RU2260840C2 - Protection means - Google Patents

Abstract

FIELD: mobile communications.

SUBSTANCE: protection means has key module and blocking module. Mobile communication system has protection means and communication port. Method describes operation of said protection means and mobile device.

EFFECT: broader functional capabilities.

3 cl, 5 dwg

Description

Technical field

The present invention relates to a security system for securing a device or set of information.

State of the art

The increasingly rapid development in the field of electronics has led to the emergence of a large number of mobile electrical devices with reduced sizes. Mobility itself leads to the fact that not only the device itself, but also the information stored in it, have become attractive and attractive to thieves.

Known security features provide locking using either hardware or software in combination with the primary input signal.

In the case of hardware locking, a primary input module is used, for example, a fingerprint input module (biometric sensor), a PIN (personal identification number) code input module combined with an additional module, for example, with a so-called smart card module (smart card with microprocessor) or the like him, or without such a module.

In the case of software blocking, verification software is used that checks that the correct input signal (PIN code, fingerprint, etc.) is transmitted through an external input module. Typically, the software is stored in a storage device, such as a hard disk, that is easily accessible.

US patent No. 56668876 relates to the permission (authorization) of the use of a service by a user, which is provided by a modified pager that calculates a unique response code to the transmitted call code based on the call code entered by the personal identification number and internal key. The response code is entered into a simple terminal, such as a telephone, and if a unique response code is accepted, then the user can access the required service, such as cashless transactions or remote telephone service.

Application WO 00/24554 describes an El-Gamal algorithm in a public-key cryptosystem. Secret new random numbers are generated on the server and user secret keys, which are encrypted using a symmetric algorithm, using individual user identification keys, determined by hashing the corresponding user key phrases or biometric information (fingerprint, voice sample, retina scan or face analysis result ) are stored in a storage accessible for the server, and new random numbers and encrypted secret keys are transmitted to the equipment s user, if necessary via a network, which is not secure. In order to prevent an attacker from detecting random numbers or using previously used random numbers in an attack of block replay, an exchange is used for a call answering protocol in which at least one secret new random number is transmitted from the server to the user equipment when the user is identified on the server. In this exchange, the first random number that is allocated to the user for use when signing a document, and the second random number that should be used by the user when generating the signature by hashing the first and second random numbers together, as part of the call answering protocol, are transmitted to the user equipment in encrypted form together with the update value and the server signature, which is formed by hashing together the first and second random numbers and the update value.

Description of the invention

The present invention is the creation of a very reliable and security device to prevent access to equipment and / or information stored in it.

Another objective of the present invention is to provide a device for identifying and blocking the input signal, which can be combined with various devices.

One of the advantages of the tool according to the present invention compared to the known method is, among other things, that (if applied to a computer) no modifications to the operating system or basic input / output system (BSVV, BIOS) of the computer are needed. It is a fact that such systems are simply made to work, even without any great knowledge in this area.

In addition, the blocking module, according to the invention, is integrated into the equipment that will be protected, which ensures complete protection, in addition, there is no need to change the usual inputs and outputs of the equipment, ports, etc.

These tasks are accomplished using security measures to provide access to the device or information in the device, which mainly contains the key module and the blocking module, which differ in that the key module is located at a distance from the blocking module, contains an input module and a communication module, and that user authentication is performed in the key module before locking / unlocking is enabled by the key module.

Brief Description of the Drawings

The invention is described below with reference to embodiments with reference to the accompanying drawings, in which:

figure 1 shows a structural diagram with the main parts of the means according to the present invention,

figure 2 shows a communication diagram between two modules in a given tool according to the present invention,

3 shows a block diagram of a first embodiment of means in a computer according to the invention,

4 is a schematic side view of a mobile communication device provided with means according to this invention, and

5 is a block diagram showing another aspect of the present invention.

Detailed Description of a Preferred Embodiment

The device 10 according to the present invention, which is schematically shown in figure 1, consists mainly of two modules, designated 11 and 12.

The first module consists of a touch or key part 10 for entering identification information by which user identification is performed. The key part 10 can be divided into two modules: the input module 13 and the key module 14, which are preferably, but not necessarily, physically integrated in one module 11.

