US20080039140A1 - System and method for secure biometric identification - Google Patents

Images

Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
  • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
  • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
  • H04L9/3231—Biological data, e.g. fingerprint, voice or retina
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/80—Wireless
  • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor

Definitions

• the present invention relates to electronic devices and systems. More specifically, the present invention relates to systems and methods for providing user identification and/or authentication for electronic devices and systems.
• the inventive system includes a mobile unit and a server.
• the mobile unit is adapted to receive biometric input and provide a first signal in response thereto.
• a first transceiver is included for transmitting the first signal and receiving a second signal in response thereto.
• a secure device is operationally coupled to the mobile unit. The secure device has two modes of operation: a first locked mode by which access thereto is prohibited and a second unlocked mode by which access thereto is enabled on receipt of the second signal.
• the server unit includes a second transceiver for receiving the first signal transmitted via the wireless link.
• the server is equipped with a system for authenticating the biometric data and providing the second signal in response thereto.
• the second signal is then communicated to the mobile unit where it is utilized to access the secure device.
• the first and second transceivers are adapted to operate in accordance with the Bluetooth specification.
• the mobile unit is adapted to encrypt the first signal and decrypt the second signal.
• biometric input is provided by a fingerprint sensor mounted on a Personal Digital Assistant.
• the secure device in the illustrative implementation is an encrypted database for which the second signal is a decryption key.
• FIG. 1 a is a perspective front view of an illustrative implementation of a PDA adapted for use in accordance with the teachings of the present invention.
• FIG. 1 b is a perspective rear view thereof.
• FIG. 2 is a block diagram of an illustrative implementation of a mobile unit subsystem constructed in accordance with the present teachings.
• FIG. 3 is a block diagram of an illustrative implementation of a server subsystem for use in the system for secure biometric identification of the present invention.
• FIG. 4 is a flow diagram illustrative of a method for secure biometric identification implemented in accordance with the teachings of the present invention.
• the inventive system includes a mobile unit and a server.
• the mobile unit is a Personal Digital Assistant (PDA) adapted to receive biometric input from a fingerprint sensor and provide a first signal in response thereto.
• PDA Personal Digital Assistant
• personal Digital Assistants are well known and widely used.
• FIG. 1 a is a perspective front view of an illustrative implementation of a PDA adapted for use in accordance with the teachings of the present invention.
• FIG. 1 b is a perspective rear view thereof.
• the PDA is implemented in accordance with the teachings of copending U.S. utility patent application, filed on Mar. 21, 2000, entitled “SYSTEM AND METHOD FOR SECURE USER IDENTIFICATION WITH BLUETOOTH ENABLED TRANSCEIVER AND BIOMETRIC SENSOR IMPLEMENTED IN A HANDHELD COMPUTER”, inventor Martin Morris, (Atty. Docket No. WIDC-011), which teachings are hereby incorporated herein by reference.
• the PDA 10 is equipped with an expansion slot 12 such as the VisorTM, Handheld Computer manufactured and sold by Handspring and disclosed more fully at www.handspring.com.
• the expansion slot 12 is adapted to receive a card 14 on which a biometric device, in the illustrative embodiment—a fingerprint sensor 16 , is disposed.
• a transceiver 22 is also disposed on the card 14 .
• the transceiver 22 is adapted to operate in accordance with the BLUETOOTH SPECIFICATION VERSION 1.0A CORE, published in July 1999.
• FIG. 2 is a block diagram of an illustrative implementation of a mobile unit subsystem constructed in accordance with the present teachings.
• the mobile unit subsystem 20 includes the wireless transceiver 22 which is adapted to communicate with a central processing unit (CPU) 26 of the PDA.
• the central processing unit 26 receives biometric data from the fingerprint sensor 28 .
• data from the fingerprint sensor 28 is encrypted in either in software 30 adapted to run on the CPU 26 and/or in optional hardware 32 . Encryption hardware and software are well known in the art.
• the control software 30 also enables the CPU 26 to selectively access and control the mobile unit components via a system bus shown generally at 38 .
• the encrypted biometric data is either used locally to access an encrypted database 34 or, preferably, transmitted over a link such as a wireless link to a server subsystem via the transceiver 22 and antenna 24 .
• the server subsystem is depicted in FIG. 3 .
• FIG. 3 is a block diagram of an illustrative implementation of a server subsystem for use in the system for secure biometric identification of the present invention.
• the encrypted biometric data signal is received by a server antenna 42 and a second wireless Bluetooth enabled transceiver 44 .
