METHOD FOR AUTHENTICATION AND VERIFYING INDIVIDUALS AND UNITS

• US 20110055906A1
• Filed: 11/17/2008
• Published: 03/03/2011
• Est. Priority Date: 02/22/2008
• Status: Abandoned Application

• Current Assignee: Fachhochschule Schmalkalden
• Original Assignee: Fachhochschule Schmalkalden
• Inventors: Rozek, Jan, Rozek, Thomas, Rozek, Werner
• Application Number:
  US12/918,539
• Publication Number:
  US 20110055906A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A method is provided for authenticating and verifying individuals and units, wherein the data exchange between the units proceeds by means of relative data and/or encrypted data. The method is characterized in that the authentication and/or verification processes of individual and/or units are carried out by units that are allocated to individuals or that the authentication and/or verification processes of individuals and/or units are carried out by units authorized to authenticate and/or verify, a unit being authorized to authenticate and/or verify by the transmission of at least one copy of a power by a unit allocated to an individual through the unit allocated to the individual once the owner of the unit allocated to an individual is authenticated.

Claims

1. A method for authentication and authentification of persons and units, wherein data exchange is performed between units by means of relative data and/or encrypted data, comprising:

performing the authentication and/or authentification of persons and/or units using personal units, or

performing the authentication and/or authentification of persons and/or units using units authorized for authentication and/or authentification, wherein a unit is authorized for authentication and/or authentification by having transferred to it at least one authorization copy from a personal unit by said personal unit after authentication of the possessor of said personal unit.

2. The method according to claim 1, wherein:

the authorization copy is at least one identifying data element of a person or a personal unit, or each are a identifying data element of a person or of a personal unit, and/or

the authentication and authentification of a person and/or a unit is performed in conjunction with a personal unit by means of data identifying the person and/or the unit, wherein authentication is performed with at least one data element via a worldwide unique characteristic which is inseparably combined with the person and/or the unit,

all of the data identifying the person are unalterably stored in the personal unit,

the data element identifying a unit is unalterably defined with the characteristic inseparably combined with the unit, or that the data identifying a unit are unalterably defined with the characteristics inseparably combined with the unit, and are unalterably stored in the unit,

the authenticity of a person and hence an attribution of the possessor of the personal unit is only verified in conjunction with the personal unit,

the identifying data used for verification have at least one secret random data element which is only defined in conjunction with the personal unit,

upon each new authentification, the identifying data element or the identifying data is or are provided with at least one new random data element in conjunction with the personal unit of the sender,

the transmission of the identifying data provided with at least one random data element only occurs in form of relative data,

the calculation of the relative data upon each new exchange is performed with at least one new random reference data element within dynamically changing spaces,

at least a part of the random reference data and/or spatial data are randomly generated by the transmitting unit,

the transmission of the random reference data and/or spatial data generated in the transmitting unit is performed with relative data,

the transmitting unit, by data interlacing and/or permutations, makes it impossible for a third party to associate the relative data in the transmitted data stream, wherein a data receiving unit extracts a part of the data interlace information from a part of the relative data and/or from a global random reference data element present in each unit and valid for a time interval,

the data receiving unit calculates the absolute data for all of the transferred relative data from the transferred relative data with reference to the random reference data within dynamically changing spaces,

the verification or verifications of the transferred identifying data is or are performed by the data receiving unit only in conjunction with the personal unit of the recipient, and

by verifying the validity and authenticity of the identifying data of the recipient by the data receiving unit and/or the personal unit of the recipient, the validity and authenticity of the identifying data of the sender is concurrently verified.

3. The method according to claim 2 wherein:

he identifying data used for authentication of a person are biometrical data, and/or the identifying data used for authentification of a person are address data comprising at least one address data element and identity data element and/or a personal identity number; and

/or

the identifying data element used for authentification of a unit is a worldwide unique device number; and

/or

at least one random reference data element is a random number and at least one other separate random reference data element is a part of at least one global random reference data element which is valid for all of the units and for a time interval, wherein the separate random reference data element is randomly extracted from the global random reference data element and the position of extraction is recorded in at least one first position data element; and

/or

in function of a position data element from the global random reference data element, other data are read, for calculating spatial coordinates and/or as a data interlace information; and

/or

the secret data interlace information intended for the identifying data is randomly extracted from the global random reference data element and/or from at least one random number generated in the transmitting unit, wherein the position of reading of the secret data interlace information is identified by at least one position data element, and

the position data are transmitted in at least one relative data element.

4. The method according to claim 2, wherein:

one secret random data element is interlaced into each identifying data element; and

/or

one secret random data element is interlaced into each of two data of the address data of the sender and the recipient, or one secret random data element is interlaced into each of the address data of the sender and of the recipient, or that one secret random data element is interlaced into the address and identity data element of the sender and the recipient.

5. The method according to claim 4, wherein:

the data interlace information are data of a random number, and/or data of the global random reference data element, and/or data of a separate random reference data element extracted from the global random reference data element, and comprise at least the secret random data element to be interlaced and the interlace control data element,

one bit of the secret random data element to be interlaced is inserted into the bit data stream of the respective data element of the address data when the bit in the interlace control data element is one or zero, and

bit interlacing is terminated when all of the bits of the random data element have been interlaced into the bit data stream of the respective data element of the address data, or when all of the bits of the secret random data element that have not yet been interlaced until the end of the bit data stream have been attached to the end of the bit data stream.

6. The method according to claim 2, wherein, for the concurrent authenticity and validity verification of the address data of the sender and the recipient, the transmitting unit calculates at least one relative data element of the address data of the recipient with reference to at least one data element of the sender.