Preferably, the input module 13 may consist of means of any type, preferably by means of which unique identifying information can be input. Such a tool may comprise a biometric sensor, a PIN code reader, a voice recognition device, an eye retina recognition device, a card reader, etc., all of which are well known to one skilled in the art.

The second part consists of a blocking module 12, which protects the object 15 in question.

The key module 14 initializes a unique communication procedure between the key part 11 and the blocking part 12. Unique to this invention is that the user identification is performed directly in the key part 11 and does not occur in the blocking part.

After user registration, the corresponding lock can be removed. There are two options for unlocking, on the one hand, for a certain pre-selected time period, on the other hand, permanently (if manually selected), which, however, gives poor protection. If the lock was released for a certain period of time, the user needs to identify himself again when this period of time expires.

During operation, identification information is entered, for example, by pressing a finger on a sensor (fingerprint sensor, SOP), entering a PIN code, etc. If the user identification is confirmed, an encrypted electronic signal is sent from the key module to the blocking module, whereby the blocked resource or object 15 (for example, a hard disk in the computer) is made available to the user.

Using a safe method of transfer between modules ensures that it is not possible to send a false signal to the blocking module to provide access to the blocked module.

The external module, key module 14, is provided by electronics, which mainly includes a microprocessor 16 with a built-in and largely protected program and data memory. The latter is a precaution, allowing access to the program or stored key information for reading or copying.

Preferably, the key module 14 stores a list of authorized users. Maintenance of this list, such as adding new authorized users, deleting users, etc., is performed locally without communication with other modules.

The key module decides in each case when the object should be protected, whether it should be unlocked or locked. The decision is usually based on the decision of the operator / user, i.e. The key is initiated by authorized users. The blocking may also occur at the initiative of the blocking module after a predetermined time has elapsed if the operator, despite the request, does not identify himself for some time.

The key module can be completely deprived of blocking and should not be protected from attacks, because data from the computer and the storage medium cannot be read from outside the processor (protection function in the processor).

The locking module 12, which communicates with the key module, for example, via a serial connection, is installed on or in the object 15, which must be locked, and performs its protection. Each attempt to access a locked object by bypassing the normal login procedure through key part 11 will be detected by the blocking module. Alternative steps may be initialized, i.e. prolongation of the inactivity mode for a longer period of time, warning signals, erasing data on the hard disk / storage device, etc.

The communication between the key and lock modules is carried out using, for example, digitally encoded signals through a serial connection.

The connection may be asynchronous and may occur at a relatively high transmission rate. Communication takes place according to a special blocking protocol, which may also contain known means of parity and time control.

As already mentioned, the purpose of the protection system according to this invention is, inter alia, to prevent unauthorized access, for example, to computers or more specifically access to a specific hard drive and the information that is on it. In order to obtain near-complete protection, an encrypted protocol can be used between the key part 11 and the block part 12. The likelihood that a security violation will succeed depends on the length of the random number, the protected key length, and the length of the response. It can easily be made smaller than, for example, 10 ^-18 , which actually means protection against unauthorized access.

Blocking protocol - a communication procedure that ensures the integrity of the computer transmission and ensures that unauthorized violation of the exchange of data between the modules cannot occur. If the messaging is performed correctly, the lock is released from the locked object and it remains unlocked, respectively. If any errors are detected, the object is blocked.

To verify the identity, the following messaging can be used (see FIG. 2):

a. the key module or key code 14 starts the verification sequence by sending a request to the blocking module,

b. the blocking module responds to variables randomly generated by a message,

from. at the same time, using a special algorithm that uses a security key, a numerical value is calculated. This value, which is fully calculated from the sent response message, is stored for future use,

d. the key module responds with a numerical value, which is calculated from the received message using the same algorithm and key used in the blocking module. This number can be used without changing the response, or it can be encoded so that the blocking module can interpret it. If the blocking module receives a message that contains a number identical to the number calculated during transmission in step b, then the identification is considered verified.

If the messaging is done correctly according to steps a-d above, then the locked object is unlocked accordingly or remains unlocked. If the answer does not match, then the object remains locked.

The hidden key code may vary for the key module and the blocking module (s) and for the blocking modules. This is possible because the key module is initialized with additional information that is specific to the connected lock module, respectively. This allows the lock module to return the correct answer to the lock module (as if it has access to the key code of the lock module).

