Classifications

• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/20—Individual registration on entry or exit involving the use of a pass
  • G07C9/22—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder
  • G07C9/25—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder using biometric data, e.g. fingerprints, iris scans or voice recognition
  • G07C9/257—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder using biometric data, e.g. fingerprints, iris scans or voice recognition electronically
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/20—Individual registration on entry or exit involving the use of a pass
  • G07C9/21—Individual registration on entry or exit involving the use of a pass having a variable access code
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/20—Individual registration on entry or exit involving the use of a pass
  • G07C9/27—Individual registration on entry or exit involving the use of a pass with central registration

Definitions

• the present invention relates to a system and a method for the automated control of the crossing of a border.
• Border controls e.g. B. at airports, but also in the field of land and ferry traffic are time-critical for cross-border passenger traffic.
• the effort of the control authorities has increased disproportionately to the number of travelers - among other things because of the Schengen Agreement.
• the increasing mobility of people and the growing number of passengers in international air traffic have led to new requirements in passenger transportation.
• the human and financial resources of the state control authorities, air carriers and the airport operator and the spatial conditions at many international airports are increasingly limited.
• the invention is therefore based on the object of increasing the speed of passenger traffic.
• this object is achieved by a system for the automated control of the crossing of a border, with:
• a passage gate arranged in front of a boundary for regulating the passage of the system users with an entrance and an exit, the entrance and the exit being closed in the basic position
• a device arranged in front of the entrance of the passage lock for separating the system users a device arranged behind the singling device, but in front of the entrance to the passage lock, for reading the data stored on the identification media,
• a device arranged in front of the entrance of the passage lock for checking the authenticity of the identification media
• a device arranged in front of the entrance of the passage lock for checking the presence of manipulation of the data on the respective identification medium
• a device for forwarding the personal data to the wanted database and for querying whether the system user is on a wanted list
• the object is further achieved by a method for the automated control of the crossing of a border, which comprises the following steps:
• the system can provide that the device for recording personal data of system users has a device for automatically reading in the personal data.
• the device for automatically reading the personal data can be a scanner.
• the device for recording biometric data advantageously includes a device for recording a fingerprint and / or the retinal structure and / or the facial features and / or the voice and / or language of a respective system user.
• Another special embodiment of the system is characterized by a device for processing the recorded biometric data and converting it into one or more representative data feature (s), which can be used to recognize the system user during the check.
• the device for storing data has a device for encrypting the personal and / or identification medium data and for generating an identification medium-specific key.
• the encryption device is a locally provided security module or is located in a background system that is connected via an online data connection.
• the device for storing the data preferably has a device for electrical personalization of the encrypted data in the identification medium and / or a device for applying the personal data and, if appropriate, a photo and the signature of the respective system user to the identification medium.
• the personal data can be applied to the identification medium in thermal transfer printing.
• the device for storing the data advantageously has a device for covering the identification medium with a laminate film.
• the identification medium is forgery-proof thanks to the laminate film.
• the identification media are preferably smart cards.
• At least one video camera is advantageously provided in the passage lock. This enables the passage lock to be monitored, in particular with regard to the implementation of an effective separation. Furthermore, it can be provided that the device for reading the data stored on the identification media has a device for calculating the identification medium-specific key from the encrypted identification medium data and verification thereof. This makes it possible to carry out a card legitimation check.
• the device for reading the data stored on the identification medium preferably has a device for decrypting the encrypted personal data and verifying the same. This enables a personal identification check.
• Another particular embodiment of the invention is characterized by a device for generating and distributing keys for data encryption and monitoring system operation.
• a device for generating and distributing keys for data encryption and monitoring system operation fulfills the function of a TrustCenter.
• a further particular embodiment of the invention is characterized by a device for managing and monitoring, in particular, the lifespan of all identification media issued to system users.
• a further particular embodiment of the invention is characterized by a device for cryptographic encryption of data transmitted between devices in the system and / or between the system and external devices. This is to protect against unauthorized access to the transmitted data.
• the invention is based on the surprising finding that by integrating official controls into the overall process, with part of the control being preferred in principle, accelerating and simplifying the handling of border traffic is aimed without affecting the quality of the control.
• the at least partially brought forward control can simplify and shorten the control at the border with regard to the previously checked, unproblematic travelers, which enables the police and control forces to concentrate on potential perpetrators and dangers.
• the control carried out in advance allows a machine-controlled cross-border passenger traffic without problems with the police, with all the individual components, which also includes a border control by police officers, namely comparison of persons, authenticity check of border crossing documents, search for a search, permission to cross the border.
• a border control by police officers namely comparison of persons, authenticity check of border crossing documents, search for a search, permission to cross the border.
• travelers who have previously been classified as unproblematic from the police point of view, after filing an application and on a voluntary basis are automatically identified by machine using personal data and biometric data stored on their identification media when crossing the border and checked by the police using an online search query ,
