WO2001044898A1

WO2001044898A1 - Cryptographic token and enabling system

Info

Publication number: WO2001044898A1
Application number: PCT/CA2000/001480
Authority: WO
Inventors: George H. Solomos; Jose Luis R. Laraya
Original assignee: Krypton Software Ltd.
Priority date: 1999-12-13
Filing date: 2000-12-13
Publication date: 2001-06-21
Also published as: AU1978901A; WO2001044898A8; CA2315599A1

Abstract

An enabling system for enabling device operation and a cryptographic token (24) is disclosed. The enabling system captures through a contact sensitive graphical interface (40) a template associated with a user's ideogram signature information and stores this template in memory (64). The template is then compared with subsequent inputs of this ideogram signature information from the user and verified to enable the cryptographic token or other devices to function.

Description

CRYPTOGRAPHIC TOKEN AND ENABLING SYSTEM

Field of the Invention

The present invention relates to an enabling method and systems for devices such as communications systems, security systems and a cryptographic token and security system. Background of the Invention

With the growth of the communication of information across communications systems such as the internet, telecommunication systems, video and satellite communication systems, and the inter communication between these systems, more interest is being shown in securing the communication of data across such communication systems. Various different standard algorithm protocols have been developed and implemented by the communications industry to encrypt data at the point of origin of the transmission and decrypt the data at the final intended point of reception for the data.

In an internet communication system, the data is provided with an application header, a transport header, an internet header, and a data link header Link encryption occurs when the data link header includes an encryption method or algorithm that encrypts the remainder of the signal The layers of encryption increase as the data link header, the internet header, the transport header and the application header introduce encryption protocols to encrypt the data. While these levels of encryption are currently the standard levels or layers of encryption associated with internet communications, there is continual movement in the industry to improve security protocols.

While these layers of security algorithms are standard protocols and have been adopted by the communications industry, it is the user's key that locks and unlocks the manner in which the standard protocol security algorithms encrypt and decrypt the data.

Another problem associated with the security of information transmitted over communication mediums relates to social engineering. It is common for users large and small to continue using the same asymmetrical keys and log on passwords for extended periods of time Further, these keys are typically stored in a computer or other data bus storage means where the software for the encryption and decryption of the data is also stored. Consequently, it is possible for an unauthorized third party to copy the hard drive or storage medium and subsequently analyze the storage medium without time constraints to determine the user's asymmetrical and symmetrical keys Once having obtained such key information, this third party can then intercept the communication and utilize the key to unlock or decrypt the transmitted data

Accordingly, there is a need to improv e the security of data communicated across communication systems by better control of long on - 3 -

access so that third parties may not gain unauthorized access to the transmission of the data. Summary Of The Invention

It is within the realm of the present invention that a cryptographic token may include a contact sensitive graphical interface accessible by the user so as to enable the cryptographic token to function and transmit the user cryptographic key or other user information to a security module. To accomplish this, the cryptographic token includes an authentication processor connected to the graphical interface for verifying the authenticity of the user. This interface and authenticity check provide an enabling or log m method that may be conducted off-line from or in conjunction with a security module such that it is improbable to gain unauthorized access to the user's cryptographic key information.

The present invention has application with various communication systems, such as voice communication, video communications, telecommunications, and internet communications.

The authentication processor and the contact sensitive graphical user interface provide the basis of the method and system for enabling the cryptographic token and the security system. This enabling method and system may be used to enable other types of devices requiring restricted access such as, for example communications devices and security access devices. Other devices to be enabled may include enabling of telephones, cellular, satellite or video telephones, computers, video communication devices, telecommunication devices, and voice communication devices. It is contemplated that the enabling method and system may operate independently of the cryptographic token. That is the method and system may operate to simply enable, or permit operation of a device and not perform the encryption/decryption operation also performed by the cryptographic token. Secure communication or activation occurs by the device to be enabled being operable with or having the contact sensitive graphical interface. The user ideogram signature is produced on the contact sensitive graphical interface and the authentication processor creates a user identification template from the user ideogram signature produced on the contact sensitive graphical interface. The template is stored in memory. The comparator compares a second produced user ideogram signature information on the contact sensitive graphical interface with the user identification template stored in memory and the device is enabled when the compaπson of the second produced user ideogram signature information matches the user identification template stored in memory.

