WO2015128128A1

WO2015128128A1 - Method for storing biometric access data for a computer system, computer system, and data memory

Info

Publication number: WO2015128128A1
Application number: PCT/EP2015/051250
Authority: WO
Inventors: Ulrich Ahn; Thomas Schkoda; Mario Wegener
Original assignee: Fujitsu Technology Solutions Intellectual Property Gmbh
Priority date: 2014-02-27
Filing date: 2015-01-22
Publication date: 2015-09-03
Also published as: DE102014102637B4; DE102014102637A1

Abstract

The invention relates to a method for storing biometric access data for a computer system (10) having biometric access control. The method comprises the following steps: recording biometric access data; checking if biometric access data are stored and associated with a user profile after biometric access data have been recorded; recording and examining non-biometric access data of the user profile if the check was negative; and storing the recorded biometric access data for the user profile. The invention further relates to a computer system (10) and to a data memory.

Description

description

Method for storing biometric access data for a computer system, computer system and data memory

The invention relates to a method for depositing

biometric access data for a computer system with biometric access control. The invention further relates to a computer system and a data memory.

Biometric access controls on computer systems offer several advantages. So can an access for users

for example, be simplified. Also, one can

Security level can be increased by an additional installation of a biometric query. In order to equip a computer system, for example in a company network with biometric access control, it is necessary that the individual users who use the computer system, registered and their biometric data in the

Computer system are deposited.

The object of the invention is to describe a method for storing biometric access data for a computer system with biometric access control, which allows a user to easily deposit his biometric access data in the computer system. It is another object of the invention, a for such a

Method to identify suitable computer system and a data storage.

According to a first aspect, the object is achieved by

Method for storing biometric access data for a Computer system with biometric access control solved. The method comprises the steps:

- collecting biometric access data;

- Check that biometric access data are stored and assigned to a user profile after biometric

Access data were recorded;

- capturing and checking non-biometric login credentials of the user profile if the scan was negative; and

- storing the acquired biometric access data to the user profile.

Lying a computer system with biometric

Access control does not provide biometric access to a user profile, for example, locally or on one

Network storage, so can with the help of the process

biometric credentials to the user profile are captured as soon as a user logs on. This is particularly effective when biometric accessibility has been re-established and users subsequently log in to the computer system for the first time. For a user profile for which non-biometric access data are already available, biometric access data are recorded. This avoids the need for the user to be personally authorized at a central office.

According to an advantageous embodiment, the following steps are additionally performed after the step of checking

executed: - checking biometric access data if the check was positive; and Unlocking a user profile belonging to the biometric access data when checking the

biometric access data was positive. If biometric access data are already stored in the computer system, then the user profile is unlocked as soon as the biometric access data are checked and considered correct

were. Thus, a user can directly without

Enter additional non-biometric credentials in the computer system.

According to a further advantageous embodiment, the step of checking biometric access data is repeated several times up to a predetermined number

Repetitions repeated. This happens when the verification of the acquired biometric access data was negative.

By being able to repeat the step of acquiring and checking biometric access data several times, the method becomes more error-tolerant.

According to a further advantageous embodiment, the biometric access data comprise at least one of the following biometric data: fingerprint; Vein pattern;

Iris structure; Retina; Face; Voice.

Individual biometric data types of the aforementioned list have different advantages. For example, while a fingerprint is straightforward and quick to grasp, a fingerprint will often be left on surfaces, posing a greater security risk than, for example, an iris structure. By a Combination of different biometric data types can further increase security.

According to a further advantageous embodiment, the non-biometric access data comprise at least one of

following data types: password; Security card;

Security question.

A well-chosen password still provides a relatively high level of security. The above-mentioned proven and usual non-biometric data types can also be used for verification, for example, if the biometric

Access data was not recognized. According to a second aspect, the object is achieved by

Computer system solved. The computer system includes a

Safety device and a biometric

Input component. The safety device is to

furnished, nonbiometric access data of a

selected user profile and check if the selected user profile is not biometric

Access data are assigned. The security device is further configured to provide the biometric access data to the selected user profile via the biometric

Input component to capture and save, if the

Check of nonbiometric access data was successful.

