WO2008081051A1

WO2008081051A1 - Method and system of security by means of biometric identification of persons

Info

Publication number: WO2008081051A1
Application number: PCT/ES2006/000724
Authority: WO
Inventors: José María NEGRE CARRIÓ
Original assignee: Doyen, S.L.
Priority date: 2006-12-29
Filing date: 2006-12-29
Publication date: 2008-07-10

Abstract

Method comprising the following steps: capture of a biometric reading; composition of a message with the identification of the terminal (1a,&mldr;1n), biometric reading and instruction; encrypting of the message; sending thereof via a virtual private network on the Internet; reception of the message by a server computer (3) and decrypting thereof; identification of the person; matching with a database (31) the identification of the terminal (1a,&mldr;1n), the identification of the person and the identification of the instruction; sending of an encrypted message to the means of security (2a,&mldr;2m) determined by the database (31), in the case of a positive match. The security system includes means of security (2a,&mldr;2m) operable from terminals (1a,&mldr;1n) with a biometric reader (11); an encryption device (12) and a device for communications (13) via Internet, with one or more server computers (3) by means of a virtual private network.

Description

DESCRIPTION

PROCEDURE AND SECURITY SYSTEM THROUGH BIOMETRIC IDENTIFICATION OF PEOPLE.

Object of the invention

The present invention relates to a security method and system by means of biometric identification of persons, of flexible use and versatile character that is universally applicable for access, means of operation or performance of financial operations.

Background of the invention.

Biometric identification applications are known to increase the security of financial transactions and the use of devices due to the unauthorized attempt of unsuitable persons, discriminating against users if they are authorized. In this biometric identification, the principle of identification of people is used by one or more physical and biological characteristics of the user, which are so personal that it is practically impossible for another person with such characteristics to supplant it. Traditional systems using keys, encrypted cards, radio-controlled devices or remote controls and others, are likely to be violated, since they use control and authorization means that the user can lose or can steal with some ease, enabling a person Unauthorized can access with a key that is not your property. The invention patent ES2200720 "Procedure for controlling access to enclosures and access support is known." of the firm Primavera Sound, SL in which a system of access control to a concert is described, for example, by means of automated barriers or lathes. According to the procedure, an authorized personnel collects a biometric measurement of the user to be authorized and records it on a physical medium, such as a card with memory as an input. Next, the user, when wanting to access the enclosure, must insert the card into an appropriate reader in the access and undergo a biometric test so that a remote processor compares both and decides if it is the original user, or another person who supplants it. This system is simple, but it requires the use of a coded support or key to host the Ia identification, with which it is easy to lose it and possibly duplicate and modify it. Second, it is an application restricted to the access to a place or similar by one or several doors, making it impossible for its use to be universal for different types of access or actions that require authentication. It is also known the patent ES2006936 for "Electronic digital access" of Mr. Diego González Aligurangues in which an access system is described by means of the fingerprint as a means of biometric control. This system comprises, in a first embodiment, the fingerprint reader, the stored authorized fingerprint memory and the opening and closing mechanism of a door or the like in the same device. This provision is likely to be manipulated and with its violation obtain biometric data from registered users or enter unauthorized data for fraudulent use. In addition, the device must have sufficient memory to store all the data of authorized persons and it is difficult to update in a system with several of said devices operating simultaneously. In a second embodiment, some of the elements are expected to be at a distance, but it does not establish security measures that prevent unwanted manipulation. In the case that several independent access systems are simply implemented, the management of them must be carried out completely separately and independently, according to their security characteristics.

Description of the invention

The procedure and security system by means of biometric identification of persons of this invention is intended to establish a secure and universal platform in which it is easy to add both identification terminals and secure actuation devices, simply by updating a user database. This allows to establish a completely transparent system to the user, which is scalable and with real-time control.

In effect, the procedure comprises the phases of:

- Capture of a biometric reading of a unique characteristic of a person to carry out an instruction or action,

- Composition of a message with the identification of the terminal where the capture is made, the data of the reading and an identification of the instruction to be carried out,

- encrypted message to prevent violation,

- sending the message through a private virtual network over a network global communication, computers,

- reception of the message by a server computer and its decryption,

- identification of the person by means of biometric reading data,

- collated with a database of the identification of the terminal, of the identification of the person and of the identification of the instruction to be carried out,

- sending at least one message to the security means or means determined by the database, in case of positive comparison.

It is envisaged that in case of a negative check in the database, a message can be sent with an adequate notification of said comparison or check to the terminal to notify the user, or to notify an authority of the fraudulent identification attempt.

The database can be created, maintained and manipulated by controlling agents or delegates from remote computers for updating and to establish user privileges. Thus, the database can be controlled immediately, controlling the privileges or access that a user has with a single stored biometric reading and a list of authorizations, as contracted.

This procedure is carried out using a system comprising in the biometric reading terminal an encryption device and a communication device with one or more server computers through a private virtual network over a global computer communication network, such as the Internet. Thus, the terminal is capable of generating an encrypted message with the biometric reading, the identification of the terminal and the instruction to be performed. This communication is transmitted to the corresponding server computer by means of the known communication networks that have been described.

The terminal may comprise an interface console, such as a keypad or another, for the introduction of instructions or commands to be performed.

