Biometric-based authentication in a nonvolatile memory device

• US 7,389,425 B2
• Filed: 06/14/2004
• Issued: 06/17/2008
• Est. Priority Date: 06/27/2000
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Brizek, John P., Hasbun, Robert N., Vogt, James R.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Brown; Christopher J
• Application Number:
  US10/867,472
• Publication Number:
  US 20040236954A1
• Time in Patent Office: 1,464 Days
• Field of Search: 713/186, 726/27
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06V 10/94 Hardware or software architectures specially adapted for image or video understanding
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition

Abstract

A biometric-based security circuit in which the user database, processor, and biometric map generation functions are all located on the same integrated circuit whose secure contents are inaccessible from external to the integrated circuit. Biometric data, such as a fingerprint, retina scan, or voiceprint, is taken from a user requesting access to restricted resources. The biometric data is transferred into the integrated circuit, where it is converted to a biometric map and compared with a database of biometric maps stored in a non-volatile memory in the integrated circuit. The stored maps represent pre-authorized users, and a match triggers the security circuit to send a signal to a host processor authorizing the host processor to permit the requesting user access to the restricted resources. The integrated circuit essentially serves as a write-only memory for the secure data, because the secure data and security functions in the integrated circuit are not directly accessible through any pin or port, and therefore cannot be read or monitored through a dedicated security attack. A second non-volatile memory, accessible from external to the integrated circuit, can also be provided in the integrated circuit for holding non-secure data. This second memory has its own interface port, and is isolated from the security-related functions and memory so that secure and non-secure functions are physically isolated from each other and cannot be modified to overcome that isolation.

Claims

1. An apparatus, comprising:

an integrated circuit including;

a first processor;

a first interface coupled to the first processor to communicate with a second processor external to the integrated circuit;

a first non-volatile memory decoupled from the first interface and coupled to the first processor to store first biometric data identifying at least one authorized user, and having contents that are unreadable external to the integrated circuit;

a second interface coupled to the first processor to input second biometric data from a biometric reader; and

a second non-volatile memory coupled to a third interface and decoupled from the first processor, first interface, second interface, and first non-volatile memory, and having contents that are accessible external to the apparatus through the third interface.

2. The apparatus of claim 1, wherein the first non-volatile memory is a flash memory.

3. The apparatus of claim 1, wherein the second non-volatile memory is a flash memory.

4. The apparatus of claim 1, wherein the biometric reader is a fingerprint reader.

5. The apparatus of claim 1, wherein:

the first biometric data includes a first biometric map; and

the integrated circuit contains includes code to cause the first processor to convert the second biometric data to a second biometric map.

6. The apparatus of claim 5, wherein the integrated circuit contains code to cause the first processor to perform a comparison between the second biometric map and the first biometric map.

7. The apparatus of claim 6, wherein:

the integrated circuit contains includes code to cause the first processor to send a verification signal through the first interface if a match is found in the comparison; and

the integrated circuit contains code to cause the first processor to send a non-verification signal through the first interface if a match is not found in the comparison.

8. The apparatus of claim 1, wherein the integrated circuit contains code to cause the first processor to authenticate a program downloaded into the integrated circuit.

9. A system, comprising:

a host processor;

a biometric reader;

an integrated circuit coupled to the biometric reader and host processor including;

a first processor;

a first interface coupled to the first processor and the host processor;

a first non-volatile memory decoupled from the first interface and coupled to the first processor to store first biometric data identifying at least one authorized user, and having contents that are unreadable external to the integrated circuit;

a second interface coupled to the first processor and the biometric reader to input second biometric data; and

a second non-volatile memory coupled to the host processor through a third interface and decoupled from the first processor, first interface, second interface, and first non-volatile memory, and having contents that are accessible external to the apparatus through the third interface.

10. The system of claim 9, wherein:

the first biometric data includes a first biometric map; and

the integrated circuit contains code to cause the first processor to convert the second biometric data to a second biometric map.

11. The system of claim 10, wherein the integrated circuit contains code to cause the first processor to perform a comparison between the second biometric map and the first biometric map.

12. The system of claim 11, wherein:

the integrated circuit contains code to cause the first processor to send a verification signal through the first interface if a match is found in the comparison; and

the integrated circuit contains code to cause the first processor to send a non-verification signal through the first interface if a match is not found in the comparison.

13. The system of claim 9, wherein the integrated circuit contains code to cause the first processor to authenticate a program downloaded into the integrated circuit.

14. A system comprising:

biometric reader; and

a first processor;

a security circuit including;

a second processor;

a first interface coupled to the second processor to input biometric data;

a first non-volatile memory coupled to the second processor to store second biometric data identifying at least one authorized user, and having contents that are unreadable external to the security circuit;

a second interface coupled to the second processor to communicate with the first processor;

a third interface coupled to the second processor; and

a second non-volatile memory coupled to the third interface and decoupled from the second processor, first interface, second interface and first non-volatile memory, having contents that are accessible external to the security circuit through the second interface.