By having biometric in a computer system

Access data can be recorded and saved to a user profile, is a change from one

Non-biometric to a biometric access control greatly facilitated. According to an advantageous embodiment, the

Safety device further set up the

activate selected user profile if the verification of the biometric access data was successful.

By having the security device set up to unlock the selected user profile if the validation of the biometric credentials has been successful, a user is allowed to log in via biometric access control.

According to an advantageous embodiment, the

Security device a login component for logging in a user to the computer system.

With such a modular structure, the solution can be found in existing security concepts of known

Operating systems are integrated.

According to a third aspect, the object is achieved by a

Data memory solved. Executable program code is stored on the data memory, with the execution of the

executable program codes by a

Data processing unit, a method according to the first aspect is performed.

Advantages for this correspond to the advantages mentioned in the first aspect.

According to an advantageous embodiment, the

executable program code a credential query for an operating system. For example, a credential query may be a password query or biometric data collection. In general, a credential query is a query of credentials. With the help of such

Credentials query allows a user not only to the computer system, but also directly to a computer

Log in the operating system.

The invention will be described below with reference to

Embodiments and figures explained in more detail. In the figures show:

Figure 1 is a schematic representation of a computer system according to an embodiment of the invention; and

FIG. 2 shows a flowchart of a method according to FIG

Embodiment of the invention.

FIG. 1 shows a schematic representation of a

Computer system 10. The computer system 10 has a

Safety device 11 on. The security device 11 controls accesses and authorizations for the computer system 10. This includes an access control. The

Safety device 11 presents a user on a screen connected to computer system 10

Login screen. For this purpose, the securing device 11 has a registration component 12. The login component 12 further serves to manage various access data and

Validate access data. The security device 11 evaluates the received from the login component

Validation data. If the validation data is positive, the security device 11 grants a user access to higher levels of software, such as an operating system (Credential Provider for Microsoft Windows, or Plugable Authentication Modules (PAM) for Unix / Linux derivatives). Are the

Validation data, however, negative, denied the

Security device 11 allows a user access to higher levels of software.

With the securing device 11, a data memory 13 is connected. The data memory 13 may be, for example, a local hard disk such as an SSD hard disk, but also another storage medium. The data memory 13 may also be a network memory, for example via a

Data network is accessible. Furthermore, the

Safety device 11 with a biometric

Input component 14 and a non-biometric

Input component 15 connected.

The nonbiometric input component 15 is in

Embodiment of a keyboard. Non-biometric access data, such as passwords, can be queried via the nonbiometric input component 15. In an alternative embodiment, it is in the

nonbiometric input component 15 around a card reader. In this case, over the non-biometric

Input component 15 Access data from a chip card

read. Basically it concerns with the

non-biometric input component 15 for one device, a combination of multiple devices, or software for acquiring nonbiometric access data. The biometric input component 14 is used to acquire biometric access data. In the described

Design are detected via the biometric input component 14 fingerprints. This is the biometric Input component 14 designed as a fingerprint sensor. Other configurations may, of course, be other sensors such that other biometric data such as venous pattern, iris structure, retina, etc. may be used

Face or a voice can be detected.

To check recorded access data, the

Login component 12 match the acquired access data with stored in the data memory 13 access data. If a match of access data is detected, the security device 11 grants access to the user

Computer system 10. Alternatively, computer system 10 may be connected to a data store via a data network. In this case, a reconciliation of access data via the data network takes place. Likewise, the computer system 10 may be connected to a plurality of local and / or data stores connected to the computer system 10 via a data network. In this case, the login component 12 matches access data with a current access data record.

In the following, with reference to the illustrated in Figure 2

Flowchart 20 describes a method for storing biometric access data. For example, the procedure is performed after an administrator considers switching to a biometric user login as the only valid one

Registration form or login policy.

In step 21, a user profile is selected by a user. For example, by entering a user name in an input field provided for this purpose. Has the

User previously logged on the computer system 10, so his username already in the input field

be registered so that the user profile as a suggestion is predetermined. Alternatively, a user may choose a user profile from several suggested user profiles. In step 22, biometric access data is acquired.

For this purpose, the logon component 12 of the

Securing device 11 presents the user with a surface with a query for acquiring the biometric access data on a screen. About the biometric

Input component 14 detects the backup device 11 now the biometric access data of the user.

