (5). With the sensor located at the bottom of the recess, it will have some protection while still being easily accessible with your finger (A).

In yet another embodiment of the invention, the portable device is designed with an enclosure that is equipped with a sliding lid (13D) which enables a finger (A) to be placed on, or swiped over, the sensor (5) which is protected under said sliding lid, but still easily accessible with your finger (A).

The slide cover (13D) can be forced to the closed position by a spring mechanism, so that it fully covers the sensor (5) when the slide cover is not pushed aside by a finger (A) when a fingerprint image is to be captured. A finger guide structure (13E) is placed next to the sliding cover (13D) when the sliding cover (13E) is in the closed position, and fully covers the sensor (5). The purpose of the finger guide (13E) is to intuitively guide the finger

(A) in the correct position to open the sliding lid (13D) and thereby swipe the finger (A) correctly over the sensor (5) if the sensor (5) is of the swipe type. In this embodiment, the UART interface (9D) of the IC (1) usually carries the PCMCIA port (13B).

In a further embodiment of the invention, the portable device is equipped with non-volatile memory (7) which is expanded with additional capacity beyond the 256 Kbyte minimum capacity to provide additional storage capacity for data, thereby enabling the device to operate as a general portable data storage. For such additional storage capacity, the IC (1) can be equipped with a USB controller for a mass storage with at least one control endpoint and 2 volume endpoints (in/out) to provide access to data inside the portable device, only accessible by a positive match of the the captured fingerprint image with one of the fingerprint representations for authorized users stored inside the portable device.

The following operations will usually be carried out for the use of the devices according to the invention: - The network administrator will organize the delivery of the portable devices (12 or 13) to the authorized users in a personalization process for the chip/IC (1) where data is pre-stored on the chip/IC (1). This involves loading the IP addresses of a targeted Intranet server, the selected encryption algorithm, and other data characterizing the Intranet onto the portable device (12 or 13). This information is either scrambled by block (8) for storage on external non-volatile Flash memory (7),

or alternatively securely stored in built-in non-volatile Smart Card memory (7A) or on an external non-volatile

Smart card memory (7E).

The network administrator, or the persons to whom he has delegated authority, will then enroll the user who will be the "owner" of the portable device (12 or 13). Such delegation can be performed by the administrator who enrolls new sub-administrators on the server, with the privilege of enrolling new users. Once the administrator has enrolled a sub-administrator, including recording one or more of the sub-administrators' fingerprints, the administrator must countersign with his own pre-approved fingerprint, before the sub-administrator's privilege to enroll new users is authorized by the software on the server (30). Thereby, a delegation hierarchy is maintained, which enables monitoring of administrator and sub-administrator authorizations, to check for unintended use of administrator rights, to detect any rogue server in

the hierarchy.

- Registration of a new user, by the administrator or a sub-administrator will be carried out on a terminal connected to the server (30). The administrator (or a sub-administrator) will perform the enrollment procedure for a new user, including recording one or more fingerprints for the

new user, and issuing a seed for the SKG algorithm to such new user. Finally, the administrator, or sub-administrator, will complete this procedure by countersigning with his fingerprint. If the countersignature fingerprints match that of an authorized administrator, or sub-administrator, the enrollment procedure is considered valid, and the personalized data is downloaded to the portable device (12 or 13) connected to the terminal. If the countersignature is not authenticated, the registration is deemed invalid and will be cancelled.

The user has, by registering above and handing over a portable device (12 or 13), been authorized for access to the Intranet network (N), or parts of it. In the latter case, with partial access, the definition of which parts of the network, or directories on the server (30), to which the user has authorized access will be defined in

The user profile, stored on the server (30) .

With the help of such a portable device, the user can safely access the server (30) on the network (N) from a terminal (31) in the network (N), or from any terminal connected to the server (30) in the network (N) , using the Internet, either using fixed lines or using wireless connections. Such access will now be described using an example with the USB dongle as illustrated in Figures 3A and 3B which contains an IC (1) which

shown in Figures 2A and 2B.

- This example involves a user who is traveling and wants to connect to the Intranet server (30) on the network (N) from an Internet Café or a Business Center at a hotel. The user will insert the portable device (12 or 13) into the USB port (or alternatively into the PCMCIA opening in the terminal, if the portable device is a PCMCIA card). The USB dongle (12) may have an extension cord for the USB connection, in case the USB port is inconvenient

located on the back of the terminal (31).

- To start the connection procedure, the user swipes his finger over the fingerprint sensor (5) on the USB dongle. This

will trigger a signal to the excitation block (5B) on

the sensor interface (5A) on the IC (1) .

- The trigger signal from the sensor (5) to the wake-up block (5B) will cause the wake-up circuit (5B) to start up the pre-processing block (5C), the high-speed bus (3) and the volatile working memory (6A or 6C). The preprocessing block (5C) will immediately start recording the fingerprint image from the sensor (5) via a first interface block (5A), while the pickup circuit (5B) starts up the remaining blocks on

The IC (1), starting with the central processor (2).

The preprocessing block (5C) will crush the raw data, ie.

the captured fingerprint images, using hardware-embedded algorithms optimized for the labor-intensive initial high-speed processing of fingerprint data, thereby reducing it to a temporary form, to be stored in the volatile

working memory (6A or 6C).

- When this data reduction is completed by the preprocessing block (5C) designed to perform this number crunching at a maximum speed in a dedicated hardware block (5C), the reduced data is gradually ■ transferred from the volatile working memory (5C) to the central processor (2) via

the high-speed bus (3).

The central processor (2) will further reduce the fingerprint data to a compact form by so-called details, where important details of the fingerprints are transformed into an alphanumeric string comprising at least the X and Y coordinates of each detail, plus its direction. This compact fingerprint representation using details can be expanded with other features when needed. When the central processor (2) has completed the reduction of the captured fingerprints to compact detailed form, it will transmit this access detail table via the high-speed bus (3) for temporary storage in the

short-term working memory (6A or 6C).

- The central processor (2) will obtain the compact fingerprint detail information from a master detail table, formed during the enrollment of the authorized users, stored during the enrollment of the authorized users, stored in non-volatile memory (7, 7A or 7C}, and compare the one with the access detail table temporarily stored in the volatile

working memory (6A or 6C).

The matching algorithm, which is a subset of the administrative software, will place the detail points of the access attempt detail table over the detail points of the main detail table, and translate and rotate the upper one until a best fit is established. Such a best fit is determined by assigning a predefined tolerance range around each of the main detail points, and checking whether the position of the detail points for the access attempt falls within the limits of the tolerance range. Thereby a comparison of the extracted features representing the fingerprint recordings with the features of the pre-stored ones is achieved

the fingerprint representations.

- The number of detail points matching between the access attempt detail table and the master detail table required to validate an authenticated user is preset in a subset of the administrative software by the system administrator. The minimum number of matching detail points required to declare a positive match may be varied by the system administrator according to the sensitivity of the contents of the directories to which the user is seeking access. The concept of a binary match or no-match can be extended with a quality feature, where an absolute match, where the detail points of the access attempt coincide exactly with the corresponding master detail table, gives the highest score. The quality score for each matching pair of details can then be gradually reduced until the location of the details for the access attempt falls towards the limit of the tolerance area around the main detail point. If the matching is positive, the connection process will automatically continue. If the result of the matching is

negative, then the connection process is canceled at this stage.

