Secure management of a smart card

• US 9,251,330 B2
• Filed: 04/09/2014
• Issued: 02/02/2016
• Est. Priority Date: 04/09/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Boivie, Richard H., Friedlander, Robert R., Kraemer, James R., Linton, Jeb R.
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US14/249,001
• Publication Number:
  US 20150294095A1
• Time in Patent Office: 664 Days
• Field of Search: 726/19, 713/189, 380/200
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06K 19/06037 multi-dimensional coding
• CPC Class Codes: G06K 19/06112 the marking being simulated using a light source, e.g. a barcode shown on a display or a laser beam with time-varying intensity profile
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

A smart card comprises: a processing circuit; a memory that contains a protected object; an activity detector that receives a signal that describes a planned activity of a person who is in physical possession of the smart card; and an activity analyzer that evaluates features of the planned activity. In response to the activity analyzer determining that a predefined risk associated with the planned activity exceeds a predetermined value, the activity analyzer: issues an instruction to the person who is in physical possession of the smart card to provide a biomarker to a biosensor that is physically contained within the smart card; and receives, from the biosensor, real-time biometric data for the person who is in physical possession of the smart card.

Claims

1. A smart card comprising:

a processing circuit;

a memory, wherein the memory contains a protected object, wherein the protected object initially cannot be utilized in its protected state by the processing circuit within the smart card;

an activity detector, wherein the activity detector receives a signal that describes a planned activity of a person who is in physical possession of the smart card;

an activity analyzer, wherein the activity analyzer evaluates features of the planned activity, and wherein, in response to the activity analyzer determining that a predefined risk associated with the planned activity exceeds a predetermined value, the activity analyzer;

issues an instruction to the person who is in physical possession of the smart card to provide a biomarker to a biosensor that is physically contained within the smart card, wherein the biosensor is a camera, and wherein the biomarker is a digital photograph of the person who is in physical possession of the smart card; and

receives, from the biosensor, real-time biometric data for the person who is in physical possession of the smart card;

a receiving device, wherein the receiving device receives a security object;

a blending logic, wherein the blending logic combines the real-time biometric data with the security object to generate a hybrid security object;

a conversion logic, wherein the conversion logic uses the hybrid security object to convert the received protected object into a usable object that can be utilized by the processing circuit within the smart card;

a photo memory, wherein the photo memory comprises a previous digital photograph of a person who is authorized to be in physical possession of the smart card, wherein the previous digital photograph was taken before the biomarker was taken;

a comparison logic, wherein the comparison logic compares the previous digital photograph and the biomarker;

a blocking logic, wherein the blocking logic prevents the conversion logic from creating the usable object in response to the previous digital photograph failing to match the biomarker;

a matrix barcode generator, wherein the matrix barcode generator generates a matrix barcode that contains payment information, identification information, and authorization information for the person who is in physical possession of the smart card; and

a display, wherein the display displays the matrix barcode on the smart card.

2. The smart card of claim 1, wherein the planned activity is a planned financial transaction, and wherein the smart card further comprises:

a physical positioning logic, wherein the physical positioning logic identifies a physical location of the smart card in real-time; and

a financial transaction logic, wherein the financial transaction logic combines with the activity analyzer to determine that the predefined risk associated with the planned activity exceeds the predetermined value in response to the physical positioning logic determining that the smart card is at a physical location that has been predetermined to be incongruous with the planned financial transaction.

3. The smart card of claim 1, wherein the person who is in physical possession of the smart card is a particular worker, wherein the planned activity is an equipment maintenance/operation, and wherein the smart card further comprises:

a worker evaluation logic, wherein the worker evaluation logic identifies an activity that has been preauthorized to be performed by the particular worker; and

an activity approval logic, wherein the activity approval logic blocks the conversion logic from creating the hybrid security object in response to the equipment maintenance/operation failing to match the activity that has been preauthorized to be performed by the particular worker.

4. The smart card of claim 1, further comprising:

a rescission command logic, wherein, in response to the smart card receiving a rescission command, the rescission command logic executes the rescission command to deactivate the security object, wherein deactivating the security object prevents future executions of the protected object.

5. The smart card of claim 1, wherein the protected object is stored in a protected region of memory within the smart card, wherein the hybrid security object provides access to the protected region of the memory within the smart card, and wherein the smart card further comprises:

a memory access logic that utilizes the hybrid security object to access the protected object within the protected region of the memory within the smart card.