• Figure 1 is a plan view of part of a system according to a particular embodiment of the present invention.
• FIG. 1 schematically essential facilities and equipment blocks of the system
• Figure 1 shows a plan view of part of a system according to a particular embodiment of the invention.
• the part shown concerns the control of system users directly at a border (e.g. national border).
• Figure 1 shows a pass-through gate 10 with an input 12 and an output 14.
• the input 12 and the output 14 are each with a Revolving door 16 or 18 provided.
• the separation can be mechanical, but also z. B. be carried out optically.
• a traffic light can be used. If the traffic light is green, a single person is allowed to pass. When a person walks on red, a visual and / or audible alarm is triggered.
• a card reader 20 for reading smart cards is located between this device and the revolving door 16.
• the revolving door 16 is locked in the basic position and thus closes the entrance 12.
• a biometric data reader 22 In the passage lock 10 there is a biometric data reader 22.
• the card reader 20 and the biometric data reader 22 are connected to a local server of the Federal Border Guard (not shown).
• a video camera 24 In the passage lock 10 there is also a video camera 24 for monitoring the mechanical isolation of the system users.
• a system block which is provided with the reference number 26, relates to the application and issue of a card (so-called enrollment center).
• the card in the form of a smart card 28 serves as a credential for every system user. It is checked when crossing the border in the part of the system shown in FIG. 1, which is referred to here as a decentralized automated border control system 30.
• the decentralized automated border control system 30 comprises a local server of the Federal Border Guard, which is connected via a service server 32 of the Federal Border Guard to a search database 34 of INPOL, a trust center 36, a central data management device 38 of the Federal Border Guard and the enrollment center 26.
• a card application can be made in the enrollment center 26. This includes all process steps that are necessary to record the potential system users, in particular the registration of their personal and biometric data.
• Several enrollment centers can be provided, which are set up at different locations.
• the potential system users present their border crossing document, from which the operator of a PC, on which the acquisition software runs, acquires the data automatically or manually.
• the data record is printed out on a form and signed by the applicant, potential system user.
• the form contains the following additional information:
• the fingerprint of the potential system user is captured using a fingerprint reader (not shown).
• the processing software converts the data obtained from the fingerprint reader into one or more representative data features, which enable the system user to be recognized during border control.
• a test for duplicates is carried out, that is, it is checked whether the applicant is already entered in the system.
• the previously recorded personal data are supplemented by the biometric data and given for encryption. This takes place either on the local system in a security module provided for this purpose or in a background system, for which an online data connection is used for this purpose. is switched.
• the encrypted data is electrically personalized in a smart card blank in the enrollment center and the personal data is applied to the smart card body using thermal transfer printing.
• a photo of the system user and his personal details can also be printed.
• the smart card body is covered with a forgery-proof laminate film. All these steps take place in one machine and are monitored by the PC.
• the smart card is handed over to the system user.
• the entire enrollment takes less than 10 minutes.
• the card application and issuance can also be carried out on site at the border when the system is used for the first time.
• the capture software ensures that smart cards are only issued with the help of legitimate border control officers, only after all the necessary steps have been taken successfully and only for visa-free nationals of certain approved states who are in possession of a valid travel document.
• the card control includes all processes that are carried out during the cardholder's check as part of the entry.
• the card control takes place within a passage lock 10 (see FIG. 1) which the person to be checked has to enter.
• the passage gate itself can be easily integrated into the existing infrastructure, which means that only minor structural changes are necessary.
• the local server is used for process control and for communication with external computers.
• mechanical separation is first carried out by means of a mechanical separation device (not shown) in order to prevent unauthorized persons and several persons from entering at the same time.
• a mechanical separation device not shown
• This measure is supplemented by the use of a video camera 24 in the passage lock 10 and corresponding image evaluation software.
• the person to be checked is asked to insert the smart card into a card reader 20.
• a security module (not shown) for checking the authenticity of the smart card and the personal data stored thereon.
• Each authentic smart card has a smart card-specific key that can be calculated based on certain smart card data by the security module in the card reader 20 and then verified.
• the communication between the smart card and the security module in the card reader 20 is additionally protected with a temporary key that was previously negotiated between the smart card and the security module.
• the personal data including biometric data
• MAC authenticated signature
• the revolving door 16 can be rotated so that the person can enter the passage gate.
• the fingerprint of the system user is collected by means of the biometric data reader 22 and a comparison with that on his smart card stored biometric data. For this purpose, extracts are formed from the locally obtained data and compared with the data features stored in the smart card.
• Abusive users or authorized persons incorrectly rejected by the system are reliably detected in the passage gate at the latest. After a corresponding automatic alarm triggering by the system, intervention by the border control authority or an authorized representative would be necessary to free the person from the passage gate and to carry out a regular border control.
• the required personal data is forwarded to a INPOL search database via the local Federal Border Guard server for verification.
• the design of the pass-through, the type of separation technology used and the release at the exit of the pass-through can depend on, for. B. the ergonomics and management of large traffic flows can be determined.
• the Trust Center 36 serves as the central system component for the administration of all security-relevant aspects of the system, in particular for the generation and distribution of keys and monitoring of the ongoing system operation.
• the central data management device 38 of the Federal Border Guard serves to manage all smart cards issued with functions for monitoring the card life cycle.
