BIOMETRIC SMART CARD FOR MOBILE DEVICES

• US 20090191846A1
• Filed: 01/25/2008
• Published: 07/30/2009
• Est. Priority Date: 01/25/2008
• Status: Abandoned Application

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: SHI, Guangming
• Application Number:
  US12/020,028
• Publication Number:
  US 20090191846A1
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A method and apparatus for controlling access to the data stored on a smart card for use in mobile devices. A user initializes the smart card memory by saving an authentication credential in memory. Subsequently, when various applications executed on the mobile device seek to retrieve the data stored in the smart card memory, the user must submit to an authentication process before access to the data stored in the smart card memory is granted. Embodiments utilize biometric traits and biometric templates stored in memory as authentication credentials. Biometric sensors are provided with the smart card so that a candidate biometric trait can be generated and compared with a biometric template stored in memory. If the biometric trait matches the stored biometric template, then access to the data stored in the smart card is granted.

Claims

1. A smart card for storing data for use in a mobile device comprising:

a processor;

a biometric sensor coupled to the processor; and

a memory coupled to the processor, the memory having stored therein software instructions configured to cause the processor to perform steps comprising;

receiving a data access request to access data stored in the smart card;

prompting a user to complete an authentication process, wherein said authentication process comprises;

prompting the user to use the biometric sensor to generate a candidate biometric trait;

comparing the candidate biometric trait with a biometric template stored in the memory; and

authenticating the user if the generated candidate biometric trait matches the biometric template stored in the memory; and

granting access to the data stored in the smart card only if the user is authenticated.

2. The smart card of claim 1, wherein the software instructions in the memory are further configured to prompt the user to use a biometric sensor coupled directly to the smart card.

3. The smart card of claim 1, wherein the software instructions in the memory are further configured to prompt the user to use a biometric sensor integrated in the smart card.

4. The smart card of claim 1, wherein the software instructions in the memory of the smart card are further configured to cause the processor to grant access to provisioning data stored in the smart card to both authenticated users and non-authenticated users;

wherein the access to provisioning information allows the mobile device to place and receive telephone calls to and from a limited number of telephone numbers.

5. The smart card of claim 1, wherein the software instructions in the memory of the smart card are further configured to cause the processor to receive the candidate biometric trait from a remote biometric sensor.

6. The smart card of claim 1, wherein the software instructions in the memory of the smart card are further configured to cause the processor to selectively identify data stored on the smart card as unsecure data, wherein access to unsecure data is granted to an authenticated user and a non-authenticated user.

7. The smart card of claim 1, wherein the software instructions in the memory of the smart card are further configured to cause the processor to grant access to data stored on the smart card for a preset period of time after the user has been authenticated.

8. The smart card of claim 1, wherein the software instructions in the memory of the smart card are further configured to cause the processor to determine whether an application requesting access to data stored on the smart card requires the user to be authenticated, wherein the user is only prompted to complete the authentication process when the data request is received from an application that requires user authentication.

9. The smart card of claim 1, wherein the biometric sensor is a modular biometric sensor that may be replaced.

10. A method for controlling access to data stored in a smart card for use in a mobile device, comprising:

receiving a data access request for data stored in the smart card;

prompting a user to complete an authentication process, wherein said authentication process comprises;

prompting the user to use a biometric sensor to generate a candidate biometric trait;

comparing the candidate biometric trait with a biometric template stored in a memory; and

authenticating the user if the generated candidate biometric trait matches the biometric template stored in the memory; and

granting access to the data stored in the smart card only if the user is authenticated.

11. The method of claim 10, wherein the prompting the user to use a biometric sensor prompts the user to use a biometric sensor coupled directly to the smart card.

12. The method of claim 10, wherein the prompting the user to use a biometric sensor prompts the user to use a biometric sensor integrated in the smart card.

13. The method of claim 10, wherein the biometric trait and biometric template are both fingerprint images.

14. The method of claim 10, further comprising granting access to provisioning data stored in the smart card to both authenticated users and non-authenticated users;

wherein the access to provisioning information allows the mobile device to place and receive telephone calls to and from a limited number of telephone numbers.

15. The method of claim 14, wherein the limited number of telephone numbers include emergency service telephone numbers.

16. The method of claim 10, further comprising generating the candidate biometric trait at a remote biometric sensor. [I'"'"'m concerned this is way to broad and encompasses biometrically protected data as in laptop computers. I'"'"'d delete it.]

17. The method of claim 10 further comprising performing the authentication process in a server and sending an override signal to the mobile device if the user is authenticated, wherein receipt of the override signal by the mobile device enables access to the data stored in the smart card.

18. The method of claim 10 further comprising selectively identifying data stored on the smart card as unsecure data, wherein access to unsecure data is granted to an authenticated user and a non-authenticated user.

