METHOD AND ARRANGEMENT FOR SECURE USER AUTHENTICATION BASED ON A BIOMETRIC DATA DETECTION DEVICE

• US 20100049987A1
• Filed: 12/19/2006
• Published: 02/25/2010
• Est. Priority Date: 12/19/2006
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: Rabbini, Alessandro, Licciardi, Luigi, Ettorre, Donato, Turolla, Maura, Varriale, Antonio
• Granted Patent: US 8,955,083 B2
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An arrangement for secure user authentication includes a computer or telecommunication terminal with a smartcard and a device. The smartcard is adapted to securely store biometric information relating to at least one user and the device is adapted to detect biometric data of users. The smartcard and the device include a radio interface for communicating together and a module for exchanging biometric information between each other. In this way, tampering of the transferred biometric information is difficult. In order to increase the security, one or more of the following measures may be used: a secure communication channel between the device and the smartcard, a direct (preferably short range) communication channel between the device and the smartcard and encryption and decryption of biometric information transferred between the device and the smartcard.

Claims

1-27. -27. (canceled)

28. An arrangement for secure user authentication comprising a user terminal with a smartcard and a device, wherein the smartcard is adapted to securely store biometric information relating to at least one user, and wherein the device is adapted to detect biometric data of users, the smartcard and the device comprising a radio interface for communicating together and a module for exchanging biometric information between each other.

29. The arrangement according to claim 28, wherein said module is adapted to establish a direct secure communication channel between said smartcard and said device.

30. The arrangement according to claim 28, wherein said smartcard and/or said device comprise a module for encrypting and/or decrypting biometric information.

31. The arrangement according to claim 28, wherein said smartcard is a telecommunication subscriber identification module.

32. The arrangement according to claim 28, wherein said radio interface is of the ZigBee™

type.

33. The arrangement according to claim 28, wherein the radio interface of said device is adapted to stay in power save mode and to be woken periodically.

34. The arrangement according to claim 28, wherein said device is portable and is external to said user terminal.

35. The arrangement according to claim 28, wherein said biometric data correspond to fingerprint data and said biometric information corresponds to biometric templates.

36. The arrangement according to claim 28, wherein said device comprises a read-only memory storing one device identification code.

37. The arrangement according to claim 28, wherein said smartcard comprises a read-only memory securely storing one encryption key associated with the smartcard.

38. The arrangement according to claim 28, wherein said device and said smartcard comprise a read-only memory storing an encryption key for encrypting a communication channel therebetween.

39. The arrangement according to claim 28, wherein said device comprises a memory having a storage capacity for at least one encryption key associated with the device.

40. A method for authenticating at least one user of a user terminal comprising the steps of:

providing a device adapted to detect biometric data of users and comprising a device radio interface; and

providing in said user terminal a smartcard adapted to securely store biometric information relating to at least one user and comprising a smartcard radio interface,

wherein the device radio interface and the smartcard radio interface are adapted to communicate between each other; and

wherein the authentication of said at least one user is obtained by the steps of;

A) detecting biometric data by means of said device;

B) deriving biometric information from said detected biometric data;

C) transferring said derived biometric information from said device to said smartcard or said stored biometric information from said smartcard to said device; and

D) comparing said derived biometric information with said stored biometric information.

41. The method according to claim 40, wherein said smartcard is adapted to securely store biometric information relating to a plurality of users.

42. The method according to claim 40, comprising a configuration phase wherein said device and said smartcard mutually authenticate.

43. The method according to claim 42, wherein said configuration phase is capable of providing stored information related to said smartcard to said device.

44. The method according to claim 43, wherein said configuration phase is capable of detecting biometric data of a primary user through said device and securely storing biometric information derived from said detected biometric data of said primary user to said smartcard.

45. The method according to claim 44, wherein said configuration phase is capable of detecting biometric data of at least one secondary user through said device and securely storing biometric information derived from said detected biometric data of said at least one secondary user to said smartcard.

46. The method according to claim 45, wherein storage and/or removal of biometric information relating to at least one secondary user is enabled by said primary user.

47. The method according to claim 45, wherein said smartcard associates with said primary user, a first set of privileges, and with said secondary user, a second set of privileges, the privileges of said first set being higher than the privileges of said second set.

48. The method according to claim 42, further comprising a configuration phase, wherein information related to said smartcard is stored in at least a second device.

49. The method according to claim 40, wherein step C) provides establishing a direct secure communication channel between said smartcard and said device.

50. The method according to claim 40, wherein the radio interface of said device stays in power save mode and is woken periodically in order to communicate with said smartcard.

51. The method according to claim 40, wherein step C) provides to first encrypt and then decrypt biometric data or biometric information.

52. The method according to claim 40, wherein, during a configuration phase, an encryption key is generated based on information related to said smartcard and on information related to said device, and is stored in said device and in said smartcard for encryption/decryption use or for encrypting a communication channel between them.

53. A method for providing a service to a user through a user terminal, wherein the service requires authentication of the user, comprising a method for authenticating the user by the method of claim 40.

54. The method according to claim 53, wherein the service provides for a commercial transaction and implies communication of the user terminal with an application server, the user terminal and the application server being connected through a telecommunication network.