In a most preferred embodiment, the biometric sensor module is used as an input module.

Biometric sensors have significant advantages for identifying people at the entrance, when accessing computers, etc. Among the advantages can be mentioned performance, an extremely high degree of protection during identification and, in addition, the absence of problems with forgotten passwords or a password that fell into the wrong hands. In combination with the present invention, the sensor part performs biometric identification of user fingerprints. When the user fingerprint identification is completed, an encrypted message is sent from the key module to the blocking module, whereby the blocked resource is made available to the user.

Lists of authorized fingerprint samples are located in the key module. Maintenance of this list, i.e. adding new authorized fingerprints, removing fingerprints, etc., is carried out locally without communication with other modules.

The sensor module can be equipped with indicators, such as two LEDs, red and green, to facilitate understanding of whether the fingerprints coincided or not. Diodes indicate whether the lock is unlocked or set, and also the status when registering / removing fingerprints.

The following are a number of non-limiting examples that explain various aspects of the invention.

The first non-limiting example shown in FIG. 3 relates to a hard disk module 30 (or another memory module or storage device) in a computer equipped with a fingerprint sensor 31 or a biometric sensor, i.e. module with addition. Addition is one of many applications of the locking system according to the invention. A module with an addition is understood to mean a standard module, such as a hard drive, which is equipped with a lock module and which is connected to a computer (or similar) module through a special electrical device, which is located, for example, on the controller board 32 (a card for installation in a computer, such as an ISA (industry standard bus architecture) standard board, PCI (peripheral device interface standard), or the like). The electronic part contains a key module and also means for communication with the software in the computer via the specified data bus. The sensor 31 or, alternatively, other identifying equipment communicates directly with the board 32 or, for example, via infrared or radio communication (Bluetooth specification) or the like.

In this preferred embodiment, the standard hard disk is modified in order to work together with the locking device according to the invention. It is understood that it is provided by a lock system installed internally and which by means of hardware prevents access to data on the disk. The appropriate procedure depends on the design of the device (disk).

Connections to the device remain the same as to a regular hard drive, i.e. signal cables are connected and power is supplied from the power supply unit of the computer. An additional connection is provided for communication between the lock module and the controller.

The locking function according to the invention is achieved by a key module and a locking module, respectively. The fingerprint sensor is connected via a cable and a switch to the controller interface on which the key module is used. The lock module is located on the hard drive.

In addition to performing the lock function, the electronic module is also located in the lock module for communication with computer programs. The program can, among other functions, warn in advance about locking the hard drive. In addition, the lock can be performed using software.

To restart the computer, use the switch, usually installed in front. It is always connected to a power source (input voltage Vin = + 5 V) even when the computer is turned off, provided that the main voltage is turned on. When the switch is turned on, the signal is transmitted to the system board and the computer starts working. When using the fingerprint sensor, the switch can be disconnected and the input voltage Vin, which is supplied to this contact, is instead fed to the controller board. From there, it moves further to the fingerprint sensor. Thus, the fingerprint sensor is always on. With authorized registration, a signal is issued from the controller board to the system board, replacing the usual press of a button.

A lock can be initialized in several ways:

- automatically, when a certain amount of time has passed (for example, in the case of unauthorized manipulation),

- when the user locks through the lock system,

- when the user locks using the control procedure described below.

Unlocking can usually be done in one way, namely by providing the correct fingerprint.

If the person (s) who / has registered their / their fingerprint / fingerprints are not available when the disk needs to be unlocked, it is possible for, for example, the system programmer or the person responsible for protection to unlock the module using a special code . It should be sophisticated enough code to prevent almost any access.

An attempt to remove the lock by transmitting false signals to the hard drive can lead to its blocking from further access attempts, for example, for a certain period of time or until the responsible person resets the lock function.

The fingerprint sensor can also be complemented by other locking devices, such as smart cards.

With the exception of the previously listed functions, the add-on module is fully compatible with a standard hard drive.

To install the module with the addition, special software may be required. It will monitor the lockout function through the controller board and indicate the status for the user. In particular, the user must be warned in advance for a certain amount of time before the drive is locked. Using this program it is also possible to directly block the module. Accordingly, the program is always active, and the status of the disk is displayed on the taskbar (activity field), where various commands can also be set.