- One result of the occurrence of a positive match could be that the release of an IP address from the Smartcard block (7C) or

from the external Smartcard chip (7E).

The next step in the connection procedure involves the device (USB dongle or PCMCIA card) (12 or 13) automatically loading a small Java application (eng.: applet) from its non-volatile memory (7, 7A or 7E) into on the terminal (31) via the USB port (9A) in the case where the device is a USB dongle, or via the UART port (9D) in the case where the device is a PCMCIA circuit board. This small Java application contains the IP address of the server (30)

to which the user seeks authorized access.

- Once the central processor (2) has established a positive match between the details of the access attempt and the resident master details, the administrative software [stored in the non-volatile memory (7, 7A or 7E)] will calculate a secure key. The secure key will either be calculated using an algorithm executed on the central processor (2) (for the case of Figure 2A), or alternatively using a dedicated hardware block (8A) for the case of Figure 2B). The general algorithm will generate the secure key, and the special key or password will be generated as a result of the seed being entered into the algorithm. This seed will either be scrambled and stored in scrambled form in non-volatile memory (7) in the option of Figure 2A, or be securely stored in a Smart Card environment (7A) in the case of the

alternative IC architecture outlined in Figure 2B.

The secure key will be input to encryption block (8,

8B or 8C) for encryption of a message/communication. The message will include the following elements: - The device number of the USB dongle or PCMCIA card (12 or 13) and the SKG key number (not the key itself) in encrypted format. - The device's (12 or 13) IP address in encrypted format.

- The secure key number (in encrypted format).

- The user's ID, in encrypted format.

Optionally, PKI verification in encrypted format, for the case of authentication of the user holding the electronic certificate.

- Other encrypted information required by the special requirements for secure communication, in the prevailing Intranet. - The calculated communication response is thus a result that depends on the comparison of fingerprints above. This message/communication is encrypted to form a secure output in a predefined format and sequence (for example handshake procedures) and is transmitted to an external device, network or system through one of the communication interfaces. - Thus, if a positive match of the fingerprint recordings with the fingerprint representation of an authorized user is achieved, an output signal is generated from the IC/chip (1) including the targeted IP address and encrypted

communication.

- When this information is received, for example, by the server (30) in the network (N) that is targeted, the receiving server (30) will look up the unencrypted serial number, or the IP address of the device (12 or 13) in the privilege subset for the data store on the server (30). - From this data set, the server (30) will retrieve the special seed issued to this user during registration, is The algorithm for generating a secure key (SKG) on the server (30) then becomes an input to this seed, together with the open the (non-encrypted) key number. - If the key number from the device (12 or 13) is higher than the key number that the server is currently using (keys are out of sync), the server will increase the key number to match that of the device (12 or 13), and generate the corresponding key from SKG -algorithm with the seed stored using the device's serial number, as input to the decryption process. - If the key number supplied by the device (12 or 13) is lower than the key the server (30) is currently using, then the server will return its current key number to the device (12 or 13) implying that the device steps up its key number accordingly. - If the encryption fails (an incorrect password is displayed),

the server (30) will assume that the received communication attempt is false, and that the server will cancel further steps in the communication procedure.

A subset of the administrative software customizing the secure output response of the targeted network or intranet (N) to a predefined format and sequence including handshake sequences could be preloaded into the non-volatile memory (7A, 7E, or 7).

Preferably, this preloaded subset of administrative software is capable of combining one or more of the following steps: - generation of a secure key or password (8 or 8A), - application of any of the encryption methods at hand and built into the hardware blocks, such as DES, ECB, CBC, TDES (8 or 8B) or any proprietary encryption algorithm also built into the hardware (8C), - customizing handshake sequences according to the rules of secure communication for the device, network or system (N). The preloaded subset of the administrative software is preferably also adapted to perform sequencing of the respective functional blocks on the chip/IC (1) to produce secured output data suitable for transmission in the calculated network (C) and for processing by receiving devices connected to the network (C).

The output of the IC (1) could also be blocked (unauthorized access condition) if the matching of the recorded fingerprints is negative with respect to any of the authorized fingerprint representations stored in the non-volatile memory (7A, 7E, or 7) .

The output from the IC (1) can be opened (authorized access state) if the above matching is positive.

By means of these features of the invention, a local fingerprint authentication at the device (12 or 13) will be transformed into a password and an optional handshake procedure as for the secure communication procedure of the current network (30) without having to include biometric representations on the server (30). Thereby, the system provider of the network (N) does not have to choose any of the upcoming biometric standards, with the built-in risk of choosing a non-winning biometric standard. The system administrator will still have the security of biometrics, through the devices (12 or 13) when authenticating authorized users.

In an alternative application according to the present invention, an access device with the sensor (5) and IC (1) is built into peripheral hardware for the terminal (31), such as, for example, building the sensor (5) and the IC (1) into a PC mouse or a keyboard or on the chassis of a laptop. In general, the access device for embedding may have all or many of the technical characteristics of the portable device described above, however, some aspects of this application will be explained in more detail with reference to Figure 5.

The embedded system (15) comprises the fingerprint sensor (5) which is connected by means of a cable (15B) to a printed circuit board (15A), such as the IC (1) as well as external volatile memory (6) and external non-volatile memory is mounted on.

The PCB (15A) also contains a connector (15C) for connecting the embedded device (15) into the peripherals for a terminal (31) or the computer for a stand-alone device. The biometric device (15) can be built into the terminal's (31) mouse (41) or keyboard (42), or into the chassis of a laptop PC (40).

This procedure for using the built-in access device will follow the same procedure as described above for the portable device, possibly with an alternative enrollment method called "remote enrollment" and described below. Note that this remote registration option can be used in portable devices (12 or 13) as well as in built-in applications. - This enrollment option means that the system administrator does not personally oversee who registers their fingerprint at the sensor (5). - The system administrator, or his delegate, will hand over a seed to the potential user, for example wood

registered post.

- The mailed package may, in addition to the seed, also include a CD-ROM with the personalization data for the biometric device (15), in the case of an embedded option. For the case of the portable device option (12 or 13), the postal package may include the device fully personalized so that the first user only has to enroll

his finger(s).

- Alternatively, the new user can connect via the network (N) to the system administrator, to perform the remote registration procedure in online mode. This will involve a special transfer where the personalization data for the embedded device (15) is transferred over the network

in a special session.

- The first person to register their fingerprint is assumed to have the correct identity, and will become the "owner" of

the device.

- When a person has performed a remote login and has become the "owner" of the device, a special sector of the non-volatile memory (7, 7A or 7E) will be locked. This memory sector will contain the personalization data for a particular network (N). This sector cannot then be opened for modification by anyone other than a system administrator with special privileges. However, other memory sectors will be available to other networks (N) or other service providers. The built-in device (15) will thus comprise a chip for several services each

proprietary memory sector is inaccessible to other service providers or network system administrators.

