DEVICE AND USER AUTHENTICATION

• US 20120033807A1
• Filed: 04/02/2010
• Published: 02/09/2012
• Est. Priority Date: 04/10/2009
• Status: Active Grant

• Current Assignee: Koninklijke Philips N.V.
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Asim, Muhammad, Merchan, Jorge Guajardo, Petkovic, Milan
• Granted Patent: US 9,031,231 B2
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G16H 10/65 stored on portable record carriers, e.g. on smartcards, RFID tags or CD
• CPC Class Codes: H04L 2209/88 Medical equipments
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A method of authenticating a device and a user comprises obtaining a device ID for the device, performing a biometric measurement of the user, obtaining helper data for the user, and generating a key from the biometric measurement and helper data. There is then generated a message comprising the key or a component derived from the key, which transmitted to a remote service, and at the service there is carried out the step of authenticating the device and the user with the message. In a preferred embodiment, the generating of the key further comprises generating the key from the device ID.

Claims

1. A method of authenticating a device (10, 12) and a user (20) comprising:

obtaining a device ID (32) for the device (10, 12),

performing a biometric measurement (30) of the user (20),

obtaining helper data (34) for the user (20),

generating a key (36) from the biometric measurement (30) and helper data (34),

generating a message (38) comprising the key (36) or a component derived from the key (36),

transmitting the message (38) to a remote service (18), and

authenticating the device and the user (20) with the message (38).

2. A method according to claim 1, wherein the step of generating a key (36) further comprises generating the key (36) from the device ID (32).

3. A method according to claim 1, and further comprising obtaining sensing data (40) for the user (20), and the component derived from the key (36) comprises the sensing data (40) processed with the key (36).

4. A method according to claim 1, and further comprising generating a codeword from the biometric measurement (30) and helper data (34), and checking that the device ID (32) matches the codeword.

5. A method according to claim 1, wherein the step of generating a message (38) further comprises including the helper data (34) for the user (20) in the message (38) and the step of authenticating the device (10, 12) and the user (20) comprises generating the key (36) from the helper data (34) and the device ID (32).

6. A method according to claim 1, and further comprising encrypting the device ID (32) with the key (36) and wherein the component derived from the key (36) comprises the encrypted device ID (32).

7. A method according to claim 1, and further comprising including in the message (38) the device ID (32) and/or a user ID.

8. A system for authenticating a device (10, 12) and a user (20) comprising:

a measurement apparatus (26) arranged to perform a biometric measurement (30) of the user (20), and

a processor (28) arranged to

obtain a device ID (32) for the device (10, 12),

obtain helper data (34) for the user (20),

generate a key (36) from the biometric measurement (30) and helper data (34),

generate a message (38) comprising the key (36) or a component derived from the key (36), and

transmit the message (38) to a remote service (18).

9. A system according to claim 8, wherein the processor (28) is further arranged, when generating the key (36), to generate the key (36) from the device ID (32).

10. A system according to claim 8, and further comprising a sensing device (10, 12) arranged to obtain sensing data (40) for the user (20), and wherein the component derived from the key (36) comprises the sensing data (40) processed with the key (36).

11. A system according to claim 8, wherein the processor (28) is further arranged to generate a codeword from the biometric measurement (30) and helper data (34), and to check that the device ID (32) matches the codeword.

12. A system according to claim 8, wherein the processor (28) is further arranged, when generating a message (38), to include the helper data (34) for the user (20) in the message (38).

13. A system according to claim 8, wherein the processor (28) is further arranged, to encrypt the device ID (32) with the key (36) and wherein the component derived from the key (36) comprises the encrypted device ID (32).

14. A system according to claim 8, wherein the processor (28) is further arranged to include in the message (38) the device ID (32) and/or a user ID.