• the card management also includes the functions for processing applications, i.e. recording personal data and biometric data.
• the core is the personal data together with the biometric data.
• biometric data is an element of the personal data record.
• About the personal data record is first using a secure hash method, for. B. the SHA-1 algorithm, generates a cryptographic checksum.
• This 160-bit value has the typical properties of a good hash algorithm, which means that it is essentially collision-free.
• the result of the algorithm is used as part of the cryptogram formation, since the entire personal data record is too large as the input date for the encryption.
• the hash value compresses the content of the personal data record to a greatly reduced form.
• the hash value cannot be used to infer the original data. Changes in the personal data record inevitably result in a change in the hash value.
• the secure hash method is not an encryption method, which means that it does not use any keys.
• essential extracts from the personal data e.g. name, date of birth and place of birth
• the data for the query in the INPOL wanted database are encrypted together with the hash value using a private key procedure.
• RSA with a key length of at least 1,024 bits or elliptic curves with a sufficient key length are to be used as private key procedures.
• the private key of an issuing office or the private key of a central instance is used for the encryption of the extract.
• the personal data can be sent to the central instance for encryption and only then can it be personalized in the smart card (e.g. by online request).
• the public key is required to decrypt the extract. This is stored in the control terminals. Decryption first provides the personal data for the INPOL query and the hash value. The hash value is compared with a recalculated hash value. In the case of equality, an unadulterated data record can be assumed.
• a unique smart card number could be included in the personal data record and thus linked to it. It would not be possible to transfer the data to another smart card. A sensible use of this option requires online personalization, in which personal data and the smart card number are encrypted and personalized directly in the smart card.
• the personal data record can be encrypted with the private key of the issuing office. This would then save their public key in the smart card. A control station would then use the public key of the issuing point supplied by the smart card to verify the extract. To prevent misuse, such as the import of forged public keys from an issuing agency, the key pairs of the issuing agency must be electronically signed by a central authority. Such a procedure allows the smart card to be issued without access and authorization by a central system.
• Each smart card in the system is given a unique serial number during manufacture. This serial number is the basis of the cryptographic process that is actively used by the Smart Card are executed.
• the smart card contains a smart card-specific key for authentication that is obtained by deriving the serial number from a master key.
• PRO mode is a variant of the read access introduced in ISO7816, in which the data transmitted to the terminal is secured by a message authentication code (MAC).
• MAC message authentication code
• This MAC is generated dynamically with each read access in order to rule out a so-called replay attack, ie the re-import of data that has already been read.
• the MAC is generated within the operating system of the smart card using the card-specific authentication key and a random number supplied by the terminal.
• the terminal contains a random number generator and the master key in a security module (e.g. another smart card), which is used to derive the smart card key under the smart card serial number.
• the terminal automatically checks the MAC immediately after reading out the smart card data and rejects a card with a faulty MAC.
• the MAC is generated dynamically by the smart card.
• the key required for this must be present in the smart card.
• Manipulation of the smart card, e.g. B. by duplication, requires access to this card key, which is only possible with a high financial outlay.
• this protection level requires a more powerful smart card.
• a symmetrical method for MAC formation usually Triple DES
• the asymmetrical method of the elliptic curves can be used. With this method, the private, card-specific key is stored in the card so that it cannot be read out, and the public key is made readable. The public key must be signed with the private key of the system operator.
• a control terminal now only needs to save the system operator's less security-critical public key and use it to check the authenticity of the card-specific public key.
• the data is read out analogously to the symmetrical method, with the difference that the MAC is generated by the asymmetrical algorithm.
• the transfer of data between devices in the system is to be secured by cryptographic methods.
• Line encryption methods are available for this purpose, with which protected, transparent data channels can be set up.
• Another feature of the 5th shell is the intention to put all security-relevant system facilities in the care of the border control authority. From the authority's point of view, this is intended to ensure that access to these system facilities without their intervention and is not possible under any circumstances. For this, not all system facilities actually have to be located on the premises of the authority itself.
• the technical operation could also be carried out by a representative of the authority, as long as corresponding contractual warranty clauses make unauthorized access by third parties (including the operator) impossible.
• An additional organizational precautionary measure consists in the fact that all official steps - that is, the implementation of early border control in accordance with national, Schengen and EU requirements and the release of the smart card - are reserved for an official from the border control authority. Suitable access controls exist for him and for the other employees in the enrollment center.
• the acquisition software ensures that smart cards
• the systems according to the invention have a number of advantages which distinguish them from various other, to date unsuccessful, attempts to introduce automated border controls nationwide: -
• the system is an effective and economical way to make border control authorities more efficient.
• the system allows border guards to focus on a more police-relevant group of people. This means they can do more for security and service with less effort.
• the smart card used in accordance with a particular embodiment of the invention allows even sensitive data to be stored without the risk of misuse through unauthorized changes or counterfeiting.
• the procedure allows the shortest possible transaction times (essentially only dependent on the response time behavior of the query in the INPOL wanted database).
• the procedure does not pose any data protection problems (the owner carries his / her personal data, which is protected against unauthorized access).
• the smart card used in a particular embodiment of the invention contains sufficient storage capacity for these and possibly further future applications with additional useful potential.