Yet another aspect of the invention relates to stand-alone applications, or applications within a local network, for example in a car. Examples of such applications are:

- Hotel safes,

- Personal safes (for example in student dormitories, etc),

- Medicine cabinet,

- Armory,

- Biometric systems for the automotive industry.

Examples of such "stand-alone" applications will be separately described below. However, it should be understood that this aspect of the invention may include all or most of the technical aspects described above for the portable access device and the embedded access device.

The method of secure access control and user input in stand-alone applications according to this aspect of the invention will typically include many or all of the steps described above for the built-in or portable access device, however limited to operations performed in the stand-alone application itself.

Generally, when an embedded access control and user input device or apparatus according to the invention is used in a stand-alone device, the operation and control software is preloaded into the non-volatile memory block (7 or 7A or 7E) of the integrated circuit IC (1). The central processor block (2) on the IC (1) executes said operation and control software for the stand-alone device.

The method for secure access control and user input in stand-alone devices having a built-in access control or user input device according to the invention generally includes steps similar to those outlined above for the portable access device.

Hotel safes involve frequent check-in of new guests for a limited time (for example, a single night's stay). Furthermore, there may be several users (for example a family) who require access to the safe. An important feature is that when the door in the safe is left open for a period of time (for example 5 minutes), all the resident master fingerprint detail tables should be automatically deleted, so that the memory is clean when the next guest(s) check into the room. Another factor is the ability to track unauthorized access attempts, for example by rogue servers.

The standalone hotel safe application will be explained with reference to Figure 6. The hotel safe (50) in this example is not connected to any network, and only has a power supply from the mains (not shown). The safe is equipped with a hinged door (51) with locking bolts (52). In the front of the hinged door (51) there is a cover (53) which houses the user interface comprising a fingerprint sensor (5) and a socket for connecting a service unit (not shown). The service unit can be a PDA that can be used to reset the settings in the safe's administrative software, download event tables, and download fingerprints from failed opening attempts. The fingerprint sensor (5) is connected by means of a cable (15B) to the printed PCB circuit board (15). The PCB (15A) houses the integrated circuit (1), external volatile memory (6), external non-volatile memory (7) and optionally a connector (15C) to another printed circuit board (54) containing the control system for the safe, including a connection to the service unit (not shown). The two printed circuit boards (15 and 54) are mounted on the inside of the hinged door (51) on the "safe" side, while the sensor (5) is mounted on the outside, in the lid (53).

The safe will be operated as follows, with reference to Figure 6, and Figures 2A and 2B. When a guest checks out of the hotel room, he will leave the safe door (51) open. When the safe door (51) has been left open for a preset time, stored in the IC's (1) administrative software, all the master detail representations of the fingerprints stored in the non-volatile memory (7) will automatically be erased, leaving the safe memory in a "clean" state for the next guest. When the next guest(s) checks into the room, the guest will find the safe (50) with the door (53) open, waiting for the next "owner" to register their fingerprint. The guest will now register their fingerprint with the sensor (5) . When the guest touches the sensor (5), this will trigger an output voltage from the sensor (5) which triggers the IC's (1) pickup circuit (5B) The fingerprint will be processed by the preprocessor block (5C) and the central processor (2) to be stored in compact format as a detail table in non-volatile memory (7, 7A or 7C) using the volatile memory (6 or 6C) as working memory. Such processing of the fingerprint into compact detail representations should take less than 1.0 seconds. When this processing is complete, a beeper (not shown) in the front cover (53) will beep for a preselected period of, for example, 10.0 seconds. Within this time frame, a next fingerprint can be captured, processed and stored by the IC (1). This can be one of the guest's other fingers, or the fingers of his family. This process can be repeated until, for example, the 10 second time frame for beeping since the last fingerprint was enrolled runs out without a new fingerprint being enrolled. At this stage, a number of compact master fingerprint representations, in the form of details, can be stored in the non-volatile memory (7, 7A or 7C). The safe door (51) can now be locked. When the door is closed in this way, however, the locking bolt(s) (52) will not be closed until one of the enrolled users countersigns with their fingerprint on the sensor (5), and this countersignature fingerprint is found by the IC (1) to match one of the enrolled main fingerprints stored in memory. This will prevent the safe from being accidentally closed by non-registered persons. When the safe's door (52) is closed and locked, it waits for an authorized fingerprint to open the safe. Any unauthorized fingerprint attempting to open the safe can be recorded, for subsequent download to the service unit (not shown). This will have preventive effects on any rogue servant who attempts to tamper with the safes, in order to gain illegal access. When a fingerprint image from the sensor (5) is captured and processed by the IC (1), the central processor (2) will perform a match analysis of the access attempt details with the templates of the authorized master details stored in the non-volatile memory (7, 7A or 7C). In the case of a positive match, the administrative software in the safe control PCB (54) will retract the locking bolts (52) and the hinged door (51) will pop open. The safe control PCB (54) can be eliminated by transferring all the administrative software for the safe control PCB to the IC (1) as it has ample capacity and as the fingerprint processing will only be performed part of the time. The final step in the operating procedure for the hotel safe (50) is for the user to leave the safe door (51) open when checking out of the room, automatically causing all master prints to be erased from the non-volatile memory (7, 7A or 7C).

Personal safes (for example for student boarding houses) will normally involve less frequent registration of new users, while each user must have access to the safe for a longer period than a hotel safe. Similarly, the feature of automatically erasing the main fingerprint details when the door is left open for a period of time would be impractical. Instead, the cover (53) of the front door (51) can be equipped with a keyboard, or at least some function keys, which enable the user to send commands to the IC (1) such as, for example, "delete main fingerprint". Alternatively, such commands can be communicated from the user to the IC (1) by means of fingerprint commands, which use the IC's (1) navigation mode. If a function button or fingerprint commands are used, the user must countersign with their fingerprint to authenticate the command. This will prevent any person from giving commands to the IC (1).

Medicine cabinets will have a different layout than the safe versions above. The main purpose of a medicine cabinet with biometrics is to prevent the theft of drugs and prescription drugs. Considering the consequences of any emergency situation, the main purpose of the medicine cabinet with biometrics is not to block access to the cabinet, but to log all access for subsequent review if inconsistencies in the contents are detected, for example at each shift change. Furthermore, this requires that the medicine cabinet with biometrics goes to open mode in the event of a fault, in the event of a power failure, etc. Correspondingly, the principles of the invention will be the same, but the flexibility of the invention will be used to adapt these principles for the user interface. Explanation of the operation of the medicine cabinet with biometrics will be made with reference to Figure 7 and Figures 2A and 2B.

The medicine cabinet with biometrics will be made in two versions; a network cabinet for clinics and hospitals, and a stand-alone version, for example for private homes. The network version will have an external terminal (42) for administration and printing of access logs, while the stand-alone version of the cabinet will only have a front cover (62). The description will first be made of the network cabinet, and then of the stand-alone cabinet.

The biometric medicine cabinet (60) has a hinged front door (61) containing a locking mechanism (65) and a front cover with a user interface (62) comprising a keyboard, a finger opening including a fingerprint sensor (5) plus 3 LEDs (Light Emitting Diodes ; green, yellow and red). The user interface (62) and the locking mechanism (65) are connected to a printed circuit board - PCB (15) (see Figure 6). The PCB (15) accommodates the IC (1), the external volatile memory (7), the external non-volatile memory (6) and a connector for connection (63) to the external terminal (42) as well as power supply (64) from the mains (64A) and from a rechargeable battery (64B) for emergency power.

