Method, arrangement and secure medium for authentication of a user

• US 20040107367A1
• Filed: 11/26/2003
• Published: 06/03/2004
• Est. Priority Date: 02/09/2001
• Status: Active Grant

• Current Assignee: Human Bios GmbH
• Original Assignee: Human Bios GmbH
• Inventors: Kisters, Friedrich
• Granted Patent: US 7,447,910 B2
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

When confidential data or areas of an EDP system (2) are accessed by a user (9), the user is granted access only if he registers (16) with the EDP system correctly with a user name and a password and, in addition, can identify himself as having access authorization using an access code (21), to which only he has access, from a database (5.2). The database is stored on a chip card (5), and access to the database has dual protection. Access to the access codes in the database is given only to that user who can correctly authenticate himself (12) to the chip card using biometric data, for example. In addition, the access codes in the database can be accessed only by a program (5.1) which is stored on the chip card and which can be activated only following correct authentication to the chip card by the user and which needs to have correctly authenticated itself (20) directly on the database using an ID incorporated in the program code.

Claims

1. Method for authenticating a user for access to protected areas, where an access code is read from a database stored on a security medium, particularly a chip card, and is transmitted to a data processing apparatus, characterized in that the user is authenticated before the access code is read, a mediator program, particularly a Java program, is started, a card program stored on the security medium is asked by the mediator program to read the access code, the mediator program is authenticated by the security medium, and, if the mediator program and the user have been correctly authenticated, the access code is read from the database by the card program, is transferred to the mediator program and is transmitted to the data processing apparatus by the mediator program.

2. Method according to claim 1, characterized in that the card program authenticates itself on the database, and the database does not read an access code and/or deletes itself or is deleted if the card program does not correctly authenticate itself.

3. Method according to claim 1 or 2, characterized in that the mediator program acknowledges receipt of the access code to the card program, and the card program deletes the access code from the database afterwards.

4. Method according to one of claims 1 to 3, characterized in that the user is authenticated by virtue of user-specific identification features, preferably biometric user data, being ascertained and these features being compared, particularly by the security medium, with user identification features stored on the security medium beforehand.

5. Method according to one of claims 1 to 4, characterized in that the data processing apparatus is accessed via a public communication network, where communication between the user and the data processing apparatus is encrypted and the encryption is performed using an asymmetric encryption method, particularly a public key method, and the user preferably inputs a user name and a password in order to access the data processing apparatus.

6. Method according to one of claims 1 to 5, characterized in that the data processing apparatus checks the access code transmitted by the mediator program, and the user is permitted to access the, particularly confidential, data or areas if the check was successful.

7. Arrangement for authenticating a user for access to protected areas, comprising a data processing apparatus for authenticating the user, a security medium and first means for accessing the security medium, the security medium having a processor and a memory, characterized in that the memory stores a database having a plurality of access codes, a program for accessing the database and user-specific identification features for a user, in that an access code can be read from the database exclusively by the program, and the security medium has means for authenticating a mediator program which asks the program to read the access code, in that the arrangement has second means for ascertaining user-specific identification features, preferably biometric user data, and the arrangement has third means for comparing the ascertained user-specific identification features with the user-specific identification features stored on the security medium.

8. Arrangement according to claim 7, characterized in that the second and third means are integrated in the security medium.

9. Arrangement according to claim 7, characterized in that the third means are integrated in the security medium and the second means are integrated in the first means.

10. Arrangement according to one of claims 7 to 9, characterized in that the memory stores information for identifying the user.

11. Arrangement according to one of claims 7 to 10, characterized in that the security medium has fourth means for deleting the database if it is accessed for misuse.

12. Security medium for authenticating a user for access to protected areas, comprising a processor and a memory, characterized in that the memory stores a database having a plurality of access codes, an individual program and user-specific identification features for a user, an access code can be read from the database exclusively by the individual program, and the security medium has means for authenticating a mediator program which asks the individual program to read an access code.

13. Security medium according to claim 12, characterized in that it has means for determining user-specific identification features and also means for comparing the user-specific identification features stored in the memory with the determined identification features.