Landscapes

• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Engineering & Computer Science (AREA)
• Human Computer Interaction (AREA)
• Lock And Its Accessories (AREA)
• Collating Specific Patterns (AREA)
• Credit Cards Or The Like (AREA)

Priority Applications (6)

Applications Claiming Priority (4)

Related Child Applications (2)

Publications (1)

Family

ID=26055667

Family Applications (1)

Country Status (6)

Cited By (2)

Families Citing this family (27)

Citations (7)

Family Cites Families (5)

• 2000
  • 2000-11-14 JP JP2001540724A patent/JP4383704B2/ja not_active Expired - Lifetime
  • 2000-11-14 CA CA2392264A patent/CA2392264C/en not_active Expired - Lifetime
  • 2000-11-14 WO PCT/DE2000/004004 patent/WO2001039133A1/de not_active Ceased
  • 2000-11-14 CN CNB008173516A patent/CN1158634C/zh not_active Expired - Lifetime
  • 2000-11-14 US US10/130,377 patent/US7272721B1/en not_active Expired - Lifetime
  • 2000-11-14 AU AU25025/01A patent/AU778154B2/en not_active Expired
• 2007
  • 2007-09-13 US US11/900,677 patent/US7809951B2/en not_active Expired - Fee Related

Patent Citations (7)

Also Published As

Similar Documents

Legal Events