The locking mechanism (65) is provided for fail-to-open, in the event of complete loss of power supply, including the rechargeable battery (64B). The handle shaft protrudes from the hinged door (61) carried by a bearing inside the front plate. A cylinder with internal grooves terminates the handle shaft. The internal locking mechanism has a corresponding cylinder with internal grooves. This cylinder is attached to a lever that pushes or pulls the locking bolts. Said lever is attached to a spring device which helps to hold the locking bolts in the closed position, and requires the handle to be pushed down to open the medicine cabinet. The outer and inner cylinders can be connected by a locking pin, with external slots, operated by means of a solenoid controlled from the PCB (15). In the event of power loss [from the mains (64A) as well as the rechargeable backup battery (64B)], this locking pin will be connected to the two cylinders (with internal slots) which allow the safe to be opened using the handle. When the system is active (turned on) the solenoid will be controlled from the PCB so that the latch pin extends, thereby engaging the two cylinders, only when there is a positive fingerprint match allowing the door to be opened using the handle.

The operating procedure for the medicine cabinet with biometrics for the network version for clinics and hospitals is explained with reference to Figures 2a, 2b, 6 and 7. - The person responsible for the safe storage of medicines and prescription drugs on the ward (for example the head nurse) will be registered as system -administrator at the terminal (42) and leads the administration of access to the medicine cabinet, and monitors access to the cabinet. - Registration of the system administrator is carried out by bringing up the access management menu on the terminal's (42) monitor. At first registration, the access table is empty (clean). The first person to register is assigned system administrator rights. Registration is performed by entering the name of the system administrator in the access management table, as well as the user ID, which can be the unique national identity number. - The administrator will automatically be given full privileges.

Once the username and user ID are entered, the system will enter training mode, allowing the person to be enrolled to practice swiping their fingerprint until a minimum number of consecutive attempts (for example, 3) are of sufficient quality to to grant access. Recording of fingerprints will be carried out by the sensor (5) mounted in the user interface on the front cover (62), or alternatively by means of a portable biometric device (12 or 13) attached to the terminal (42) or by means of a built-in biometric device (15 ) which is integrated into one of the terminal's (42) peripheral units (40, 41 or 42).

The registration itself is explained with reference to Figures 2a and 2b, which represent the IC (1) mounted on the PCB (15) in the front door (or embedded in the terminal's peripheral units). The first fingerprint of the system administrator is captured by the sensor (5), which wakes up the IC (!) by a trigger signal to the wake-up circuit (5B). The preprocessor will capture the fingerprint image and perform the initial labor-intensive processing, which reduces the fingerprint image to a compressed temporary format, using the volatile memory (6A or 6C) as working memory via the high-speed bus (3). This temporary data is then fed to the central processor (2) which reduces the fingerprint to compact representation by details. The administrative software will be set up to require a minimum of eg 3 detailed fingerprint representations of acceptable quality. If one of these fingerprint recordings is of poor quality, the administrative software will reject the attempt. When sufficient (for example 2) detail tables have been recorded for the system administrator with acceptable quality, then these will be stored in non-volatile memory (7,

7A or 7C) as the system administrator's master detail table.

- When the next user is to be registered, the system administrator will have to open this procedure by authenticating himself with his fingerprint. When such access is authenticated to the system administrator by a positive match against the system administrator master detail tables stored in the non-volatile memory (7, 7A, or

7C), the next user can be registered.

- Such enrollment is carried out as described above, by a training session followed by the enrollment of a minimum (for example three) of fingerprint details (per finger) of acceptable quality. The system administrator then enters the username and user ID for the user, and finally the user is assigned access privileges (if there are any restrictions). Temporary employees can be registered for a given calendar period. Finally, when all data is entered, the system administrator must countersign with his own fingerprint, to be authenticated against the stored system administrator master details. The registration of the new user

will only be completed, and accepted, by such authenticated counter-signature. - Other users can still be registered in the same way, at any time. The system administrator can delegate such authorization as a special privilege in the database.

For the network version of the medicine cabinet with biometrics, the access tables will be stored both in the IC's (1) non-volatile memory (7, 7A and 7C) built into the user interface cover (62) located on the front of the door (61) of the cabinet (60), as well as as backed up non-volatile memory in the terminal (42) or any server (30) to which the system is connected. Actual access control will be performed locally on the IC (1) in the medicine cabinet (60) while the transactions will be copied to the data store for backup in the terminal (42) or server (30). Thereby, the medicine cabinet (60) can be accessed even if the terminal (42) or the server (30) in the network (N) is down.

- Any authorized user can access the medicine cabinet with biometrics by pressing a user ID on the keypad of the user interface cover of the hinged door keypad, followed by recording a fingerprint image on the sensor (5) in the user interface cover (62). Pressing the user ID will trigger the wake-up circuit (5B) which starts up the entire IC (1). When the user ID has been pressed on the keyboard on the user interface cover (62), the user will enter his fingerprint on the sensor (5) mounted in the user interface cover (62). The IC (1) will process the fingerprint image captured from the sensor (5) into compact detailed fingerprint representations for access locally in the IC (1). The administrative software on the IC (1) then looks up the user ID entered on the local keyboard on the user interface cover (62) and then compares the access detail table with the main detail table stored with the user ID in the non-volatile memory (7, 7A, or 7C). on the IC during registration. If the detail feed with the central processor (2) confirms that the person seeking access is the authentic owner of the user ID, then it will

the administrative software on the IC (1) start up the locking mechanism (65) solenoid, which thus protrudes the locking pin with external slots to connect to the two cylinders with internal slots in the locking mechanism (65). This connection with the locking pin will make it possible to open

the medicine cabinet by pressing down on the handle of the locking mechanism.

- The administrative software on the IC (1) will keep the locking mechanism (65) locking pin engaged for a preset time (eg 30 seconds) while one of the LEDs (light emitting diodes) in the user interface cover (62)

lights up flashing.

- When access is performed, by opening the medicine cabinet door (61), the event is logged in the IC's (1) non-volatile memory (7, 7A, or 7C), and copied to the terminal's (42) database and

optionally to a server (30) in a network (N).

- If the matching of the access detail tables does not match the stored main detail table for the user ID entered, then the locking pin in the locking mechanism (65) will not extend into the grooves in the outer cylinder. Such failed connection will disconnect the handle, so that the handle is isolated and

the cabinet cannot be opened.

