WO2010020658A1

WO2010020658A1 - Cryptography method and identification method based on biometric data

Info

Publication number: WO2010020658A1
Application number: PCT/EP2009/060718
Authority: WO
Inventors: Thomas Wölfl
Original assignee: Psylock Gmbh
Priority date: 2008-08-20
Filing date: 2009-08-19
Publication date: 2010-02-25
Also published as: DE102008041392A1

Abstract

The present invention relates to a method for encrypting and/or marking data using at least one key, wherein the key is determined from a biometric sample. The present invention also relates to a method for identifying a person using a biometric sample, wherein parameters of the biometric sample are determined and wherein from the parameters at least one key is determined which is then used for identification purposes. The present invention also relates to a corresponding computer product and to a memory space containing correspondingly encrypted data.

Description

CRYPTOGRAPHY PROCESS AND IDENTIFICATION PROCESSES BASED ON

BIOMETRIC DATA

BACKGROUND OF THE INVENTION

FIELD OF THE INVENTION

The present invention relates to a method for encrypting and / or signing data by means of at least one key.

STATE OF THE ART

Due to the worldwide networking of computers via the Internet and due to the extensive data exchange via e-mail and the like, data protection in the exchange of data and the security of the origin of the data is becoming increasingly important. For example, methods based on the PGP (Pretty Good Privacy) method are known from the prior art. In this widespread encryption method, a public and a secret key are generated with which the messages can be encrypted or messages can be signed. The public key is in this case generally made available to the public in order to generate encrypted messages, which are then sent to the owner of the matching secret key, wherein the owner of the secret key can decrypt the encrypted message with his secret key.

In the signature, the message or part of the message is encrypted by the sender with the secret key. The recipient of the message decrypts the message with the public key and compares it with the additionally transmitted unencrypted message or partial message and can determine if it matches that the signature originated from the owner of the secret key and no one since the encrypted part of the document has changed.

In addition to the asymmetric methods with a public and a secret key, there are also so-called symmetric methods in which only a secret key is used for encryption and decryption. Known symmetrical methods are the Drive according to the Data Encryption Standard (DES method) or the Advanced Encoding Standard (AES method). This method is a block ciphering method in which information blocks are encrypted with keys of a certain length.

However, in both asymmetric and symmetric encryption methods, the problem is that at least one secret key must be stored in order to have it available for encryption and / or decryption. So if the secret key falls into the wrong hands, the encryption system is ineffective. Overall, the system is only as secure as the secret key is protected against unauthorized access.

DISCLOSURE OF THE INVENTION

OBJECT OF THE INVENTION

The present invention thus has the object to provide an encryption method and a method for signing data, which has a higher security compared to the known methods. In addition, the corresponding encryption and / or Signierverfahren should be easy to implement and feasible. In addition, a software program product for implementing the method to data processing systems and appropriately protected memory areas are to be made available.

TECHNICAL SOLUTION

This object is achieved by a method having the features of claim 1, a computer program product having the features of claim 23 and a memory space having the features of claim 24.

In addition, a simplified method for identifying a person with the features of claim 12 is provided.

Advantageous embodiments are the subject of the dependent claims. The invention is based on the recognition that compared to stored keys for encrypting and / or signing data thereby a higher security standard can be achieved when the corresponding secret key does not need to be stored, but can be generated again and again in a reproducible manner. In this case, the inventor has recognized that biometric methods, such as those used to identify persons in access control to security-relevant areas, such as secure houses and the like or in access to data processing systems, can be used correspondingly to at least one of them in a reproducible manner So to generate the secret key. Such biometric methods for identifying persons are described, for example, in WO 98/06020 A1 or US Pat. No. 6,151,593 A with regard to the use of typing behavior as biometric information. In addition to the typing behavior as biometric information, further biometric information can be used, such as the image of the eyes, in particular the iris, image of the face or the image of a fingerprint.

From the biometric information at least one characteristic parameter can be determined, which is used to determine the at least one key. Of course, several characteristic parameters of the biometric information can be used to determine the key. In particular, longer key can be obtained from several characteristic parameters by e.g. Create concatenation of the corresponding values of the characteristic parameters.

The characteristic parameters may include, for example, with respect to images of the eyes, fingerprints, or faces, corresponding data about survey values such as eye distances, distances of the fingerprint lines, or density of the fingerprint lines, or the like. In the case of biometric information in the form of data about the typing behavior of a person on a single key, a sensor field, a keypad, a keyboard of a conventional PC or other keyboard, the characteristic parameters may comprise different values. For example, these may include values regarding the holding time of all or certain keys, the transition period from releasing one key to pressing the next key, the transition period from releasing one key to releasing the next key, the transition period from pressing a key to pressing the next key , the frequency or frequency of errors, the tip rate, ie the number of words typed in a certain time, the velocity of the attack, So be the number of actuated keys in a certain time, etc. In particular, single or multiple repetitions, ie pressing the next key before the previous key is released, the frequency of use of certain function keys, the selection of alternatively available keys, such as the selection of the left or right shift key or the like be used. Above all, statistical values, such as frequency distributions or probability values, can be determined from this. As characteristic parameters also other special temporal or key-related abnormalities can be used.