• the received signal is decrypted by an optional conventional hardware based decryption circuit 46 and/or by decryption software implemented in control software 48 adapted to run on a server CPU 50 .
• decryption scheme utilized on the server is designed to match that of the mobile unit 20 .
• the RSA public key encryption scheme is used. This scheme is disclosed more fully in U.S. Pat. No.
• the server control software also controls the CPU 50 to selectively access and control the components of the server subsystem 40 via a server subsystem bus shown generally at 51 .
• the decrypted biometric data in the illustrative implementation, the decrypted fingerprint, is compared by fingerprint matching software 52 to a database 54 of biometric data, i.e., fingerprints.
• Fingerprint matching software is well known in the art. Such software may be purchased from Veridicom, Inc. of Santa Clara, Calif.
• the retrieved encryption key is encrypted by the resident encryption scheme either by the hardware unit 46 , if provided, and/or by the encryption software implemented in the control software 48 .
• the encrypted encryption key is then transmitted back to the mobile unit 20 via the wireless link through the transceiver 44 and antenna 42 .
• the encrypted encryption key may be provided to a network 59 via a first network interface. card or circuit 58 and a second network interface card or circuit 66 .
• the network 59 facilitates the communication of the encrypted encryption key to the mobile unit 20 via a wireless transceiver 62 and an antenna 64 . This configuration may be preferred if the second antenna 64 is closer to the mobile unit 20 .
• inventive system can be implemented such that the encrypted biometric data is transmitted from a first PDA 20 and the encrypted encryption key or other information is sent to a second mobile unit or over a network to a second server or network of devices.
• the mobile unit CPU 26 decrypts the encrypted key using the resident software and/or hardware decryption facility 30 and 32 , respectively.
• the decrypted encryption key is then used by the CPU 26 to access a secure device.
• the secure device is an encrypted database 34 mounted on the mobile unit.
• the secure device need not be mounted on the mobile unit 20 .
• the secure device may be coupled to the mobile unit via the wireless link.
• the secure device i.e., database 34
• the secure device has two modes of operation: a first locked mode by which access thereto is prohibited and a second unlocked mode by which access thereto is enabled on receipt of the decrypted encryption key.
• the decryption key for the encrypted database 34 should not be stored on the mobile unit.
• a working copy 36 of the encrypted database 34 is created.
• FIG. 4 is a flow diagram illustrative of a method for secure biometric identification implemented in accordance with the teachings of the present invention. As shown in FIGS. 2, 3 and 4 when a user in possession of the mobile unit 20 wishes to access the secure device 34 , he/she places a finger on the fingerprint sensor 28 and starts the access control program 100 .
• the CPU 26 running the access control software 30 scans the fingerprint from sensor 28 and, at step 106 , encrypts it with the public key of the authentication server 40 by using the encryption software or hardware 30 , 32 .
• the resulting encrypted message is sent to the server 40 via the transceiver 22 and antenna 24 on the mobile unit 20 and the antenna 42 and transceiver 44 of the server 40 .
• the encrypted fingerprint is sent via the access point 60 and local or wide-area network 59 when the server 40 is not within direct radio range of the mobile unit 20 .
• the server CPU 50 decrypts the message using its secret key and the encryption hardware and/or software 46 and 48 , respectively.
• the CPU 50 then utilizes the fingerprint match software 52 to compare the decrypted fingerprint to the database of authorized fingerprints 54 to determine if the request is valid.
• step 114 the decryption key for the user's encrypted database 34 ( FIG. 2 ) is retrieved from the key database 56 ( FIG. 3 ).
• the key is encrypted via the encryption hardware or software 46 , 48 ( FIG. 3 ) and, at step 118 , sent back to the mobile unit 20 via the same path from which the request was originally received.
• the key is received and decrypted.
• the retrieved key used to make a temporary working copy 36 of the encrypted database 34 .
• this temporary copy 36 is either read or edited. If edited, then at step 130 the edited working copy is deleted or rewritten to encrypted form as soon as the user completes his operation.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Health & Medical Sciences (AREA)
• Life Sciences & Earth Sciences (AREA)
• Biodiversity & Conservation Biology (AREA)
• Biomedical Technology (AREA)
• General Health & Medical Sciences (AREA)
• Mobile Radio Communication Systems (AREA)

Abstract

Description

Claims (21)

Priority Applications (1)

Applications Claiming Priority (2)

Related Parent Applications (1)

Publications (1)

Family

ID=38577916

Family Applications (2)

Family Applications Before (1)

Country Status (1)

Cited By (8)

Families Citing this family (13)

Citations (68)

Family Cites Families (3)

• 2000
  • 2000-03-21 US US09/531,720 patent/US7284266B1/en not_active Expired - Lifetime
• 2007
  • 2007-10-16 US US11/873,164 patent/US20080039140A1/en not_active Abandoned

Patent Citations (68)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events