6. A method of managing a smart card, the method comprising:

storing, in a memory, a protected object, wherein the protected object initially cannot be utilized in its protected state by the processing circuit within the smart card;

receiving, by an activity detector, a signal that describes a planned activity of a person who is in physical possession of the smart card;

analyzing, by an activity analyzer, features of the planned activity, wherein, in response to the activity analyzer determining that a predefined risk associated with the planned activity exceeds a predetermined value, the activity analyzer;

issues an instruction to the person who is in physical possession of the smart card to provide a biomarker to a biosensor on the smart card, wherein the biosensor is a camera, and wherein the biomarker is a digital photograph of the person who is authorized to be in physical possession of the smart card; and

receives, from the biosensor, real-time biometric data for the person who is in physical possession of the smart card;

receiving, by a receiving device, a security object;

combining, by a blending logic, the real-time biometric data with the security object to generate a hybrid security object;

converting, by a conversion logic that uses the hybrid security object, the received protected object into a usable object that can be utilized by the processing circuit within the smart card;

storing, in a photo memory, a previous digital photograph of the person who is authorized to be in physical possession of the smart card, wherein the previous digital photograph was taken before the biomarker was taken;

comparing, by a comparison logic, the previous digital photograph and the biomarker;

blocking, by a blocking logic, the conversion logic from creating the usable object in response to the previous digital photograph failing to match the biomarker;

generating, by a matrix barcode generator, a matrix barcode that contains payment information, identification information, and authorization information for the person who is in physical possession of the smart card; and

displaying, on a display on the smart card, the matrix barcode.

7. The method of claim 6, wherein the planned activity is a planned financial transaction, and wherein the method further comprises:

identifying, by a physical positioning hardware device, a physical location of the smart card in real-time; and

determining, by a financial transaction logic and the activity analyzer, that the predefined risk associated with the planned activity exceeds the predetermined value in response to the physical positioning logic determining that the smart card is at a physical location that has been predetermined to be incongruous with the planned financial transaction.

8. The method of claim 6, wherein the person who is in physical possession of the smart card is a particular worker, wherein the planned activity is an equipment maintenance/operation, and wherein the method further comprises:

identifying, by a worker evaluation logic, an activity that has been preauthorized to be performed by the particular worker; and

blocking, by an activity approval logic, the conversion logic from creating the hybrid security object in response to the equipment maintenance/operation failing to match the activity that has been preauthorized to be performed by the particular worker.

9. The method of claim 6, further comprising:

executing, in response to the smart card receiving a rescission command, a rescission command to deactivate the security object, wherein deactivating the security object prevents future executions of the protected object.

10. The method of claim 6, wherein the protected object is stored in a protected region of memory within the smart card, wherein the hybrid security object provides access to the protected region of the memory within the smart card, and wherein the method further comprises:

utilizing, by a memory access hardware logic, the hybrid security object to access the protected object within the protected region of the memory within the smart card.

11. A computer program product for managing a smart card, the computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, the program code readable and executable by one or more processors to perform a method comprising:

storing, in a memory, a protected object, wherein the protected object initially cannot be utilized in its protected state by the processing circuit within the smart card;

receiving, by an activity detector, a signal that describes a planned activity of a person who is in physical possession of the smart card;

analyzing, by an activity analyzer, features of the planned activity, wherein, in response to the activity analyzer determining that a predefined risk associated with the planned activity exceeds a predetermined value, the activity analyzer;

issues an instruction to the person who is in physical possession of the smart card to provide a biomarker to a biosensor on the smart card, wherein the biosensor is a camera, and wherein the biomarker is a digital photograph of the person who is authorized to be in physical possession of the smart card; and

receives, from the biosensor, real-time biometric data for the person who is in physical possession of the smart card;

receiving, by a receiving device, a security object;

combining, by a blending logic, the real-time biometric data with the security object to generate a hybrid security object;

converting, by a conversion logic that uses the hybrid security object, the received protected object into a usable object that can be utilized by the processing circuit within the smart card;

storing, in a photo memory, a previous digital photograph of the person who is authorized to be in physical possession of the smart card, wherein the previous digital photograph was taken before the biomarker was taken;

comparing, by a comparison logic, the previous digital photograph and the biomarker;

blocking, by a blocking logic, the conversion logic from creating the usable object in response to the previous digital photograph failing to match the biomarker;

generating, by a matrix barcode generator, a matrix barcode that contains payment information, identification information, and authorization information for the person who is in physical possession of the smart card; and

displaying, on a display on the smart card, the matrix barcode.

12. The computer program product of claim 11, wherein the method further comprises:

receiving, by a receiving device, an instruction to perform a predefined physical manipulation of the smart card; and

in response to the person who is in physical possession of the smart card performing the predefined physical manipulation of the smart card, converting, by a conversion logic that uses the hybrid security object, the received protected object into a usable object that can be utilized by the processing circuit within the smart card.