7. The method according to claim 6, wherein:

the interlaced sender address data element is referenced to at least one random reference data element, and the interlaced recipient address data element is referenced to at least one random data element related to the interlaced sender address data element, and the interlaced sender identity data element is referenced to at least one random data element related to the interlaced recipient address data element, and the interlaced recipient identity data element is referenced to at least one random data element related to the interlaced sender identity data element; and

the random data related to the interlaced address data element and/or to the interlaced identity data element are the results of coordinate related and bit-wise executed exclusive OR combining operations between the interlaced address data used as position vectors and the random number or random numbers used as position vector(s).

8. The method according to claim 3, wherein:

the personal unit predefines at least one position data element or all of the position data or at least the second position data element; and

/or

the personal unit of the recipient performs authentification by comparing the transferred identifying data of the recipient with the authorized identifying data that are unalterably stored in the personal unit, and/or by comparing the de-interlaced random data, wherein if a match occurs as a result in all comparisons, the recipient and the sender are authenticated.

9. The method according to claim 2, wherein:

the authentication and/or authentification of a person and/or a unit is delegated to a unit, by a person in conjunction with the personal unit of said person;

said delegation comprises at least transferring a position data element and transferring a copy of authorization of the identifying data in the personal unit, to the unit intended to perform authentication and/or authentification henceforth;

the unit intended to perform authentication and/or authentification henceforth unalterably stores any position data related to the copy of authorization, and the identifying data transferred, and becomes a unit authorized for authentication and/or authentification, by a predefined action of the person who passes the copy of authorization; and

the unit authorized for authentification performs authentification by comparing the transferred identifying data of the recipient with the authorized identifying data that are unalterably stored in the authorized unit, and/or by comparing the de-interlaced random data, wherein if a match occurs as a result in all comparisons, the recipient and the sender are authenticated.

10. The method according to claim 1, wherein:

the data identifying a person are address data, and/or signature data, and/or data allocated to the person;

that said identifying data are unalterably stored in the personal unit;

said identifying data are interlaced with at least one random data element in the personal unit,

the data interlace information are data of a random number, and/or data of a global random reference data element, and/or data of separate random reference data which are read from a global random reference data element that is provided in all units and is valid for a randomly predefined time interval;

the position of reading is predefined with reference to the second position data element,

the respective interlaced identifying data element is transmitted to the data receiving unit as a relative data element together with the other relative data,

the data receiving unit determines, from said relative data, the identifying data element or the identifying data and the position data element, determines the data interlace information by means of said position data element, de-interlaces the interlaced identifying data therewith, and compares the respective de-interlaced random data element with the allocated data element from the random number and/or the random reference data element; and

if a match occurs between all of the de-interlaced and allocated random data, the authenticity of the respective identifying data element is detected.

11. The method according to claim 10, wherein the data allocated to a person are at least one of a social insurance number, tax number, account number, card validity data, card number, commercial register number, association register number, cooperation register number, certification data element, and at least one data element of the certifying authority.

12. The method according to claim 2, wherein:

the data identifying a person are imported into a unit identifying said person during an instruction process, and are unalterably stored in said unit identifying the person, wherein the instruction process is performed by a person authorized for instruction;

or

the data identifying a person and at least one certification date and/or card validity date are imported into a unit identifying said person during an instruction process, and are unalterably stored in said unit identifying the person, wherein the instruction process is performed by a person authorized for instruction.

13. The method according to claim 12, wherein:

in the instruction process, biometrical data and/or signature data are imported and stored as said data identifying a person,

the biometrical data and/or signature data are imported at least a second time, and are compared with the stored data,

upon a match thereof, the instruction process for the data identifying a person is terminated and the unit identifying a person is enabled, and is allocated to the person as a personal unit, and

by enabling the personal unit, the data identifying the person, and/or the data identifying the personal unit, and the certification data and card validity data are authenticated.

14. The method of claim 13, wherein:

in another instruction process, following successful authentication of the person possessing the personal unit, the personal data are imported into the personal unit by said personal unit, and are stored in said personal unit in a manner unalterably by a third party, and

a modification of the personal data can only be executed following successful authentication of the person possessing the personal unit.

15. The method according to claim 9, wherein:

the transfer of an authorization copy to an authorized unit is stored in an authorization table; and

the authorization table comprises at least the authorized data of the data identifying a person, and/or the authorized data of the personal unit, and/or the personal data, and/or a position data element, and/or the calendar date and/or the time of authorization, and/or the calendar date and/or the time of deletion of the authorization, and/or

the copy of authorization of the authorized unit can be deprived by the person having passed the authorization, after authentication of the person attributed to the authorization, and/or

each action related to the authorization has to be acknowledged by an action of the person attributed to said authorization, and/or

said authorization table is related to a data exchange table in the unit that is to transmit data, which table contains definitions about the data to be transmitted,

said definitions comprise the data to be transmitted, and/or the calendar date and the times of transmissions, and the identifying data of the recipient, and/or

the authorization table in the data receiving unit is related to a data reception table which contains definitions about the data to be received,

said definitions include the data to be received, and/or the calendar date of reception, and the data identifying the sender, and/or

each transfer of an authorization copy to a unit performing authentication and/or authentification is logged and stored in the personal unit of the person attributed to the authorization, and

the contents of the log comprise at least the calendar date and/or the time of the transfer of authorization, and/or the identifying data element of the authorized unit, and/or das calendar date and/or the time of deprivation of authorization or deletion of authorization.

16. The method according to claim 1 wherein the personal unit is a secure electronic card and serves as an identity card and/or service identity card and/or employee identity card and/or user identity card and/or health insurance card for the cyberspace.