- One possibility, to guarantee access, could be to open the medicine cabinet even if the fingerprint does not match, but then to register the fingerprint image and save it for later checking. The opening procedure will be started in the same way as above. The user enters his user id on the keyboard of the user interface (62). If the user ID does not match any of the pre-stored authenticated users, the process is interrupted and the red LED will flash. When a user ID match is established with a pre-stored authenticated user, his fingerprint image will be captured by the sensor (5) and reduced to access attempt details by the IC (1). If there is no match for the pre-stored ones

the main details of the entered user ID, the administrative software on the IC (1) can still open the medicine cabinet by pushing out the locking pin in the locking mechanism (65), but now this event will be registered as a

unauthorized access event. This will cause the IC (1) to store the entire fingerprint image acquired by the sensor

(5) in the event table, for subsequent comparison with

the owner of the user ID entered, or for other persons suspected of having gained access to the medicine cabinet at the registered time of access. The prerequisite for such emergency opening of the cabinet is that the fingerprint image that is recorded has acceptable quality for later matching of prints from candidates.

The above procedure ensures that one can gain access to the medicine cabinet with biometrics even in the event of an emergency, but the identity of the person seeking access is either authenticated by a matching of fingerprint details, or the entire fingerprint image is stored for later identity searches. The above method of looking up the user ID and then checking the identity of the owner of his fingerprint enables a so-called "one-to-one" matching. Thereby, the number of users does not weaken the system's security. The system will thereby provide maximum security, even for large user groups, for example within a hospital. In this case, the fingerprint will be reduced to compact detail form locally on the IC (1) on the PCB (15) in the door of the medicine cabinet, then encrypted by the IC (1) before being transmitted to a server (30) for authentication in the server database.

The main difference between the network version of the medicine cabinet (for example for hospitals and clinics, as described above) and the stand-alone version (for example for private homes) is that the terminal (42) and any network connection (N) to a server (30) will not be included. The differentiation between the two versions is simply a setting in the configuration of the administrative software on the IC (1) mounted on the PCB (15) embedded in the user interface cover (62). All connection with the free-standing medicine cabinet will similarly be carried out through the user interface cover (62) using the individual keys on the keyboard for setting the mode and commands. Any event tables from the stand-alone version of the medicine cabinet can be downloaded to a PDA that acts as a service unit, which is connected via a port directly to the PCB (15). The administration of the stand-alone version will differ slightly from the one above, in that the user interface is limited only to the front cover (62). - The first person to enroll in the standalone version will be the system administrator ("owner") of the standalone version, and will be given full access privileges. - The administrator can use the keys on the user interface cover's (62) keyboard to enroll new users, or delete previous users completely (except the system administrator). - Registration of new users will require authenticating matching of the countersignature by the system administrator to be valid.

Application of the invention to weapon cabinets will be identical to the stand-alone version of the medicine cabinet with biometrics, as outlined above.

Application of the invention in car systems for the automotive industry will be explained using two different preferred versions of the hardware: for the key to the doors of a car (central locking system) and for ignition control (ignition blocking). Although these are preferred locations of the device according to the invention, it will be understood that the same device could be embedded in any part of the car that a user operates, but that it is particularly suitable for those parts where access restriction is also useful. An important point when using the invention in car systems is the security point, to prevent theft or unauthorized use of the car. Thereby, this application is fundamentally different from the network version of the medicine cabinet with biometrics, where the main purpose was not to prevent access, but to guarantee access and leave an audit trail by means of fingerprints of those who have accessed the network medicine cabinet. The automotive industry emphasizes secure access by blocking unauthorized users from accessing the car. These two different applications of the invention demonstrate its applicability and flexibility, and exactly the same principles are used, albeit with different settings in the administrative software.

The application of the invention in cars will be explained with reference to Figures 2B, 8 and 9.

The door control (central locking system) is sketched in Figure 8. The door control, which is a portable device (20), comprises an external enclosure (20) containing a fingerprint sensor (5) coupled to a miniature printed circuit board (21) on which the IC (1) is placed on. The remote control (20) further comprises a battery (25) for power supply which is held in the housing (20) by means of a removable cover (26). The battery (25) is connected to the PCB (21) by means of wires. The remote control is also equipped with a wireless 2-way radio transmitter and receiver (21), and all the active components are connected to the IC (1) using wires (23) via the PCB (21). This remote control for car doors can be made very compact, where the size of the enclosure (20) is determined by the size of the battery (25). Thereby, the physical size of the enclosure can be compressed to the size of a key ring holder.

Inside the car, another built-in device (15) (see Figure 9) is mounted, for example on the gear lever (71) or on the steering wheel (72), for ignition control for the engine. Two sensors can be placed on the steering wheel, where a first sensor (15) is located on the left side of the steering wheel and is intended for audio, GPS, and built-in mobile phone control, while a second sensor (15) is located on the right side of the steering wheel and is intended for gearshift operation and entry/access control (engine ignition). A sensor (15) intended for audio, GPS and mobile phone control, and access/access control (engine ignition) can be placed on a gear lever (71). The display on the instrument panel (see Figure 6) can be operated using finger commands from a sensor on the steering wheel or gear lever.

These two elements, the portable door remote control (20) and the built-in ignition control (15), are both connected to a central computer in the car. The connection of the portable door remote control (20) is by means of a 2-way wireless radio transmitter and receiver (27), while fixed wires to the central computer (not shown) in the car connect the built-in ignition control (15).

Operation of the biometric system when used in cars will be explained with reference to Figures 8, 9, 6 and 2a. The system's protected mode will not be activated until the car is sold from the dealer.

- The dealer will at this stage enter an encrypted command into the system through wireless transmission to the portable door control unit (20), which in turn will transmit the command wirelessly to the built-in ignition device

(15) via the door locks and the car's central computer.

- The retailer will access the database in the terminal (42) protected by fingerprint authentication. - The database at the terminal (42) will download the detailed information of the car to be sold, including its serial number (e.g. the chassis number) from a server

(30) in a network (N).

- These downloaded details will include the unique seed for the secure key generation (SKG) algorithm resident in each of the ICs (1) of the portable door controller (20) and the embedded ignition controller (15) so

as well as at the terminal (42).

- Once the dealer has proven his authority (by fingerprint verification) for this procedure at the terminal (42) he will enter the mode change routine at the terminal

(42) to change the portable door control (20) mode and

the built-in ignition control (15) from open mode, to

safe mode.

- The terminal (42) will encrypt a communication message to the portable door control (20) based on the particular

the seed for the current car, generating a unique password. - The encrypted message will be transmitted wirelessly from the terminal (30) to the portable door control (20) using two-way wireless transmission, where a handshake communication procedure is invited. - The IC (1) in the portable door control (20) will receive the encrypted message and start decryption by retrieving the seed

from non-volatile memory (7A).

- This seed will be fed into the SKG block (8A) which generates a secure key, to generate a temporary

password.

- The password is passed on to the encryption block (8B or 8C) together with the encrypted message from the terminal (42). If the encryption fails, the communication procedure will be terminated by the IC (1) in the portable door control (20). - If the encryption is successful, the communication procedure will be completed, involving for example handshake sequences, until the portable door control (20) is satisfied that

the message from the terminal (42) is genuine and authorized.

- The IC (1) in the portable door control (20) will then be put in protected mode, waiting for the first user to be registered with the system administrator of the biometrics system

in the car.

- The buyer of the car (the "owner" of the car) can then train the recording of fingerprints using a training module in

the terminal (42).

- The car owner will then register one or more of his fingers on the portable door control unit (20). This involves the successful capture of a minimum of images (for example three) reduced to main detail tables by means of the pre-processing block (5C) and the IC's (1) central processor (2) in the portable device (20). These master detail tables will be stored in the non-volatile memory (7A) on

The IC (1) .