It is within the realm of the present invention that the cryptographic token can be in the form of a rectangular card such as, for example, a printed circuit card having an input/output port that is PC card compatible. Such a PC card may have its own power supply Alternatively, the cryptographic token can be in the form of a card, such as an IC card or Smart Card. Such IC and Smart Cards typically do not have an independent power supply

The graphical interface is a contact sensitive interface that may be sensitive simply to contract or to contact and pressure contact The graphical interface may include a graphical contact sensitive tablet, which is pressure sensitive, over which a stylus is manipulated by a user to enter an ideogram signature information Alternatively a contact sensitive display may be used for the graphical interface that may or may not echo the ideogram signature information It is further contemplated that the display may generate a menu of user selection activation prompts to guide a user in entering ideogram signature information to create a user identification template to be stored in the cryptographic token. The menu may further prompt the user to create or generate new cryptographic keys within the system and prompt the user for a password in addition to the other security levels. Preferably, the cryptographic token may contain at least three authentication factors for encryption. The first factor is something the user knows such as, for example, the password. The second authentication factor is something the user has which is the token and the cryptographic key information stored on the token. The third authentication factor is something the user does which is provide ideogram signature information on the token. Additionally, the first and third authentication factors are something the user can change thereby adding a layer or level of security.

Throughout the disclosure and claims references is made to the term ideogram signature information. It should be understood that this term refers to a graphic representation made by user's on the contact sensitive graphic interface. The term signature is used to represent the user's graphic representation of it's personal signature or, is used in combination with the term ideogram to represent the personal characteristics of the user in creating an ideogram. This ideogram signature is referred to as information since it is codified and interrogated by the authentication processor of the enabling system to create an identification template of information that is subsequently used to verify the authenticity of a user

It is further contemplated to be within the realm of the present inv ention that the cryptographic token or enabling system includes a watchdog or tampering circuit which in the event of an intrusion erases from the memory of the cryptographic token the cryptographic key and ideogram signature template. Further, it is contemplated that the display or a light emitting diode display may be utilized by the cryptographic token to provide a visual indication of when the token is properly activated.

The cryptographic token may further include a buzzer for sounding alarms related to proper or improper activation of the token.

In accordance with an aspect of the present invention there is provided a method for enabling a device having a contact sensitive graphical interface, compπsing the steps of producing a user ideogram signature on the contact sensitive graphical interface, creating a user identification template from the user ideogram signature produced on the contact sensitive graphical interface, storing the user identification template in memory, comparing a second produced user ideogram signature information on the contact sensitive graphical interface with the user identification template stored in memory, and enabling the device when the compaπson of the second produced user ideogram signature information matches the user identification template stored in memory

In accordance with another aspect of the present invention there is prov ided an enabling system operable with a security system or a communications system for enabling the security system or communications system The enabling system comprising a contact sensitive graphical interface accessible to a user for capturing user ideogram signature information, memory for stoπng user ideogram signature information captured by the graphical interface; a user authentication processor for creating a user identification template from the user ideogram signature information and storing the user identification template in the memory; and, a comparator for comparing receipt of user ideogram signature information with the user identification template, the comparator generating an authentication signal when the compaπson of the user ideogram signature information matches the user identification template to enable the secuπty system or communications system. Bnef Descπption Of The Drawings

For a better understanding of the nature and objects of the present invention reference may be had to the following detailed description when taken in conjunction with the accompanying diagrammatic drawings wherein

Figure 1 is perspective view of the cryptographic token and secuπty system used as an interface between a personal computer and an internet site;

Figure 2 is a block diagram of the cryptographic token with its own off-line power supply,

Figure 3 is a perspective view of the cryptographic token showing a preferred contact sensitive liquid crystal display and stylus,

Figures 4 and 5 show the display of the token prompting the user w ith menu selections, Figure 6 is a block diagram of the internet secuπty module utilizing the cryptographic token of Figure 2;

Figures 7 to 14 are flow charts showing the steps involved in setting up and logging into the cryptographic token;

Figure 15 is a block diagram of the cryptographic token dependent on a remote power supply

Figure 16 is a shows a communication system in the form of a telephone incorporating the enabling system; and,

Figure 17 shows a secuπty system using the enabling system Detailed Descπption Of The Preferred Embodiment