Another area of application for this system according to the invention is “laptop computers”, i.e. laptop computers that protect all types of storage media: hard disk drive (HDD), floppy disk drive (HDD), compact disk (CD), random access memory (RAM), read-only memory (ROM), flash memory , a motherboard containing all components, such as a basic input / output system (BSVV, BIOS), controller modules for managing storage media, etc.

In stationary computers / servers, component protection can be applied on network cards and similar equipment for network administration.

The system can be organized as a remote control system combined with a mobile phone as a device that transmits a code. Data code generator for non-cyclic codes for access to computers, alarm systems, car locks, access systems, etc.

Codes can be transmitted via GSM (Global System for Mobile Communications), WAP (Wireless Access Protocol) telephone systems, or the like. The device according to the invention unlocks the module, and after that it is possible to select the type of action.

In an application using the invention for banking transactions or the like through, for example, a computer, the client may be provided with a touch / key module according to the invention. The client module is provided with a unique PIN code and a special algorithm. PIN code can be of a type that is used in applications of credit or bank cards, but slightly expanded. The same PIN code can also be stored in the key module used by the client. PIN code can be changed through special terminals in the bank. The same unique code may be associated with a customer account number.

At the bank, when a transaction request is received, the response is generated using a special calculation module, which confirms that the request from the corresponding key module is genuine, owned by the current account holder.

This function can be described in more detail according to the following steps:

the client contacts the bank through a computer program installed in his computer and enters his account number,

the bank issues a response containing an identifying part, lock data, etc.,

the client selects the type of transaction and fills in the data on the quantity, etc. and confirms the transaction,

the program transmits transaction lock information, as described above, and also transaction data containing, for example, quantity, account number, timestamp, etc.,

the answer is accepted only if the blocking module has received the correct identification from the key module; the response may contain identification information, various lock / unlock data and also transaction data and are sent to the bank. At the same time, the transaction data (for example, the amount) and the identification of the transaction executor are checked,

the bank uses the above algorithm together with the customer PIN code to confirm the response, and if the correct answer is received, consisting of incoming responses and transaction data, which confirms that nothing has been changed after biometric monitoring, the transaction is accepted and the customer is informed.

If a trade operation or transaction is carried out, for example, via the Internet, then the user can be provided with a key module equipped with, for example, a biometric sensor or the like. The user's key module is provided with unique identification in the form of a checksum or the like. The same unique identification may be associated with the user account number in the bank. The bank is equipped with controls to verify the correctness of the transaction request in the same manner as described above. In this case, the verification and transaction is first performed by the bank and then communicated to the seller in the manner described above.

In one further example, the invention is used in a mobile device, such as the mobile phone shown in FIG. 4. The security device 40 consists of two parts 41 and 42 connected according to a hinge (according to this example), where part 42 contains a connector 43 for connecting to the communication port (not shown) of the telephone 44. The device contains a sensor module 45, such as a biometric a sensor and the like, and the corresponding electronic part and the memory located in the second part 41. The electronic part can be powered from the telephone’s power source. The connector connects to the telephone, and the sensor portion 41 attaches to the rear side of the telephone, for example over its battery. After connecting, the phone can be used as a control or key module as described above.

A telephone can only be accessed if the right person, verified through a sensor, uses a telephone that can also be used to control other modules, for example, when making payments through the telephone network, remote control, when opening doors, accessing computers (for example, through infrared control interface), etc. In this case, the blocking module may be implemented in the telephone.

Examples of other uses of tasks using the invention include:

Radio Set-Top Box (RFR), i.e. a storage device, such as a hard disk, provided with a biometric reader or a card reader repeater.

A blocking module for portable equipment (handheld computers) that only works when a specific repeater is nearby. A repeater, for example, can be integrated into a watch. In addition, the watch can be provided with a biometric sensor that communicates with a handheld computer via infrared or radio.

A locking device can be integrated inside the remote control to ensure that only one authorized user can access the remote-controlled equipment.

When encrypting / decrypting e-mail or files, encryption can be performed using the public key, while decryption can be performed using the secret key, which is checked for belonging to the right person using a biometric sensor.

