Method, system, personal security device and computer program product for cryptographically secured biometric authentication

• US 20070195998A1
• Filed: 03/29/2006
• Published: 08/23/2007
• Est. Priority Date: 03/30/2005
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: ActivIdentity, Inc. (Assa Abloy AB)
• Inventors: Liu, Hong, Boyer, John, Le Saint, Eric, Fedronic, Dominique
• Granted Patent: US 7,787,661 B2
• Time in Patent Office: Days
• US Class Current: 382/115
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G07C 9/23 by means of a password
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence

Abstract

A system is used for authorizing access to a Personal Security Device. This system comprises a Personal Security Device 75 and another device 105 which is in functional communication with said Personal Security Device. Said Personal Security Device comprises identification information retrieval data and a biometric authentication application 200 which transfers said identification information retrieval data to said other device 105 in response to an identified match between biometric data sent by said other device and a predetermined biometric reference. Said other device 105 comprises a security executive application 230 for retrieving an Identification Information with at least said identification information retrieval data, thus generating a retrieved Identification Information, and transferring said retrieved Identification Information to said Personal Security Device 75. Said Personal Security Device comprises a security executive application 215 for authorizing access in response to an identified match between said transferred retrieved Identification Information and a predetermined Identification Information stored in said Personal Security Device.

Claims

1. A method for authorizing access to a Personal Security Device, wherein said Personal Security Device is in functional communication with another device, comprising:

said Personal Security Device transferring identification information retrieval data to said other device in response to an identified match between biometric data sent by said other device and a predetermined biometric reference,

said other device transferring to said Personal Security Device an Identification Information retrieved thanks to at least said identification information retrieval data, and

said Personal Security Device authorizing access in response to an identified match between said transferred retrieved Identification Information and a predetermined Identification Information stored in said Personal Security Device.

2. The method for authorizing access to a Personal Security Device according to claim 1, wherein said Identification Information is a Personal Identification Number (PIN).

3. The method for authorizing access to a Personal Security Device according to claim 1, wherein said identification information retrieval data are decrypting data for decrypting said Identification Information transferred to said Personal Security Device.

7. The method for authorizing access to a Personal Security Device according to claim 2, further comprising an initialization of said Personal Security Device and said other device, said initialization including:

said other device recording initial biometric data and a Personal Identification Number entered by a user,

said other device sending to a server said initial biometric data,

said server cross referencing said initial biometric data as a biometric reference using a unique identifier of said Personal Security Device, and generating a cryptographic key,

said server sending said biometric reference and said cryptographic key to said other device,

said other device routing said biometric reference to said Personal Security Device where it is stored for future use in matching with biometric data to be received by said Personal Security Device,

said other device using said cryptographic key to encrypt a copy of said Personal Identification Number, thus generating a cryptogram,

said other device sending said cryptographic key and said Personal Identification Number to said Personal Security Device where they are stored, said cryptographic key being stored as at least part of said identification information retrieval data.

8. The method for authorizing access to a Personal Security Device according to claim 7, wherein said cryptogram is stored in said other device.

9. The method for authorizing access to a Personal Security Device according to claim 7, wherein said other device sends said cryptogram to said server where it is stored in relation to said unique identifier of said Personal Security Device.

11. The method for authorizing access to a Personal Security Device according to claim 7, wherein once the Personal Security Device has received said cryptographic key and said Personal Identification Number, said Personal Identification Number is converted into a binary form which is combined with a binary random number, thus generating a combination which is then encrypted using said cryptographic key.

12. The method for authorizing access to a Personal Security Device according to claim 2, wherein a cryptographic key retained by said other device is used by said other device to be combined with said identification information retrieval data to obtain said retrieved Personal Identification Number.

13. The method for authorizing access to a Personal Security Device according to claim 1, wherein said identification information retrieval data is a symmetric cryptographic key.