19. The method of claim 10, further comprising granting access to data stored on the smart card for a preset period of time after the user has been authenticated.

20. The method of claim 10, further comprising determine whether an application requesting access to data stored on the smart card requires the user to be authenticated, wherein the user is only prompted to complete the authentication process when the data request is received from an application that requires user authentication.

21. A smart card for storing data for use in a mobile device comprising:

means for receiving a data access request to access data stored in the smart card;

means for generating a candidate biometric trait and biometric template;

means for storing said biometric template;

means for prompting a user to use said means for generating the candidate biometric trait;

means for comparing the candidate biometric trait with the stored biometric template;

means for authenticating the user if the generated candidate biometric trait matches the stored biometric template; and

means for granting access to the data stored in the smart card if the user is authenticated.

22. The smart card of claim 21, wherein the means for generating the candidate biometric trait and biometric template generates fingerprint images.

23. The smart card of claim 21 further comprising means for granting access to provisioning data stored in the smart card to both authenticated users and non-authenticated users;

wherein the access to provisioning information allows the mobile device to place and receive telephone calls to and from a limited number of telephone numbers.

24. The smart card of claim 23 wherein the limited number of telephone numbers include emergency service telephone numbers.

25. The smart card of claim 21 further comprising means for generating the candidate biometric trait at a location remote from the mobile device.

26. The smart card of claim 21 further comprising means for receiving an override signal from a remote location, wherein receipt of the override signal enables access to the data stored in the smart card to both authenticated and non-authenticated users.

27. The smart card of claim 21 further comprising means for selectively identifying data stored on the smart card as unsecure data.

28. The smart card of claim 21 further comprising means for granting access to an authenticated user for a preset period of time.

29. A smart card for storing data for use in a mobile device comprising:

a smart card memory for storing the data for use in a mobile device; and

a smart card processor coupled to the memory; and

a biosensor module unit coupled to the smart card processor, wherein the biosensor module unit comprises;

a biometric sensor;

a biosensor module processor; and

a biosensor module memory coupled to the biosensor module processor, the biosensor module memory having stored therein software instructions configured to cause the biosensor module processor to perform the steps comprising;

receiving a data access request to access data stored in the smart card memory;

prompting a user via the mobile device to complete an authentication process, wherein said authentication process comprises;

prompting the user to use the biometric sensor to generate a candidate biometric trait;

comparing the candidate biometric trait with a biometric template stored in a memory unit; and

authenticating the user if the generated candidate biometric trait matches the biometric template stored in the memory unit; and

granting access to the data stored in the smart card memory only if the user is authenticated.

30. The smart card of claim 29 wherein the memory unit storing the biometric template is the biosensor module memory.

31. The smart card of claim 29 wherein the memory unit storing the biometric template is the smart card memory.

32. The smart card of claim 29, wherein the software instructions in the biosensor module memory are further configured to cause the processor to grant access to both authenticated and non-authenticated users;

wherein the access to provisioning information allows the mobile device to place and receive telephone calls to and from a limited number of telephone numbers.

33. The smart card of claim 29, wherein the software instructions in the biosensor module memory are further configured to cause the processor to receive the candidate biometric trait from a remote biometric sensor.

34. The smart card of claim 29, wherein the software instructions in the biosensor module memory are further configured to cause the processor to selectively identify data stored on the smart card memory as unsecure data, wherein access to unsecure data is granted to an authenticated user and a non-authenticated user.

35. The smart card of claim 29, wherein the software instructions in the biosensor module memory are further configured to cause the processor to grant access to data stored on the smart card for a preset period of time after the user has been authenticated.

36. The smart card of claim 29, wherein the software instructions in the biosensor module memory are further configured to cause the processor to determine whether an application requesting access to data stored on the smart card requires the user to be authenticated, wherein the user is only prompted to complete the authentication process when the data request is received from an application that requires user authentication.

37. A system for enabling and disabling an access control application within a smart card, comprising:

a mobile device configured to communicate via cellular wireless networks, the mobile device comprising a mobile device processor and mobile device memory in communication with the mobile device processor, wherein the mobile device memory has stored therein a number of applications for execution on the mobile device processor;

a smart card in communication with the mobile device processor, the smart card comprising a biometric sensor, and smart card memory, and a smart card processor in communication with the biometric sensor, the smart card memory and the mobile device processor,

wherein the smart card memory has stored therein data for use in the number of applications for execution on the mobile device processor and software instructions configured to cause the smart card processor to perform steps comprising;

receiving a data access request from any one of the number of applications to access data stored in the smart card;

prompting a user to complete an authentication process, wherein said authentication process comprises;

prompting the user submit to the biometric sensor to generate a candidate biometric trait;

comparing the candidate biometric trait with a biometric template stored in memory; and

authenticating the user if the generated candidate biometric trait matches the biometric template stored in memory; and

granting access to the data stored in the smart card only if the user is authenticated; and

an authentication server having a server processor coupled to a server memory, wherein the authentication server is configured to receive remotely generated candidate biometric traits and biometric templates for storage in the server memory to authenticate a remote user.