- The first person to register his fingerprint in the portable door control (20) becomes the "owner" of the car, in the sense that he becomes the system administrator. When successfully enrolled in the portable door control (20) he will countersign with his fingerprint to authorize and start encryption of his master detail table(s) from the IC (1) in the portable door control (20) via the door locks and the

the central car computer (not shown) to the IC (1) in it

built-in ignition control (15) in the car.

- Such transfer of authorized master details will start with retrieving the unique seed for the car from non-volatile memory (7A) for the IC (1) in the portable door control (20). The seed will be fed to the SKG block (8A) for generation of

secure keys in the IC (1) to generate a valid password.

- This password will then be fed to the encryption block (8B or 8C) in the IC (1) of the portable door control (20), initiating encryption of the master detail tables for the "owner's" finger(s). The encrypted message will be transmitted wirelessly from the portable door control (20) using a two-way wireless radio transmitter and receiver (27) via the door locks to the central computer in the car. Note that such registration is the only event where encrypted detail tables are transferred from the portable door unit (20). During normal opening of the door, matching details will only be used to authorize encryption and transmission of simple commands, such as "open

door" or "lock door".

- If the central computer in the car is able to successfully decrypt the message from the portable door control (20), it will forward the encrypted message to the built-in ignition control (15). Failure of the car's central computer to decrypt the message (for example, by non-matching temporary pseudo-random

password) will end the communication procedure.

- When the encrypted message containing the main detail tables for the car owner reaches the ignition control (15), it will

be decrypted.

- The car's unique seed will be retrieved from the non-volatile memory (7A) in the IC (1) of the built-in ignition controller (15). - The seed will be fed to the SKG block (8A) which generates the secure key, to generate a pseudo-random temporary password. - The pseudo-random temporary password will be given to the encryption block (8B or 8C) in the IC (1) to start decryption of the encrypted message. - The "owner's" master detail tables for his finger(s), as obtained from the encrypted message, will be stored in the non-volatile memory (7A) of the IC (1) of the on-board ignition controller. - Prior to this, the "owner's" main detail tables are securely stored in the IC (1) for both the portable door control (20) and the built-in ignition control (15). - The "owner" of the car can now access the car as follows: o He will swipe his finger over the sensor (5) on it

the portable door control (20).

o His finger on the sensor will trigger a signal from the sensor (5) to the excitation circuit (5B) on the IC (1), which starts up the IC (1) in a preset sequence.

o The pre-processing block (5C) will reduce the captured fingerprint image to a reduced temporary format, feeding it via the volatile working memory (6B or 6C) and the high-speed bus (3) to the processor (2).

o The processor (2) will reduce the captured and pre-processed fingerprint image to compact main detail format.

o The processor (2) will then compare this access detail table with the main detail table(s) pre-stored at the time of enrollment in the non-volatile memory (7A).

o In the case of match, the process will be allowed to

continue. If there is no match, the process will be aborted.

- Assuming that the processor (2) establishes a match between the access attempt and one of the resident main detail tables, the processor will proceed to opening (or locking) the car doors; - The processor (2) will retrieve the seed from non-volatile memory (7A) and feed it to the SKG block (8A). - The SKG block will generate a valid, and temporary, password that will be entered into the encryption block (8B or 8C). - The processor will give the "open door" command to the creep-

tering block {8B or 8C) which in turn will encrypt it based on the valid, temporary password from the SKG block (8A) . - The encrypted "open door" command will then be wirelessly transmitted by the transceiver (27) from the portable door control (20) to the built-in ignition control (15) via the transceivers in the door locks and the central car computer. - The encrypted message will be decrypted by the built-in ignition controller (15) by its processor (2) on its resident IC (1) which retrieves the seed from the non-volatile memory (7A). The seed will be entered into the SKG block (8A) to generate the identical, temporary password fed into the encryption block (8B or 8C). If the decrypted message confirms a valid and authenticated "open door" command, then a similar encrypted command will be forwarded to the door locks by the car computer. - Alternatively, the decryption and authentication algorithms can be performed on the central car computer instead of on the built-in ignition control.

The important part is that an authenticated fingerprint triggers the portable door control (20) and the built-in ignition control (15) to generate encrypted communication procedures, involving handshake procedures, fully compatible with the communication procedures of the central computer in the car, and the door locks. The advantage of the invention is that no fingerprint needs to be transferred between the car's system security components (except for registration), but triggers the current, secure communication protocols.

Another advantage of this application of the invention is that the security of the entire system lies in the fingerprint of the car owner (or other users who he has registered), and not in any brand/sign of authorization, such as, for example, electronic keys with complex key generation algorithms. If such an electronic key is lost, there are significant logistics involved in issuing a new electronic key. The logistics involved make such a key replacement both very expensive and time-consuming. The latter can cause significant grief for the car owner.

If a fingerprint-based portable door control device (20) according to the invention is lost, a new portable device can be stored on the supplier's shelf and immediately issued to the car owner. These replacement keys have not been personalized to any particular car as no seed has been downloaded. Such personalization is initialized by a "replacement" version of the vehicle mode control software located in the vendor's terminal (42). The car owner's fingerprint is registered in the portable door controller replacement device (20). They can be authenticated against pre-stored master detail tables in the retailer's database. Once the car owner's identity is satisfactorily established, the owner-protected seed is downloaded from the dealer's database to the portable door control replacement device (20) which is now fully compatible with the in-car embedded system.

As an additional security feature, the portable or embedded device could be provided with means for the input of code or commands. This is achieved by defining a fingerprint storage segment in non-volatile memory (7, 7A, or 7E) where the device can store a series of successive fingerprint representations generated by the fingerprint sensor signal acquisition and preprocessing block (5C). Motion analysis means, in the form of a hardware or a software motion analysis program module, analyze the generated series of fingerprint representations to form a measure of the omni-directional finger movements across the sensor in two dimensions. Translation means in the form of a hardware or software translation program module analyze and categorize the omnidirectional finger movements over the fingerprint sensor according to a predefined set of finger movement sequences. A command table is used to translate the categorized finger movements into control signals where the translation means generate control signals to control the device, for example the stand-alone device, in response to the finger movements on the sensor.

