WO2008094025A1

WO2008094025A1 - Method for securely connecting a remote user and a system for carrying out said method

Info

Publication number: WO2008094025A1
Application number: PCT/KZ2007/000009
Authority: WO
Inventors: Korganbay Sagnaevich Sholanov
Original assignee: Korganbay Sagnaevich Sholanov
Priority date: 2007-01-29
Filing date: 2007-07-03
Publication date: 2008-08-07

Abstract

The invention relates to a user system, in particular, to methods and devices used for securely accessing and exchanging information. The aim of the invention is to securely accessing information and exchanging information between remote users, each of which is authorised to access and to exchange information received from a trustworthy source, whilst said information is not accessible to other users without adequate authorisation. The invention discloses a method and a system making it possible to on-line identify a person prior to access thereof to the user system and to exchange confidential information. During information exchange, persons declared themselves and authenticated individuals, only, are considered as users, whilst the unauthorised access of third persons is excluded. The inventive method consists in authenticating the face biometric data items, in obtaining the prints of all fingers of both hands and data items of the voice spiking standard sentences when registering an individual and in forming, on the basis of biometric data, a set of patterns in the form of an individual computer standard. Once access is authorised, the permanent authentication is carried out by positioning an individual in a user interface. A person authentication system consists of a devicewhich is wearable on the head of a user and comprises, embodied in an integral manner, a minicomputer or another control unit for operating a computer and authentication facilities.

Description

METHOD FOR PROTECTED CONNECTION OF REMOTE USER AND SYSTEM FOR ITS IMPLEMENTATION

The invention relates to a user system, in particular to methods and devices that ensure the security of access and exchange of information. The primary area of use is training and knowledge control, confidential information exchange, ensuring the security of transactions, financial transactions and services, etc.

A known method of identification [US 6902108 BA C2 G07 with 9/00 from 01-05.1997]. A unique description is created for each individual, formed in the form of a database and designed to identify access when communicating with the individual. The disadvantage of this method and device is a one-time identification, i.e. the inability to provide permanent identification in the confidential exchange of information with a remote user.

The known system [RU 2005105948/09, H 04 K 1/00 dated 09/20/2005], which provides the release of a cryptographically protected identification document (DI) for a person, and the DI contains the first and second representations of human-distinguishing data that distinguishes people, while the first representation is human readable, the second representation is computer readable and encrypted. The first view includes data that distinguishes a person: image of a person’s face, person’s name, person’s social security number, person’s account number, person’s weight, person’s height, person’s hair color, person’s eye color, one or more person’s fingerprints, information about birthmarks person, information about the person’s tattoos, person’s personal account information, one or more distinctive features of that person, and person’s contact information. The second view includes person-specific image data of a person's face, one or more fingerprints of a person. The disadvantage of this system is the large amount of biometric data of the second presentation and, as a consequence, the large time spent on identification, the high cost of equipment.

The closest in technical essence are the method and device for identifying a remote user [GB 9600359.5 C2 G07 C 9/00 of 09/09/1996], based on the fact that the generation of an identification signal is carried out, which is transmitted to a remote display to obtain the user's image and by which the identity of the individual is visually established with who he is being presented. In this case, fingerprints of the user are used for identification, his image and other biometric data can be used.

The disadvantage of this method is that unauthorized access and interference by third parties is possible, i.e. personification condition is not fulfilled. So, for example, if user 1 tests user 2, then there is an opportunity for another person to intervene in the testing process (by means of a hint) and the personification condition is violated, the test results and its objectivity are called into question.

The disadvantage of this device is that it does not provide isolation of the user to maintain the confidentiality of information and to exclude unauthorized interference of third parties. For example, after gaining access through a one-time identification, information may be acquired by persons who are not the ones they represent. Thus, the user service does not provide real-time protection in the exchange of information and personification.

The objective of the secure connection method of a remote user is to provide: personalized secure access to information; secure personalized exchange of information between remote users. With a personalized connection, each user gets access and exchanges information from a reliable source, and this information is not available, without appropriate sanctions, to other users.