The terminal may present an operation warning positively or negatively as a basic user interface, so that once it has been verified whether its identity is authorized or not, it is communicated if the desired instruction has been carried out or not.

In accordance with which operations, the terminal and the security means are integrated in the same apparatus, such as the lock of a door or the access to an enclosure. This allows a compact and easily installable design, which is safe against Assaults, since it does not include any information of the user that can open, does not store the information of the users who have used it.

It has also been provided that the device comprises an autonomous and portable energy support that makes it easily installable anywhere, independent of the power supply. If, in addition, the terminal's communications device is of the wireless type, such as a UMTS or similar telephone device, total autonomy is achieved, ideal for charging devices by personal identification or others.

The security means can be of a very diverse nature, but in the case of physical means, such as opening locks and operating machines, it comprises at least one communication device connected to the global computer communication network for the reception of messages. Encrypted drive from the server computer.

Description of the figures.

To complement the description that is being made and in order to facilitate the understanding of the characteristics of the invention, a set of drawings is attached to the present specification in which, for illustrative and non-limiting purposes, the following has been represented: - Figure 1 shows a block diagram of the system.

Figure 2 shows a block diagram of the biometric reading terminal.

Preferred embodiment of the invention As can be seen in the referenced figures, the system comprises biometric identification and reading terminals (1a, ... 1n) and security means (2a,, .. 2m) that can be operated from a computer server (3) remotely, these communications being made through encrypted messages circulating in a virtual private network over a global network (4) of computer communication, such as the Internet.

The terminal (1a) comprises a biometric reader (11), such as a fingerprint reader, an encryption device (12) that creates the message and a communications device (13) via UMTS, fed from an autonomous energy support ( 14) and portable. In addition the terminal (1a) also comprises a console (15) of interface for the introduction of instructions, such as a payment order and an operation warning (16) carried out positively or negatively.

The server computer (3) comprises a database (31) of biometric readings of the authorized users together with a list of operating privileges for the different security means (2a, ... 2m) to which they are authorized, such as access doors or means of conducting bank transactions. This server computer (3) is accessible from remote computers (5) by controlling agents or delegates granting privileges to users.

The security means (2a, ... 2m) are of different constitution and may comprise a communications device (not shown) for receiving the encrypted drive message from the server computer (3) through the existing private virtual network on the global network (4) of computer communication.

Once the nature of the invention has been sufficiently described, as well as an example of a preferred embodiment, it is stated for the appropriate purposes that the materials, shape, size and arrangement of the described elements may be modified, provided that this does not imply an alteration of the essential characteristics of the invention that are claimed below.

Claims

1.- Safety procedure by means of biometric identification, characterized in that it comprises the phases of: - Capturing a biometric reading of a unique characteristic of a person to carry out an instruction or action,

- composition of a message with the identification of the terminal (1a, ... 1n) where the capture is made, the data of the reading and an identification of the instruction to be performed, - encryption of the message to prevent its violation,

- sending the message through a private virtual network over a global network (4) of computer communication,

- reception of the message by a server computer (3) and its decryption,

- identification of the person by means of the biometric reading data, - checked against a database (31) of the terminal identification (1a,

... 1 n), of the identification of the person and of the identification of the instruction to be carried out,

- sending at least one message to the security medium or means (2a, ... 2m) determined by the database (31), in case of positive comparison.

2. Procedure according to claim 2, characterized in that in case of negative collation in the database (31), a message with an appropriate notification is sent to the terminal (1a, ... 1 n).

3. Method according to claim 1, characterized in that it comprises the creation, maintenance and manipulation of the database (31) housed in the server computer (3) from at least one remote computer (5a, ... 5n) for its update and user privilege establishments.

4.- Security system by means of biometric identification of persons, of the type that comprise a terminal (1 a, ... 1n) with a biometric reader (11), such as a fingerprint reader, an iris reader or of the retina of the eye, a thermal vision camera, voice recognition or others, for the actuation of at least one security means (2a, ... 2m), such as an electronic lock, a machine starter or a system electronic communication or payment, characterized in that the terminal (1a, .., 1 n) comprises an encryption device (12) and a communications device (13), being related to one or more server computers (3) by a private virtual network installed on a global network (4 ) of communication of computers for the transmission of a message with its own identification, of the reading made by the biometric reader (11) and optionally of an instruction request to the management server computer (3) for the realization of an action on one or more security means (2a, ... 2m) if the content of the message collated with a database (31) resident in said server computer (3) is authorized.

5. System according to claim 4, characterized in that the terminal

(1a, ... 1 n) comprises an operation warning (16) performed positively or negatively as a user interface.

6. System, according to claim 4, characterized in that the terminal (1a, ... 1 n) and the safety means (2a, ... 2m) are integrated in the same device.

7. System according to claim 4, characterized in that the terminal

(1a, ... 1 n) comprises an autonomous and portable energy support (14).

8. System according to claim 4, characterized in that the communications device (13) of the terminal (1a, ... 1 n) is of the wireless type.

9.- 'System, according to claim 4, characterized in that the terminal

(1a, ... 1n) comprises an interface console (15) for the introduction of instructions.

10. System according to claim 4, characterized in that the security means (2a, ... 2m) comprise at least one communication device with the global communication network (4) of computers for receiving encrypted drive messages from the server computer (3).