From these parameters numerical values representing the key can then be determined via mathematical functions. For example, average values may be determined from the characteristic parameters that correspond to at least one mathematical function, e.g. Division by a constant and / or rounding to be subjected. The corresponding numerical values can be used as keys since they are generated reproducibly.

As a mathematical function, for example, a one-way function can be performed, in which it is possible to calculate a result in a calculation direction very quickly, while the reverse direction, so the backward calculation is very time consuming.

An example of this is the multiplication of primes, which is very fast and easy to do, while the decomposition of a product into the prime factors is very expensive. Accordingly, values may be determined, for example, according to the characteristic parameters of a biometric information, also called a biometric sample, such as the average holding time of all keys or a certain key and values of other characteristic parameters, then a one-way function is applied to determine a key. The key can comprise at least one numerical value or several numerical values.

The numerical values can be determined such that the numerical values for different biometric samples of one type, ie biometric information either from the typing behavior or from the face recognition, are constant for a person. Moreover, it is also possible that, instead of the constancy of the numerical values, equivalent numerical values are also determined, which, however, enable mutual encryption and decryption. This means that not every biometric sample, ie a person's recorded biometric data, such as the recorded keypad data, must result in the identical numerical values or values of the key, but that different equivalent numerical values are possible, but that are equivalent in nature, that they allow for mutual encryption or decryption. This means that, for example, in the acquisition of the biometric data of a person in the case of the sample A, the numerical value a is generated, while in the case of the detection of the sample B the numerical value b is determined. However, the numerical values a and b are equivalent so that encryption with the key based on the numerical value a and decryption with the key on the basis of the numerical value b is possible, and vice versa.

From the biometric information, a key can be generated or even a key pair or multiple keys so that in a key pair similar to the PGP method one of the keys can be provided as a public key.

The generation of a key or a plurality of keys can also simplify an identification procedure for a person in such a way that complex comparison of reference patterns acquired in an access attempt with stored characteristic reference patterns no longer has to take place, but rather that of the characteristic parameters of FIG or the corresponding keys are generated and then only the keys are compared, ie the key generated during the access attempt with a stored reference key. As a result, the identification of a person can be simplified by generating a corresponding key. Alternatively, encrypted information can also be compared in order not to have to store a reference key.

The method according to the invention, which can preferably be realized as a computer program, allows data to be encrypted and decrypted without having to store a secret key of the corresponding person since the biometric data are always available again for generating the secret key.

Accordingly, it is also possible to create an absolutely protected data storage space, in which the corresponding encrypted data is stored, without additionally a secret key must be deposited. The secret key will be removed if necessary recovered biometric data of the user. In this way, the stored encrypted data can be publicly stored everywhere without the risk that the loss of the secret key makes the data accessible to unauthorized persons.

Particularly preferred for the described methods, memory locations and programs is an embodiment in which data of the typing behavior are used as biometric data.

Preferably, the numerical values for the key could be constant for different biometric samples or give equivalent numerical values.

Embodiment

When typing a text that is to be sent as an encrypted message Tipprohdaten are detected, which exist for example in the timed sequence of key presses. From these tipproh data, also known as a biometric sample, characteristic parameters such as the average holding time of all keys or the average holding time of a certain key or the frequency distribution of holding periods of all keys or specific keys, the probabilities of typing errors, the probability of their use determined certain keys etc.

From these values, a secret key for symmetrical encryption and decryption can then be generated by corresponding methods, the key consisting of one or more numerical values.

The numerical values can be determined, for example, by forming average values based on values of the characteristic parameters, such as, for example, the holding periods and the transition periods. The average values can be divided by a constant specified for the corresponding characteristic parameter and the result rounded to the nearest integer. The corresponding rounding results can be hanged together (concatenated) to form the key. For example, the determined average value d fl of the first characteristic parameter fl is 103.5, while d_f2 of a second characteristic parameter f2 is 18, etc.

The constant c fl is 15, while c_f 2 is 10. The division of d fl with c fl and d_f2 with c_f2 yields the values e_fl = 6.8766 and e_f2 = 1.8. The rounded, concatenated values give 72 as the constant value of the biometric sample, e.g. a tip sample, and can be used as a key value.

In addition to such simple methods for symmetric encryption, more complex methods, in particular for asymmetric encryption, are also conceivable. The so-called RSA system can form the basis for this. For this, the next higher prime number can be determined from the determined characteristic values, and a so-called RSA modulus N can be calculated from two prime numbers by prime multiplication. The Euler function φ can be applied to the RSA module, which serves to determine the second numerical value next to the RSA module for, for example, the public key. For example, a divisive number e greater than 1 and less than the value of the euler function of the RSA module N can be selected. From this, the second numerical value of the secret or private key d can then be determined as a multiplicative inverse of the modulus of the Euler function φ (N).