4. A method for authorizing access to a Personal Security Device, wherein said Personal Security Device is in functional communication with another device connected to a biometric device, the method comprising:

said biometric device recording biometric data,

said other device transferring said biometric data to a biometric authentication application of said Personal Security Device,

said biometric authentication application comparing said transferred biometric data with a predetermined biometric reference,

said Personal Security Device transferring identification information retrieval data to said other device in response to an identified match between said biometric data and said predetermined biometric reference,

said other device retrieving an Identification Information using at least said identification information retrieval data, thus generating a retrieved Identification Information, and transferring said retrieved Identification Information to a security executive application of said Personal Security Device,

said security executive application comparing said transferred retrieved Identification Information with a predetermined Identification Information,

said security executive application authorizing access to said Personal Security Device in response to an identified match between said transferred retrieved Identification Information and said predetermined Identification Information.

5. The method for authorizing access to a Personal Security Device according to claim 4, wherein said retrieved Identification Information is a Personal Identification Number (PIN).

6. The method for authorizing access to a Personal Security Device according to claim 4, wherein said identification information retrieval data are decrypting data for decrypting said Identification Information transferred to said Personal Security Device.

10. The method for authorizing access to a Personal Security Device according to claims 4 and 9, further comprising:

said Personal Security Device transferring said unique identifier to said other device,

said other device sending said unique identifier to said server,

said server retrieving said cryptogram related to said identifier,

said server sending said cryptogram to said other device.

14. A system for authorizing access to a Personal Security Device, comprising a Personal Security Device and another device which is in functional communication with said Personal Security Device, wherein:

said Personal Security Device comprises identification information retrieval data and a biometric authentication application which transfers said identification information retrieval data to said other device in response to an identified match between biometric data sent by said other device and a predetermined biometric reference,

said other device comprises a security executive application for retrieving an Identification Information with at least said identification information retrieval data, thus generating a retrieved Identification Information, and transferring said retrieved Identification Information to said Personal Security Device, and said Personal Security Device comprises a security executive application for authorizing access in response to an identified match between said transferred retrieved Identification Information and a predetermined Identification Information stored in said Personal Security Device.

15. The system for authorizing access to a Personal Security Device according to claim 14, wherein said Identification Information is a Personal Identification Number (PIN).

16. The system for authorizing access to a Personal Security Device according to claim 14, wherein said identification information retrieval data are decrypting data for decrypting said Identification Information transferred to said Personal Security Device.

17. A Personal Security Device comprising:

identification information retrieval data,

a biometric authentication application which transfers said identification information retrieval data to another device which is in functional communication with said Personal Security Device, in response to an identified match between biometric data sent by said other device and a predetermined biometric reference,

an input port for receiving from said other device an Identification Information retrieved by said other device with at least said identification information retrieval data, and

a security executive application for authorizing access in response to an identified match between said transferred retrieved Identification Information and a predetermined Identification Information stored in said Personal Security Device.

18. The Personal Security Device according to claim 17, wherein said Identification Information is a Personal Identification Number (PIN).

19. The Personal Security Device according to claim 17, wherein said identification information retrieval data are decrypting data for decrypting said Identification Information transferred to said Personal Security Device.

20. A computer program product for implementing a method for authorizing access to a Personal Security Device, wherein said Personal Security Device is in functional communication with another device, the computer program product comprising a computer readable medium carrying computer executable instructions that implement the method, wherein the method comprises:

said Personal Security Device transferring identification information retrieval data to said other device in response to an identified match between biometric data sent by said other device and a predetermined biometric reference,

said Personal Security Device receiving from said other device an Identification Information retrieved thanks to said identification information retrieval data, and

said Personal Security Device authorizing access in response to an identified match between said transferred retrieved Identification Information and a predetermined Identification Information stored in said Personal Security Device.

21. The computer program product according to claim 20, wherein said Identification Information is a Personal Identification Number (PIN).

22. The computer program product according to claim 20, wherein said identification information retrieval data are decrypting data for decrypting said Identification Information transferred to said Personal Security Device.