Referπng to Figure 1 there is shown an embodiment for the secure communication system 10 The secure communication system 10 operates in conjunction with personal computers 12 and 14 to provide for secure transactions and data communication across the internet 16 The first personal computer or computer 12 is in effect a first data transceiver for transmitting and receiving data to and from a first communication port

18. The communication port 18 of computer 12 is connected via cable 20 to an internet secuπty module 22. The internet secuπty module has an output port 26 in the form of a telephone jack for connecting through standard telephone line 28 the internet security module 22 to the internet

16 The internet 16 then routes the data across the internet to the telephone or communication line 30 of the second computer 14 It should be understood that the second computer 14 may simply be another user in the system or may be a computer that provides a service through which a secure transaction and the exchange of money or credit may flow from computer 12 through the internet security module 22, the internet 16, to the computer 14 It should be understood that the security module 22 may be alternatively connected to a single port for transmission of information with that single port. Such a single port arrangement would have application in an ATM banking machine environment.

In accordance with this embodiment, in order to activate the internet security module 22 a cryptographic token card 24 is required to be inserted into a hardware enabling receiving interface port 32 of the internet security module 22. The cryptographic token 24 is a temporary coupling which may be inserted into the port 32 and removed from the port 32 as indicated by arrow 34.

The cryptographic token 24 is shown in Figure 1 to comprise a printed circuit card which has an outer casing 36, a connecting port 38, and a contact sensitive graphical interface 40.

The cryptographic token 24 bears cryptographic key information which is utilized by the internet security module 22 when the cryptographic token 24 is inserted into the receiving port 32 of the internet security module 22. The cryptographic key information includes either a symmetric or an asymmetric key. The asymmetric key includes both a public key and a private key. These keys are preferably maintained in the cryptographic token 24 away from the internet security module 22 for use by the internet security module 22 with standard internet security protocol algorithms. Such standard internet security protocol encrypting and decrypting algorithms are, for example, a link encryption, network encryption, secure socket layer encryption, and application layer encryption. In accordance with the present invention the preferred encryption used by the internet security module 22 is secure socket layer encryption. Furthermore, the cryptographic token 24, once enabled with the security module 22, would be able to download and upload sensitive data to and from the security module and internet

Referring to Figure 2 a block diagram of the cryptographic token has a battery 42 connected to a power conditioning circuit 44. The power conditioning circuit 44 is further connected to an input power connection 46 to the PC card host controller or hardware receiving port 32 of the internet secuπty module 22. When the cryptographic token 24 is not connected to the internet security module 22 it is considered to be off-line from the internet security module 22 and power to the cryptographic token 24 is provided by battery 42. Upon insertion of the cryptographic token 24 into the host controller 32 of the internet secuπty module 22, power is fed along line 46 through the power conditioning circuit 44. The power conditioning circuit 44 acts to regulate the power source of the cryptographic token 24 from the battery 42 to the internet security module 22. The power conditioning circuit 44 has an output power line 48 which provides an operating voltage to the other programmed operating hardware of the cryptographic token 24.

User defined information is communicated to the cryptographic token 24 through the contact sensitive graphical interface 40. The contact sensitive graphical interface 40 is shown to include a contact sensitive liquid crystal display 50 connected to a graphical interface 52 The graphical interface 52 converts information pressed onto the liquid crystal display into a graphic pattern and transmits this graphic pattern across the data bus 54 to the user authentication processor 56 The user authentication processor 56 may also be considered as a cryptographic controller which controls the overall cryptographic operation of the cryptographic token 24 Prompts for information obtained from a user are transmitted across the bus 54 from the authentication processor 56 through the graphic interface 52 and echoed or displayed on the liquid crystal display 50. The user authentication processor 56 includes a comparator 58, and a real time clock and random number generator 60. The real time clock and random generator number is utilized by the authentication processor 56 to generate cryptographic key information such as symmetπcal keys and asymmetrical keys in the form of pπvate and public keys when so instructed or requested by a user.

The cryptographic token 24 also includes memory 62 in the form a flash memory 64 and a scratch pad random access memory 66. The flash memory 64 is connected to the authentication processor 56 by data transfer bus 68. The scratch pad RAM memory 66 is connected to the authentication processor 56 by data transfer bus 70. The operation of the authentication processor 56 is stepped and controlled by a control clock 72.