Claims (23)

1. Portable access device for connecting to, and allowing access only to authorized users, to an access-restricted device, device, network or system, such as a computer terminal, an Internet bank or Intranet of a company or a public management activity comprising a device interface, whether electronic or mechanical or both, to connect the device to the access-restricted device, such as a computer terminal port, characterized by- an integrated circuit (IC) (1) which provides increased security by linking the functionality of fingerprint input from a user and, upon positive authentication of the user's fingerprint, to provide secure communication with said access-restricted device, device, network or system, where said IC comprises: - a processor unit (2) which communicates with the other components on the circuit chip via a high-speed bus (3), - a first interface block for memory (6B or 6D) which is connected to the high-speed bus (3) to provide an interface with volatile memory (6A or 6B} thereby providing available working memory for other modules on the IC (1), - a second interface block (7B or 7D) connected to the high-speed bus (3) to provide connection with non-volatile memory (7A or 7 or 7E), for storing program code, such as administrative software, custom output security responses and fingerprint representations in the form of so-called fingerprint details, - a first interface block (5A) for connection to a fingerprint sensor (5), - where said first interface block (5A) is connected to an image capture and preprocessing block (5C), - said image capture and preprocessing block (5C) is adapted to perform the initial the labor-intensive processing of the raw fingerprint images captured by the sensor (5) into a data set of reduced size, called temporary fingerprint data, where the temporary fingerprint data is delivered as output to the central processing block (2) via the high-speed bus (3) for final processing into compact fingerprint representations by so-called details, on the central processor (2), - encryption modules (8 or 8A, 8B and 8C) connected to the high-speed bus (3) to provide encryption information, or alternatively scrambling information, - the processor unit (2) is adapted to add encryption information to the fingerprint data to provide secured data as an output to the high-speed bus (3) and - one or more other interface blocks (9A, 9B, 9C, or 9D) to provide the secured data of the external access-restricted device, device or system via the device interface. 2. Portable device according to claim 1, where the integrated circuit (1) comprises hardware and software required to provide output signals to one or more of the other interface blocks (9A, 9B, 9C or 9D), implemented in the form of a USB port, a PCMCIA port or a UART -gate. 3. Portable device according to claim 1, where - said IC (1) is mounted on a small printed circuit board - PCB (12B), - said PCB (12B) is connected to at least one of a USB interface (12C) or a PCMCIA mechanical interface (13B) - electronic surface components to support at least one of the mechanical USB interface (12C) and the mechanical PCMCIA interface (13B) are mounted on the same PCB <12B), - an SDRAM chip (6 ), typically with at least 4 MByte capacity, mounted on the same PCB (12B), - a non-volatile serial Flash chip (7), typically with at least 256 Kbyte capacity, mounted on the same PCB ( 12B) - a fingerprint sensor (5) mounted on the same PCB <12B), - all the previous components and chips are protected inside an enclosure (12A or 13C). 4. Portable device according to claim 3, where said enclosure is designed with a recess which enables a finger (A) to be placed on, or swiped over, the sensor (5) which is protected below said recess but still easily accessible to the finger (A). 5. Portable device according to claim 3, where - said enclosure is equipped with a sliding lid (13D) which enables a finger (A) to be placed on, or swiped over, the sensor (5) which is protected under said lid, but is still light accessible to the finger (A), - said sliding lid (13D) is forced into the closed position and fully covers the sensor (5) when the sliding lid is not pushed aside by a finger (A) when a fingerprint image is to be captured, - a guide structure (13E) for the finger is placed adjacent to the slide cover (13D) when the slide cover (13E) is in a closed position, and fully covers the sensor (5), the purpose of the finger guide structure (13E) is to intuitively guide the finger (A) into the correct position to open the sliding cover (13D) and thereby swipe the finger (A) correctly over the sensor (5) if the sensor (5) is of the swipe type, - for this application the UART interface (9D) on the IC (1) will support PCMCIA- the gate (13B). 6. Portable device according to claim 3, where - said non-volatile memory (7) is expanded with additional capacity beyond the 256 Kbyte minimum capacity, to provide additional storage capacity for data to enable the device to operate as a general portable data storage - device, and - said IC chip (1) is equipped with a control unit for a mass storage of USB class with at least one control endpoint and 2 quantity endpoints (in/out), to provide access to data in the portable device by positive match of the captured fingerprint image with one of the fingerprint representations for authorized users stored in the portable device. 7. Built-in access device for integration into peripherals of networked computers or communication terminals, to allow only authorized users to access all types of proprietary networks (LAN, WAN, etc.) typically represented by banking applications for the Internet, Intranet for companies and public management activities, and the like, comprehensively that device interface, be it electronic or mechanical or both, for integration by incorporation into a computer terminal's peripheral devices, such as in a PC mouse, a keyboard, or on the computer itself whether it is a laptop PC, a PDA or a mobile phone with wired or wireless access to a network, or network-connected devices containing a computer that permanently or occasionally serves as a terminal in a network, characterized by- an integrated circuit (IC) (1) which provides increased security by superimposing the functionality of fingerprint input from a user and fingerprint authentication to provide secure communication with said terminal and the network to which it is permanently or occasionally connected, by wire or wireless connection, where said IC comprises: - a processor unit (2) that communicates with the other components on chip 'one via a high-speed bus (3), - a first memory interface block (6B or 6D) which is connected to the high-speed bus (3 ) for connection with volatile memory (6A or 6C) thereby providing working memory available to other modules on the integrated circuit, - a second memory interface block (7B or 7D) connected to the high-speed bus (3) for connection with non-volatile memory (7A or 7 or 7E), for storing program code, for example administrative software, specially adapted security output responses, and fingerprint representations in the form of so-called fingerprint details, - a first interface block (5A) for connection to a fingerprint sensor (5), - said first interface block (5A) is connected to an image recording and preprocessing block (5C), - where said sensor signal recording and preprocessing block (5C) is adapted to perform the initial labor-intensive processing of the raw fingerprint images captured from the sensor (5) into a data set of reduced size, named temporary fingerprint data, where the temporary fingerprint data is delivered as output to the central ale processing block (2) via the high-speed bus (3) for final processing into compact fingerprint representations by so-called details, on the central processor (2), - encryption modules (8 or 8A, 8B and 8C) connected to the high-speed bus (3) to provide encryption information, or alternatively mixing (eng. scrambling) of information, - the processor unit (2) is adapted to add encryption information to the fingerprint data to produce secured data as an output to the high-speed bus (3), - one or more other interface blocks (9A, 9B, 9C or 9D) to deliver the secured data to the remote access-restricted device, device or system via the device interface. 8. Built-in/integrated device according to claim 7, where the integrated circuit comprises hardware and software needed to supply output signals to one or more of the other interface blocks (9A, 9B, 9C, or 9D), implemented in the form of a USB port, a PCMCIA port, or a UART gate. 9. Built-in/integrated device according to claim 7, - where said IC (1) is mounted on a small printed circuit board - PCB (12B), - said IC (1) is connected to the PCB (12B) by means of one or several of a USB (9A), an Ethernet (9B), a GPIO (9C), a UART (9D) or a Smart Card interface (7C) on the IC (1), - said PCB (12B) is equipped with a mechanical/electronic interface suitable for the host device, - an SDRAM chip (6), usually with at least 4 MByte capacity, which is mounted on the same PCB {12B), - a non-volatile serial Flash chip (7) , usually with at least 256 Kbyte capacity, which is mounted on the same PCB (12B), - a fingerprint sensor (5) which is mounted on the same PCB (12B), or mounted separately in the host device, and connected to the IC (1 ) on the PCB (12B) using cable. 