38. The system of claim 37 wherein the authentication server is further configured to transmit a signal via to the smart card processor to grant access to the data stored in the smart card if the remote user is authenticated by the authentication server.

39. The system of claim 37 wherein the authentication server is further configured to transmit a signal to the smart card processor to disable the authentication process.

40. The system of claim 37 wherein the server memory contains software instructions configured to cause the server processor to perform steps comprising:

receiving a remotely generated candidate biometric trait from the user;

comparing the remotely generated candidate biometric trait with a biometric template stored in server memory;

authenticating the user if the remotely generated candidate biometric trait matches the biometric template stored in server memory; and

transmitting a signal to the smart card processor to grant access to the data stored in the smart card.

41. The system of claim 37 wherein the server memory contains software instructions configured to cause the server processor to perform steps comprising:

receiving a remotely generated candidate biometric trait from the user;

comparing the remotely generated candidate biometric trait with a biometric template stored in server memory;

authenticating the user if the remotely generated candidate biometric trait matches the biometric template stored in server memory; and

transmitting a signal to the smart card processor to disable the authentication process.

42. The system of claim 37, further comprising a cellular telephone network, wherein the authentication server is configured to communicate with the mobile device via the cellular telephone network.

43. A server for remotely authenticating a user to access data stored on a smart card comprising;

a server memory; and

a server processor coupled to the server memory and configured to communicate via the Internet or cellular wireless network, wherein the processor is configured by processor-executable software instructions to perform steps comprising;

receiving a remotely generated candidate biometric trait from a mobile device owner;

comparing the remotely generated candidate biometric trait with a biometric template stored in server memory;

authenticating the user if the remotely generated candidate biometric trait matches the biometric template stored in the server memory; and

transmitting a signal to the owner'"'"'s mobile device via the cellular wireless network to disable a access control application contained in the mobile device'"'"'s smart card.

44. A server for remotely authenticating a user to access data stored on a smart card comprising;

a server memory; and

a server processor coupled to the server memory and configured to communicate via the Internet or cellular wireless network, wherein the processor is configured by processor-executable software instructions to perform steps comprising;

receiving a remotely generated candidate biometric trait from a mobile device owner;

comparing the remotely generated candidate biometric trait with a biometric template stored in server memory; and

authenticating the user if the remotely generated candidate biometric trait matches the biometric template stored in server memory; and

transmitting a signal to the owner'"'"'s mobile device via the cellular wireless network to grant access non-authenticated users to the data stored in the mobile device'"'"'s smart card.

45. A smart card, comprising:

an interface for connecting to a mobile device;

a memory module including nonvolatile memory;

a processor coupled to the memory module and the interface; and

a fingerprint scanner coupled to the processor, the fingerprint scanner comprising;

an optical path including a lens and a prism, the optical path configured to receive an image from a fingerprint;

an illuminator optically coupled to the optical path so as to illuminate a fingerprint imaged by the optical path;

an optical sensor optically coupled to the optical path so as to receive the image from the finger print;

an image generator coupled to the optical sensor and to the processor, the image generator configured to receive signals from the optical sensor, generate a fingerprint image based upon the received signals from the optical sensor, and send the generated fingerprint image to the processor,

wherein the processor is configured with software instructions to perform steps comprising;

receiving a candidate fingerprint image from the fingerprint scanner;

comparing the candidate fingerprint image to a fingerprint template stored in the memory module;

allowing access to data stored in the memory module if the candidate fingerprint image matches the fingerprint template stored in the memory module within an acceptable tolerance level; and

denying access to data stored in the memory module if the candidate fingerprint image does not match the fingerprint template stored in the memory module within an acceptable tolerance level.

46. The smart card of claim 45, wherein the fingerprint scanner is removably coupled to the processor

47. The smart card of claim 45, wherein the processor is further configured with software instructions to prompt the user to use a biometric sensor coupled directly to the smart card.

48. The smart card of claim 45, wherein the processor is further configured with software instructions to prompt the user to use a biometric sensor integrated in the smart card.

49. The smart card of claim 45, wherein the processor is further configured with software instructions to cause the processor to grant access to provisioning data stored in the memory module to both authenticated users and non-authenticated users;

wherein the access to provisioning information allows the mobile device to place and receive telephone calls to and from a limited number of telephone numbers.

50. The smart card of claim 45, wherein the processor is further configured with software instructions to cause the processor to receive the candidate biometric trait from a remote biometric sensor.