In the following step 23 is of the

Security device 11 checks whether biometric access data are stored for the selected user profile.

Is a stored set of biometric access data

exists, then in step 24, the validity of the in

Step 22 reviewed biometric access data reviewed.

If the acquired biometric access data has been rejected as invalid, the user is denied access to the computer system 10 and the method is terminated in step 25. In an alternative, not shown

Embodiment, in a negative validity check in step 24 for a predetermined number of repetitions, such as three repetitions, again biometric

Access data via the biometric input component 14 detected and checked for validity. This makes it possible to compensate for an erroneous detection of valid biometric access data. If biometric access data were recognized as valid in step 24, the user is granted access to the computer system 10 in step 26. This includes, for example, a login to an operating system and access

User data and personal settings.

If it was determined in step 23 that there is no biometric access data for the selected user profile

are present, the user is in step 27 through the

Login component 12 a surface for input

nonbiometric access data. The user now has the option of entering non-biometric access data via the non-biometric input component 15. These nonbiometric access data are provided by the

Safety device 11 detected.

The non-biometric access data acquired in step 27 are checked for validity by the security device 11 in step 28. Are the non-biometric

Access data invalid, the process is aborted in step 25. In an alternative embodiment, the user is given a predetermined number of repetitions and thus opportunities for re-entry non-biometric

Access data via the non-biometric input component 15 allows before access to the computer system 10 is finally denied.

If, in step 28, the non-biometric access data were recognized as valid, in step 29 the detected

biometric access data from step 22 of the

Safety device 11 in the data memory 13 to the

User profile saved. The user is from now on possible to log into the computer system 10 with these biometric access data in the future.

Subsequently, the user is granted access to the computer system 10 in step 26. This includes, for example, access to an operating system. Alternatively, the process continues in step 21. This is

Accordingly, the user is granted no access immediately after the acquisition of the biometric data, but again displayed a login screen through which the user can log on with the stored biometric access data.

In an alternative embodiment, the initial

Profile selection omitted by the user. The

User profile determination then additionally takes place automatically in step 24. If no profile can be assigned, the acquisition of the nonbiometric access data is then continued in step 27.

Reference sign list

10 computer system

11 safety device

12 Login component

13 data memory

14 biometric input component

15 non-biometric input component 20 Flowchart

21-29 process steps

Claims

claims

Method for storing biometric access data for a biometric computer system (10)

Access control comprising the steps:

- collecting biometric access data;

- Checking whether biometric access data are stored and assigned to a user profile after biometric access data has been recorded;

- storing the acquired biometric access data to the user profile.

The method of claim 1, wherein the following steps are additionally performed after the step of checking:

- Check biometric access data if the

Review was positive; and

Unlocking a user profile belonging to the biometric access data when checking the

biometric access data was positive.

The method of claim 2, wherein the step of checking biometric access data is multiple times to one

predetermined number of consecutive repetitions is repeated when the examination of the detected

biometric access data was negative.

Method according to one of claims 1 to 3, wherein the biometric access data comprise at least one of the following biometric data: - fingerprint; Vein pattern; Iris structure; Retina; Face; and / or vote.

5. The method of claim 1, wherein the nonbiometric access data comprises at least one of the following data types:

- Password; Security card; and / or security question.

A computer system (10) comprising a security device (11) and a biometric input component (14), wherein the security device (11) is adapted to provide non-biometric access data of a selected one

User profiles and to check if the selected user profile is not biometric

Access data are assigned, and wherein the

Security device (11) is further adapted to the biometric access data to the selected

Capture and store the user profile via the biometric input component (14) if the nonbiometric access data check was successful.

7. Computer system (10) according to claim 6, wherein the

Security device (11) is further adapted to unlock the selected user profile, if the verification of the biometric access data was successful.

8. Computer system (10) according to any one of claims 6 or 7, wherein the securing means (11) a

Login component (12) for registering a user on the computer system (10).

9. Data store, on the executable program code

is stored, while executing the executable Program codes by a data processing unit a method according to one of claims 1 to 5 is executed. The data store of claim 9, wherein the executable

Program code includes a credential query for an operating system.