The invention is not limited to the use of a key or lock module, as well as combinations of several keys and lock modules, where one or more key or lock modules can work together. The block diagram of FIG. 5 shows such a means in which L ₁ -L ₅ indicate blocking modules, and K ₁ and K ₂ indicate key modules. A key module, for example K ₁ , can be configured so that it unlocks a number of lock modules, for example L ₁ -L ₄ , while K ₂ unlocks L ₄ and L ₅ . The term “unlocks” also means allowing access to various resources and information. The communication between the lock modules and between the lock modules and the key modules can be performed by radio communication, the Internet (or other networks), infrared communication, etc., the decryption is preferably performed as described above.

Although only preferred embodiments of the present invention have been illustrated and described, it is understood that changes and modifications may occur within the scope disclosed in the appended claims.

Claims (13)

1. Security means (10) for providing access to the device or information in the module by means of user authentication, said means mainly comprising a key module (11) and a blocking module (12), said key module (11) exchanges information with said blocking module and contains an input module (13), a communication module (14) and means that performs user identification in the key module (11) before the key module allows the execution of blocking / unlocking in said block In this case, in which said key module (11) is configured to exchange information with a blocking module (12), starting a verification sequence after said blocking / unlocking is enabled, by sending a request to said blocking module (12), the blocking module responds by transmitting variable randomly generated message and calculates a numerical value using an algorithm using a secure key stored in said blocking module, said numerical value being is calculated from the transmitted response message, said key module in response provides a numerical value calculated from the received message using the mentioned algorithm and said secure key, and if said blocking module receives a message containing a value that is identical to the value calculated by the blocking module, the identification is confirmed and access to the device or information is provided. 2. The tool according to claim 1, characterized in that the said device is a computer, a cash dispenser, a door lock, a car door, a remote control unit, a mobile communication device, a laptop computer, and the like. 3. The tool according to claim 1 or 2, characterized in that the input module is a biometric sensor, a code reader (personal identification number), a voice recognition device, a retina recognition device, a card reader or a mobile phone, etc. 4. The tool according to any one of claims 1 to 3, characterized in that the user identification information is stored in the key module. 5. The tool according to claim 1, characterized in that the said numerical value is used unchanged in response or is encrypted so that the blocking module can interpret it. 6. A security device according to claim 1, characterized in that said blocking module is provided in a memory device (30) provided in a computer, said key module comprises a biometric sensor (31) and a blocking module prevents access to data, and it is associated with software computer through the module (32) of the controller. 7. The security device according to claim 6, characterized in that said controller module is one of an ISA board, a PCI board or the like. 8. The protective equipment according to claim 6 or 7, characterized in that the controller module contains a key module. 9. A security device according to any one of claims 6 to 8, characterized in that the sensor module initializes the computer through the controller module. 10. A security device according to any one of claims 6 to 9, characterized in that the blocking operation is initiated automatically after some time has passed, and / or by the user through the security device, and / or by the user using the security procedure. 11. A mobile communication device (44) for providing access to a module or information in a module, characterized in that it comprises a security device according to claim 1, said security device being an external module connected to a communication port of said mobile communication device (44), in that the protection means is provided by a biometric sensor connected to said communication module, whereby the communication module is a single unit consisting of a key module and / or a blocking module, and that the user identification is performed in the key module before the lock / unlock is received by the lock module. 12. A method for providing access to a module or information in a module essentially comprising a key module (11) and a blocking module (12), said key module (11) being coupled to a blocking module containing an input module (13) and a communication module ( 14), this method comprises the steps of: a. initialize the identification in said key module after initiation by the user, b. initialize the check in the key module by identifying in the said key module, sending a request to the blocking module, from. the blocking module responds with variable randomly generated message, d. at the same time, calculating the numerical value using a predetermined algorithm using the secure key stored in the said blocking module, and storing it for later use, e. the key module corresponds to the numerical values computed from the received message using the specified algorithm and the key used in the blocking module, and f. confirm the identification if the blocking module receives a message containing a numerical value that is identical to the value confirmed in the transmission in step c, providing access to the module or information in the module. 13. The method according to p. 12, characterized in that the said value is calculated entirely from the response message.

Images