The message can be encrypted by determining the ciphertext C from the plaintext K according to the formula C = K ^e mod N, while the decryption is performed by the formula K = C ^d mod N. By encrypting the message and transmitting the message in plain text and the public key, the recipient can determine whether the text has been changed when sending and actually comes from the owner of the secret key to the public key.

In addition, the recipient of the public key can send messages to the person from whom the biometric data originates in an encrypted manner by using the

Encrypted message with the public key and the recipient decrypts the encrypted message with the secret key. The secret key can be generated at any time by the recipient from his biometric information available only to him, for example when identifying the recipient via the biometrics. see data when logging in to the data processing system over which the encrypted message is received.

Although the present invention has been described in detail with reference to the embodiments, the invention is not limited thereto, but rather variations are possible, such as the omission of individual features or the different combination of features, without departing from the scope of the appended claims. Above all, the invention encompasses all combinations of all presented features. In particular, different mathematical functions may be used to determine a stable, constant or equivalent value from the biometric sample for use as a key.

Claims

claims

1. A method for encrypting and / or signing data by means of at least one key, characterized in that the key is determined from a biometric sample.

The method of claim 1, characterized in that the biometric sample is selected from the group consisting of fingerprints, eye and face images, and typing behavior on a keyboard.

3. The method according to claim 1 or 2, characterized in that at least one characteristic parameter is determined from the biometric sample, which is used to determine the at least one key.

4. The method according to claim 3, characterized in that the characteristic parameters include at least one element from the group, the holding period of a key, the transition period from releasing a key to press the next key, the transition period from releasing a key to release the next Key, the transition period from pressing a key to pressing the next key, the frequency or frequency of errors, the tip rate, the attack frequency, single or multiple overhauls, the frequency of use of certain function keys, the selection of alternative keys, the selection of the left or right Shift key, statistical values from it and temporal or key-related abnormalities, which are distinguished by exceptional values from the data obtained

5. The method according to any one of the preceding claims, characterized in that in the determination of the at least one key, a one-way function is applied.

6. The method according to any one of the preceding claims, characterized in that the key comprises at least one numerical value.

7. The method according to any one of the preceding claims, characterized in that the key comprises a plurality of numerical values.

Method according to claim 6 or 7, characterized in that the numerical value or values are constant in different biometric samples of a kind of one person.

9. The method according to any one of claims 1 to 7, characterized in that the key comprises a plurality of equivalent numerical values.

10. The method according to any one of the preceding claims, characterized in that a key pair or a plurality of keys are generated.

11. The method according to any one of the preceding claims, characterized in that data of the typing behavior are used as biometric data.

12. A method for identifying a person based on a biometric sample, wherein parameters of the biometric are determined, characterized in that at least one key is determined from the parameters.

The method of claim 12, characterized in that the biometric sample is selected from the group consisting of fingerprints, eye and face images and typing behavior.

14. The method according to claim 12 or 13, characterized in that at least one characteristic parameter is determined from the biometric sample, which is used to determine the at least one key.

15. The method according to claim 14, characterized in that the characteristic parameters include at least one element from the group, which determines the holding time of a key, the transition period from the release of a key to the Drü- the next key, the transition period from releasing a key to release the next key, the transition period from pressing a key to pressing the next key, the error frequency or frequency, the tip rate, the attack frequency, single or multiple overhauls, the frequency of use certain function keys, the selection of alternative keys, the selection of the left or right shift key, statistical values therefrom and temporal or key-related abnormalities, which are distinguished by exceptional values from the determined data

16. The method according to any one of claims 12 to 15, characterized in that in the determination of the at least one key, a one-way function is applied.

17. The method according to any one of claims 12 to 16, characterized in that the key comprises at least one numerical value.

18. The method according to any one of claims 12 to 17, characterized in that the key comprises a plurality of numerical values.

A method according to claim 17 or 18, characterized in that the numerical value or values are constant in different biometric samples of a kind of one person.

20. The method according to any one of claims 12 to 18, characterized in that the key comprises a plurality of equivalent numerical values.

21. The method according to any one of claims 12 to 20, characterized in that for identifying a person, the secret reference key is compared with the key generated from a current biometric sample or an encrypted reference information with a currently encrypted information.

22. The method according to any one of claims 12 to 21, characterized in that data of the typing behavior are used as biometric data.

23. Computer program product for execution on a data processing system with a stored signal sequence, which when executed on a data processing system causes the execution of a method according to one of the preceding claims.

24. Storage for electronically, magnetically and / or optically stored data, wherein the data is encrypted by the method according to one of claims 1 to 10.