The authentication processor 56 communicates with the internet security module 22 through a data transfer bus 74 to the connection interface port 38 when the port is plugged into the PC host controller 32 of the internet security module 22. The PC card interface or a connection interface port 38 is a standard interface port and may comprise as computer compatible PC card

The authentication processor is further connected to one or more LED's 76 and an audible transducer or buzzer 78

The cryptographic token 24 further includes a tampering circuit 80 that detects an intrusion of the cryptographic token 24 and sends a signal to the flash memory 64 to delete the program templates and cryptographic keys normally stored in this flash memory Referring to Figures 2 to 5 and 7 to 14, the operation of the cryptographic token 24 is described. One authentication factor of the cryptographic token 24 resides in the contact sensitive liquid crystal display 50 and the manner in which this display can capture information. In Figure 3 the display 50 is shown with the words "Jane Doe' ". This signature may be a written signature, a graph or symbol such as, for example, a dog or a house, or anything the user wishes to write onto the display 50. The user may utilize the stylus 90 to create the signature shown. This signature is in effect the ideogram signature information 92. The relative placement of the letters on the display in effect creates a signature unique to the handwriting characteristics of the user.

The cryptographic token 24 provides through the battery 42 an offline token which stores a user's cryptographic keys in the flash memory 64 together with a template of the user's ideogram signature information. The flash memory 64 may also store the password of the user. The cryptographic token 24 prompts the user with menu selection once the card is activated. The main menu 82 is displayed on the display 40 to the user allowing the user to select the options of log in or setup. The main menu 82 is shown in Figure 4. In the event the user selects the setup menu, then the setup menu 84 shown in Figure 5 is displayed to the user. The setup menu includes five options of create new template, edit existing template, generate symmetrical key, generate asymmetrical key, and enter/change passwords.

Depending on the selection of the main menu shown in Figure 4 and the set up menu shown in Figure 5, the authentication processor verifies the activation of the cryptographic token 24 by an authorized user. Once the activation of cryptographic token 24 is authenticated, the cryptographic tokei 24 <s then enabled permitting the transference of data across data transfer bus 74 from the authentication processor 56 to the connection interface port 38

Referπng to Figures 7 through 14 the method of enabling and operating the cryptographic token 24 is shown.

In Figure 7, the cryptographic token 24 is activated at 160 This activation may simply compπse tapping the contact sensitive LCD display 50 three times in a row to have the authentication processor 56 prompt the cryptographic token 24 to have the main menu displayed as at step 82 in Figure 7 This main menu in Figure 7 is similar to the one shown in Figure 4. The user then has the option to select the login feature at 162 or go to the setup feature at 164.

In the event that the user chooses the setup feature 164, then the system shown in Figure 8 displays the setup menu 84 which is similar to the menu shown Figure 5 The user then has the ability to create a new template at 166 or edit an existing template 168, generate symmetπcal key information 170, generate asymmetrical key information 172 or create/edit the password 174

In the event the user determines that they wish to create the new template 166 then the template may be created in accordance with the methodology shown in Figure 9 The processor 56 sets a counter N=0 at 220 The authentication processor 56 then requests the display 50 to prompt the user to enter ideogram signature information (ISI), such as, for example, the ideogram signature information 92 shown in Figure 3 This information is entered on the contact sensitive graphical interface 50 Next, the authentication processor 56 at 224 applies a pattern recognition algorithm to the ideogram signature information and stores the pattern result in a memory 62. The processor then checks to see that the number count N=0 at 226 and in the event that the number count is N=0, it then moves to step 228 sets the program counter N=N+ 1 and returns to step 222 to step through the process a second time.

In the event N not equal to 0, at 226 is no, then the processor 56 applies a smoothing algorithm to start to weigh the pattern results with previous pattem results to create a user identification template at 230 The processor 56 then checks at 232 to determine if this counter has reached N=3 and in the event that it has not it then issues a command to increment the counter 228 and again go through the display prompt user steps 222 and 224.

In the event the inquiry at 232 is N=3, then the processor 56 stores the user identification template information in flash memory 64 at 234 and then proceeds to step 236 ending the creation of the template process. It should be understood that in the process for creating the new template may only occur when no template has been entered into the system In the event that a template has been entered into the system, then a default to the edit routine occurs.