51. The smart card of claim 45, wherein the processor is further configured with software instructions to cause the processor to selectively identify data stored in the memory module as unsecure data, wherein access to unsecure data is granted to an authenticated user and a non-authenticated user.

52. The smart card of claim 45, wherein the processor is further configured with software instructions to cause the processor to grant access to data stored in the memory module for a preset period of time after the user has been authenticated.

53. The smart card of claim 45, wherein the processor is further configured with software instructions to cause the processor to determine whether an application requesting access to data stored in the memory module requires the user to be authenticated, wherein the user is only prompted to complete the authentication process when the data request is received from an application that requires user authentication.

54. A smart card, comprising:

an interface for connecting to a mobile device;

a smart card memory module including nonvolatile memory;

a smart card processor coupled to the memory module and the interface; and

a fingerprint module coupled to the processor comprising;

a fingerprint module interface for connecting to the smart card;

a fingerprint module memory unit including nonvolatile memory;

a fingerprint module processor coupled to the fingerprint module memory unit;

a fingerprint scanner coupled to the fingerprint module processor, the fingerprint scanner comprising;

an optical path including a lens and a prism, the optical path configured to receive an image from a fingerprint;

an illuminator optically coupled to the optical path so as to illuminate a fingerprint imaged by the optical path;

an optical sensor optically coupled to the optical path so as to receive the image from the finger print;

an image generator coupled to the optical sensor and to the fingerprint module processor, the image generator configured to receive signals from the optical sensor, generate a fingerprint image based upon the received signals from the optical sensor, and send the generated fingerprint image to the fingerprint module processor,

wherein the fingerprint module processor is configured with software instructions to perform steps comprising;

receiving a candidate fingerprint image from the fingerprint scanner;

comparing the candidate fingerprint image to a fingerprint template stored in a memory storage unit;

allowing access to data stored in the smart card memory module if the candidate fingerprint image matches the fingerprint template stored in the memory storage unit within an acceptable tolerance level; and

denying access to data stored in the smart card memory module if the candidate fingerprint image does not match the fingerprint template stored in the memory storage unit within an acceptable tolerance level.

55. The smart card of claim 54, wherein the memory storage unit is the fingerprint module memory unit.

56. The smart card of claim 54, wherein the memory storage unit is the smart card memory module.

57. The smart card of claim 54, wherein the fingerprint module is removably coupled to the smart card.

58. The smart card of claim 54, wherein the fingerprint module processor is further configured with software instructions to cause the fingerprint module processor to grant access to provisioning data stored in the smart card memory module to both authenticated users and non-authenticated users;

wherein the access to provisioning information allows the mobile device to place and receive telephone calls to and from a limited number of telephone numbers.

59. The smart card of claim 54, wherein the fingerprint module processor is further configured with software instructions to cause the fingerprint module processor to receive the candidate biometric trait from a remote biometric sensor.

60. The smart card of claim 54, wherein the fingerprint module processor is further configured with software instructions to cause the fingerprint module processor to selectively identify data stored in the memory module as unsecure data, wherein access to unsecure data is granted to an authenticated user and a non-authenticated user.

61. The smart card of claim 54, wherein the fingerprint module processor is further configured with software instructions to cause the fingerprint module processor to grant access to data stored in the memory module for a preset period of time after the user has been authenticated.

62. The smart card of claim 54, wherein the fingerprint module processor is further configured with software instructions to cause the fingerprint module processor to determine whether an application requesting access to data stored in the memory module requires the user to be authenticated, wherein the user is only prompted to complete the authentication process when the data request is received from an application that requires user authentication.

63. An access control card for regulating access to a mobile device, comprising:

a processor;

a biometric sensor coupled to the processor; and

a memory coupled to the processor, the memory having stored therein software instructions configured to cause the processor to perform steps comprising;

receiving an access request to use the mobile device;

prompting a user to use the biometric sensor to generate a candidate biometric trait;

comparing the candidate biometric trait with a biometric template stored in the memory;

authenticating the user if the generated candidate biometric trait matches the biometric template stored in the memory; and

allowing use of the mobile device only if the user is authenticated.

64. A mobile handset, comprising:

a processor;

a memory coupled to the processor;

an electrical connection slot configured to receive a biometric sensor card; and

a biometric sensor connected to the electrical connection,

wherein;

the electrical connection slot is configured to electrically connect the biometric sensor to the processor; and

the memory has stored therein software instructions configured to cause the processor to perform steps comprising;

receiving an access request to use the mobile device;

prompting a user to use the biometric sensor to generate a candidate biometric trait;

comparing the candidate biometric trait with a biometric template stored in the memory;

authenticating the user if the generated candidate biometric trait matches the biometric template stored in the memory; and

allowing use of the mobile device only if the user is authenticated.