10. Method for using a portable device according to claim 1 or an embedded device according to claim 7 to provide a superstructure from biometric input to a computer, to secure communication protocol responses to a non-biometric network, comprising in a single integrated circuit (IC) (1) performing the following steps: - recording (5C) of an image from a fingerprint sensor (5) via a first interface block (5A), - pre-processing (5C) of the captured the fingerprint signals in the image capture and pre-processing block (5C) containing hardware built-in algorithms optimized for high-speed processing of the most labor-intensive first processing of the raw fingerprint image data, - transferring the pre-processed data to the processing unit (2) to extract compact detail drawing of the fingerprints via a high-speed bus (3) - acquisition of compact fingerprint detail information by means of the processor unit (2) from a non-volatile storage module (7, 7A or 7E) containing pre-stored master fingerprint representations for authorized persons, - comparison in the processor unit (2) of the extracted features representing the occupied fingerprints with features for the pre-loaded ones - to produce, depending on the result of said comparison, a secure output in a predefined format to an external device, a network or a system through one of the communication interfaces (9A, 9B, 9C, 9D and 7C) . 11. Method according to claim 10, comprehensively preloading into the non-volatile memory (7A, 7E or 7) a subset of the administrative software that tailors the output of a secure communication response to the target network (N) or Intranet (E) in a predefined format and sequence, including for example receipt exchange sequences. 12. Method according to claim 11, wherein the output of the chip (1) is blocked {unauthorized access state) if the matching of IC (1) of the captured fingerprints is negative with respect to any of the authorized fingerprint representations stored in the non-volatile memory (7A, 7E, or 7). 13. Method according to claim 11, where the output of the chip (1) is opened {authorized access state) if the matching of the IC (1) of the captured fingerprints is positive with respect to one of the authorized fingerprint representations stored in the non-volatile memory {7A, 7E, or 7). 14. Method according to claim 11, where the pre-stored subset of administrative software can combine the steps: - generate the pseudo-random secure key or password (8 or 8A), - use any of the encryption methods available and built into the hardware blocks, such as DES, CBC, TDES {8 or 8B), or any other proprietary encryption algorithm also embedded in hardware (8C), - customizing handshake sequences according to the rules of secure communication for the device, network or system. 15. Method according to claim 11, wherein the pre-stored subsets of the administrative software are adapted to perform - sequencing the operation of the respective functional blocks of the chip (1) to produce secured output data suitable for transmission in the targeted network (N) and for processing in receiving units connected to the network (N) . 16. Method according to claim 10, where - the secure communication parameters for a network or a device, such as, for example, encryption seeds (eng.: seed), electronic certificates, PKI keys, IP addresses, etc. for the server or the resident computer which is targeted, is pre-stored in a device during personalization of the chip (1) into either built-in Smartcard blocks (7C) or external Smartcard chips (7E), or in scrambled format on external non-volatile memory (7). 17. Method according to claim 16, where - said secure communication parameters can only be obtained from the built-in Smartcard block (7C) or from the external Smartcard chip (7E) in the case of a positive match between the captured fingerprint relative to a fingerprint representation for an authorized person, and - an output signal from the chip (1) including secure communication responses is initiated depending on the result of a comparison of the captured fingerprints relative to a fingerprint representation for an authorized person. 18. Built-in access control and user input device or device to be a built-in part of stand-alone devices with some form of access control, i.e. hotel safes, medicine cabinets or the like, and to provide increased security, characterized by - an integrated circuit (IC) (1) for superimposing the functionality of fingerprint input from a user for secure communication with other parts of said stand-alone devices, where said IC comprises - a processing unit (2) that communicates with the other components on the chip via a high-speed bus (3), - a first memory interface block (6B or 6D) which is connected to the high-speed bus (3) for connection with volatile memory (6A or 6C), thereby providing available working memory for other modules on the integrated circuit, - a second memory interface block (7B or 7D) which is connected to the high-speed bus (3) for providing connection with non-volatile memory (7A or 7 or 7E), for storing program code, for example administrative software, custom security output responses, and fingerprint representations in the form of so-called fingerprint details, - a first interface block (5A) connected to a fingerprint sensor (5), - said first interface block (5A) is connected to an image capture and preprocessing block (5C), - said image capture and preprocessing block (5C) is adapted to perform the initial labor-intensive processing of the raw fingerprint data recorded by the sensor (5), into a data set of reduced size, called temporary fingerprint data, where the temporary fingerprint data is delivered as output to the central processor block (2) via the high-speed bus (3) for final processing into compact fingerprint representations by so-called details, on the central processor (2), - encryption modules (8 or 8A , 8B or 8C) coupled to the high-speed bus (3) to provide encryption information or to perform encryption or scrambling, - the processor unit (2) is adapted to apply the encryption or scrambling information to the fingerprint data to produce secured data as an output to the high-speed bus (3) , - one or more other interface blocks (9A, 9B or 9C) f or to supply the secured data to other modules in the stand-alone device. 19. Built-in device or device for access control according to claim 18 comprehensively non-volatile storage means for fingerprint information (7, 7A, or 7E), such as for example a Smart Card unit, for storing information related to the fingerprint characteristics of authorized users, - fingerprint input means (5) for inputting the fingerprint characteristics of authorized users in non-volatile memory (7, 7A or 7E) on the IC (1) and - fingerprint verification means in the form of a processing capability (2) including biometric software to check the authenticity of the user trying to access the device. 20. Built-in access control or input device according to claim 18 which additionally allows the input of code or commands by also comprising - a fingerprint storage module (7, 7A, or 7E) where the device can store a series of successive fingerprint representations generated by the fingerprint sensor signal acquisition and pre-processing block (5C), - motion analysis means, in the form of a hardware or a software motion analysis program module for analyzing the generated series of fingerprint representations to provide a measure of the omni-directional finger motion across the sensor in two dimensions. - translation means in the form of a translation program module in hardware or software for analyzing and categorizing the omni-directional finger movements over the fingerprint sensor according to a predefined set of finger movement sequences including directional and touch/non-touch finger movement sequences, - a command table for translating the categorized finger movements to control signals whereby the translating means generate control signals to control the stand-alone device in response to the finger movements on the sensor. 21. Built-in access control and user input device or apparatus according to claim 18, where - the operating and control software for the stand-alone device is loaded into the non-volatile memory block (7 or 7A or 7E) of the integrated circuit IC (1), - said operation and control software for the stand-alone device is performed by the central processor block (2) for the IC (1). 22. Method for secured access control and user input in stand-alone devices having a built-in access control or user input device according to claim 18, comprising performing the following steps in the integrated circuit: - recording (5C) of an image from a fingerprint sensor (5) via a first interface block (5A), - pre-processing (5C) of the captured signal in the image capture and pre-processing block (5C) containing hardware built-in algorithms optimized for high-speed processing of the most labor-intensive first processing of the raw fingerprint image data, - transfer of the pre-processed the data to the processing unit (2) to extract the compact fingerprint detail features for the fingerprints via the high-speed bus (3), - obtaining compact fingerprint detail information by means of the processor unit (2) from a non-volatile storage module (7 , 7A or 7E) that hold the pre-stored master fingerprint representations for a unauthorized persons, - comparison in the processor unit (2) of the extracted features representing the captured fingerprint with features for the pre-stored main fingerprint representations, - to produce, depending on said comparison, a predefined secure output to other parts of the stand-alone device. 23. Use of a built-in access control device or device according to claim 18 to implement safe access to various functions in a car, such as door locks, engine ignition, or the like.