In the event the user requests to edit the existing template 168 from the display setup menu 84 in Figure 8, then the process in Figure 10 is implemented by the processor 56. At this point, the processor checks to determine if an identification template is already stored in the a flash memory 64 at 176. In the event that there is no template stored then the processor 56 returns to the setup menu 178 In the event there is an existing template stored in the flash memory 64, step 179 is performed w hereby the processor goes to the log in procedure to authenticate that this is in fact the authorized user wishing to change there ideogram signature information. The log in procedure is discussed subsequently in more detail with respect to Figure 15.

After the login procedure is accomplished at 179, the next step is at 180 to erase the existing template stored in the flash memory 64 and then the system returns to create the new template menu at 182.

In the event a user selects from Figure 8 the create/edit password 174 step, then the process of Figure 13 is enacted. First the processor 56 determines at step 196 if the password is stored in the flash memory 64. If the answer is yes then the step 198 displays an alphanumeric key pad and prompts the user to enter the password. The processor 56 then compares the entered password with the password stored in flash memory 64 at 200. The processor 56 determines if the passwords entered and stored match at 202 and in the event that there is no match the process either ends or returns to the main menu 204 thereby rejecting the request to create or edit the password. In the event the decision box 202 comes out in a positive answer or in the event the decision box 196 indicates that there is no existing password, then the process at 206 displays an alphanumeric keypad and prompts the user to enter a new password. The new password is then stored in the memory 60 at 208 and the process displays for a second time the alphanumeric keypad and prompts the user to re-enter the new password at 210. The processor compares the entered and re-entered passwords at 212. A decision on the password matching is made at step 214. In the event that these passwords do not match then the system initiates the password editing or creating procedure once again by returning to process box 206. In the event the decision from the matching of the passwords at 214 is positive then the password is stored in a flash memory 64 at step 216 and the create/edit password routine is ended at 218

In the event the user wishes to create a new or another symmetrical key in the process the user simply chooses this selection at 170 (Figure 1 1 ) which causes the processor 58 and random number generator 60 to generate the symmetπcal key at 184. The symmetrical key is stored in a flash memory 64 at 186 and the process comes to an end at 188

With respect to the generation of the asymmetrical keys the user selects item 172 from Figure 9 and Figure 12 shows the process of the processor 58 and random number generator 60 generating the asymmetrical keys or pπvate and public keys at 190, and storing the keys information in flash memory 64 at 192 and bπnging the procedure to an end at 194. There is no password protection associated with this procedure since this key information is a feature that is proprietary to the cryptographic token 24 and the more frequently the key is changed the better Hence it is a step that is made simple for the user to effectively change the key

Referπng to Figure 7, when the log in procedure is chosen at 162 then a log in procedure or method is shown in Figure 14 The piocessor asks if the password is stored in the flash memory at 238 and in the event that there is an affirmative answer the processor at 240 displays the alphanumeπc keypad and prompts the user to enter the password At 242 the system compares the entered password with the stored password and if there is no match it brings the log in procedure to an end at 244 without enabling the cryptographic token 24 In the event that there is an affirmative decision from decision box 242 then the process continues to step 246 In the event that there is no password stored in the memory to begin with at 238 then step 246 is implemented immediately Step 246 calls for the user to be prompted to enter an ideogram signature information 92 on the contact sensitive graphical interface 50

The authentication processor 56 at step 248 applies the pattern recognition algoπthm to the ideogram signature information 92 to create the new pattern. The comparator 58 compares the new ideogram signature information pattern with the user identification template stored at the flash memory 64 at step 250. At decision box 252 a decision is made as to whether the pattern matches the user identification template and in the event the answer is no, then the system simply ends the login procedure without enabling the cryptographic token 24 at step 244. In the event there is a positive match at step 252 the processor enables itself at step 254 to communicate over the data bus 74 with the connection interface port 38 of the cryptographic token 24. Next the system bπngs the sign on or login procedure to an end at step 244. Once the cryptographic token 24 is enabled, then it is in a position to make available its cryptographic key information to the internet security module 32

Referring now to Figure 6 the internet security module 22 is shown The internet security module 22 has its own power conditioning circuit 100 connected to a battery backup 102 and through a power input line 104 to a wall plug adapter 106. The power conditioning circuit 100 regulates the power supply to the internet security module 22 The power conditioning circuit 100 has a power output line 108 which is connected to the hardware components located within the internet security module 22 to provide sufficient power to these components The internet security module 22 preferably had a touch sensitive liquid crystal display 1 10 connected through a data bus 1 14 to main processor 1 12. The liquid crystal display displays to the user the activities of the internet secuπty module 22 during the operation of the internet security module 22. The main processor 1 12 is an xx86 class processor. This processor is connected through data bus 120 to a cryptographic co-processor 1 16 and a real time clock and random number generator 1 18. The cryptographic coprocessor and real time clock and random number generator accelerate the application of the encrypting and decrypting protocols to the data main processor 1 12 to the telephone line 28. The main processor 1 12 is further connected through to LED 128 and an audible signal beeper 130. Memory for the main processor is connected through a flash memory 132 which stores programs and other keys. The internet secuπty module 122 further includes a scratch pad and random access memory 134 for temporary stoπng calculations made by the mam processor 1 12. The main processor 1 12 is further connected through signaling ports 124 to a universal serial bus interface 122 or an RS/232 seπal interface 122. These interfaces are connected to the communication ports 18 to the first computer 12. The main processor 1 12 is further connected through a communication line 126 to the PC card host interface or having the hardware receiving slot 32. The diagram shows the cryptographic token 24 connected through the PC card interface for communicating data.

The main processor manipulates a data signal coming from the computer 12 through the input or interface port 122 and the communication lines 124 with an encrypting and decrypting algorithm provided in the co-processor 1 16 and random number generator 1 18. This data is further encoded with the key information made available by the cryptographic token 24 The information encrypted is then transmitted - 19 -

from the main processor 1 12 through the modem 138 and the output 26 to the telephone line 28 and thus onto the internet. In the event the cryptographic token 24 is not present, then the main processor 1 12 performs no encryption or decryption of signals passing through the main processor between the telephone line 28 and the first computer 12 The main processor 1 12 also decrypts data received from the computer 12

The flash memory 132 stores cryptographic keys received from the cryptographic token 24. When the token 24 is removed from the internet secuπty module 22, the keys are erased from the flash memory 132. In the event the module 22 is subject to intrusion, the tamper circuit 136 sends a signal to the flash memory 132 to erase the memory 132.

Referring to Figure 15 a block diagram of an alternative embodiment for the cryptographic token 24 of Figure 2 is shown. The components of the cryptographic token card 24 of Figure 15, including their reference numerals and functionality are identical to that shown and descnbed for Figure 2 except for the differences explained hereafter. In Figure 15 the block diagram of the cryptographic token card differs in that it relies on the power from the security module 22 of Figure 6 at line 46 of Figure 15. The power from security module 22 is fed through the hardware receiving port 32 of the secuπty module at connecting line 46 into the power conditioning circuit 44 of the cryptographic token card 24 In this embodiment, the cryptographic token card 24 preferably comprises either an IC card or a Smart Card. As a result of the cryptographic token card 24 having to rely on a source of power from the security module 22, or an other power source, the cryptographic token card 24 must be coupled to the security module 22, or the other power source, so as to operate the cryptographic token card 24 in accordance with the method of operation previously described for Figures 2 to 5 and 7 to 14.

Referring to Figure 16 there is shown a cellular communications device in the form of a telephone 300. The telephone 300 includes a display 302, an on/off switch 303 and alphanumeric keypad 304 to operate the telephone. Such telephone devices are commonly known in the art. The improvement is the use of the contact sensitive graphical user interface 40 mounted to the telephone 300. The telephone 300 also includes the circuitry of Figures 2 or 15 which functions in the manner previously descπbed with respect to Figures 4, 5, 7 to 10 and 14 where the authentication processor 56 simply functions to permit authentication of the ideogram signature received by the pressure sensitive LCD 50 and graphic interface 52. The other difference is the hardware receiving port 32 may simply be an electrical line connection to the on/off switch 303 of the telephone 300 or to other circuitry in the telephone which controls the enabling operation of the telephone.

Referring to Figure 17 there is shown secuπty system in the form of a keyless door entry secuπty system 310 mounted to an access door 312. The improvement is the use of the contact sensitive graphical user interface 40 mounted to the door 312. Alternatively the contact sensitive graphical user interface 40 could be mounted to the wall adjacent the door 312 The secuπty system 310 also includes the circuitry of Figures 2 and 15 which functions in the manner previously described with respect to Figures 4, 5, 7 to 10 and 14 where the authentication processor 56 simply functions to permit authentication of the ideogram signature received by the pressure sensitive LCD 50 and graphic interface 52 The other difference is the hardware receiving port 32 may simply be an electrical - 21 -

line connection to the door opening contacts (not shown) or to locking devices for the door which controls the access through the door 312.

As is apparent from the foregoing disclosure, various other embodiments and alterations and modifications which may differ from the embodiments disclosed may be readily apparent to one skilled in the art. It should be understood that the scope of the patent shall be defined by the claims and those embodiments which come within the scope of the claims that follow.

Claims

WHAT IS CLAIMED IS:

1. A method for enabling a device having a contact sensitive graphical interface, comprising the steps of: producing a user ideogram signature on the contact sensitive graphical interface, creating a user identification template from the user ideogram signature produced on the contact sensitive graphical interface, storing the user identification template in memory, comparing a second produced user ideogram signature information on the contact sensitive graphical interface with the user identification template stored in memory, and enabling the device when the comparison of the second produced user ideogram signature information matches the user identification template stored in memory.

'2. The method of claim 1 wherein the step of creating a user identification template further includes the step of: prompting a user to enter ideogram signature information a predetermined number of times.

3. The method of claim 1 wherein the device compπses one device selected from the group consisting of a telephone, a cellular telephone, a computer, a video communication device, a telecommunication device, a voice communication device, and a security system.

4. An enabling system operable with a security system for enabling the security system, the enabling system comprising: a contact sensitive graphical interface accessible to a user for capturing user ideogram signature information; - 23 -

memory for storing user ideogram signature information captured by the graphical interface; a user authentication processor for creating a user identification template from the user ideogram signature information and storing the user identification template in the memory; and, a comparator for compaπng receipt of user ideogram signature information with the user identification template, the comparator generating an authentication signal when the comparison of the user ideogram signature information matches the user identification template to enable the secuπty system.

5. The enabling system of claim 4 wherein the graphical interface is mounted to a surface of the secuπty system

6. The enabling system of claim 4 wherein the graphical interface comprises a graphical contact sensitive tablet.

7 The enabling system of claim 4 wherein the graphical interface compπses a contact sensitive liquid crystal display.

8. The enabling system of claim 4 wherein the display further generates menu user selection activation prompts

9. The enabling system of claim 4 wherein the display further presents operating information and data during activation and enabling operation

10 The enabling system of claim 8 wherein the authentication processor controls the display to prompt a user to enter ideogram signature information a predetermined number of times to create the user identification template

1 1 An enabling system operable with a communications system to permit transmission of data messages through the communications systems when enabled by a user, the enabling system compπsing- a contact sensitive graphical interface accessible to a user for capturing user ideogram signature information inputted from a user; a user authentication processor for creating a user identification template from the user ideogram signature information and memory for storing the user identification template; and, a comparator for compaπng receipt of a newly inputted user ideogram signature information with the user identification template, the comparator generating an authentication signal when the comparison of the inputted user ideogram signature information matches the user identification template to enable the communication system.

12. The enabling system of claim 1 1 wherein the graphical interface is mounted to a surface of the communication system.

13 The enabling system of claim 1 1 wherein graphical interface compπses a graphical contact sensitive tablet.

14. The enabling system of claim 1 1 wherein the graphical interface compπses a contact sensitive liquid crystal display.

15. The enabling system of claim 13 wherein the display further generates menu user selection activation prompts

16 The enabling system of claim 14 wherein the display further presents operating information and data during activation and enabling operation.

17 The enabling system of claim 15 wherein authentication processor controls the display to prompt a user to enter ideogram signature information a predetermined number of times to create the user identification template.

18. The enabling system of claim 1 1 further including at least one light emitting diode that provides a visual signal to the user when the user authentication signal is generated.

19 The enabling system of claim 1 1 further including a audible transducer that generators an audible signal to the user.

20 The enabling system of claim 1 1 wherein the communications system is one selected from the group consisting of a telephone, a cellular telephone, a computer, a video communication device, a telecommunication device, and a voice communication device

21. The enabling system of claim 1 1 wherein the communications system is one selected from the group consisting of a telephone, a cellular telephone, a computer, a video communication device, a telecommunication device, and a voice communication device