The task of the system for a secure connection of a remote user is to perform the function of a permanently protected user service for a remote connection (personalized communication), which reduces the time spent on identification, accesses information and exchanges information only by authenticated users, as well as authenticated individuals. Another objective of the device is to ensure such isolation of the user, which eliminates the interference and access to the exchange of information of third parties, i.e. the condition of personified communication is constantly fulfilled. The proposed problem in the method is solved due to the fact that the method of remote user identification generates an identification signal that is transmitted to a remote device using a computer-readable storage medium (electronic card, flash memory, etc.), which contains two representations of the individual: 1- The second presentation is readable and contains documentary information about the person and his image: the second presentation is only computer-readable encrypted data, torye include biometric information of an individual, the prints of the fingers.

The invention provides a method for secure connection of a remote user, characterized by the condition of constant personification when accessing the user system and exchanging confidential information in real time. Personification is achieved by the fact that when accessing the exchange of information and throughout the entire exchange of information, users are only those who have declared themselves, as well as authenticated individuals, unauthorized access by third parties is excluded.

_Way secure remote user's connection is characterized in that for the recognition of the individual biometric data of the person, the prints of all the fingers of both hands and the data from the voice saying the standard phrase, prepared by individual registration, on the basis of which is formed of patterns set of - a computer of an individual standard (KEI) . From face recognition technology, it is convenient to use the separation of distances and distance relations between easily identifiable features of a person's face. This technology does not require sophisticated biometric sensors, quickly implemented and does not require a ^'large volume of memory. Retinal recognition devices may be used.

Access to the confidential exchange of information and the personalized connection of remote users is provided by a personalized communications service provider (PPS) with special-purpose software and tools and an archive with an authentication database for individuals, groups of individuals, organizations.

KEI is entered into the STP database and onto a computer-readable storage medium, forming the 2nd representation of the individual.

CEIs are used in verifying an individual to gain access to the user interface and in the process of exchanging information. Upon verification “one to one” comparisons are made according to the templates of specific biometric data of the individual with the CEI data.

Access to the personalized mode is carried out by direct connection with a personalized communications service provider (PPS) or by reading information from a computer-readable medium.

After gaining access, a personalized exchange of information is ensured by the fact that the individual “takes a position” in the user interface, that is, does not change his state in relation to the devices of the user service.

The “position” of the user is ensured by the fact that the user interface device has corresponding sensors, for example, optical sensors that control the distance from the individual’s face to the display, photosensors, contact sensors, etc., therefore, the user does not remove the device from the head after authentication. The user's “position” is also ensured by the fact that the user must hold at least one finger of each hand on the fingerprint reader. Violation of positioning leads to the immediate termination of personalized communication.

When “positioning” in the knowledge control mode, pronunciation of voice sounds by the user is not allowed. To monitor the fulfillment of this condition, the user's voice data with CEI is used. In case of violation of any conditions of “positioning”, the exchange of information in the mode of personified communication is interrupted.

The user in some cases of personified communication (knowledge control, testing) is isolated from the external environment due to visual and auditory isolation, does not make voice sounds. In this case, the input and output of information is excluded. It allows two modes of information exchange: one-way and two-way authentication. One-way authentication is used, for example, when checking and controlling the knowledge of an authenticated user by a well-known organization or group of people who do not need to introduce themselves. For example, if an institute controls students' knowledge, then in this case student authentication is required, and the institute may not be authenticated. The information exchange mode used is displayed on the user monitor screen.

For individuals with physiological, anatomical features, these data are taken into account when forming the computer standard of the individual.

The technical result of the method of secure connection of a remote user is to increase security when exchanging confidential information and objectivity of the results, for example, remote testing or knowledge control through personification. This result is achieved by the fact that access and exchange of information with continuous protection is carried out by users who have declared themselves and authenticated individuals, unauthorized access and the intervention of others is excluded. For user authentication, a set of biometric data (faces, fingerprints of both hands) is used. In the process of exchanging information, users are “positioned” (they are not given the opportunity to change their state in relation to the devices of the user system). It is allowed to authenticate users during the exchange of information. The technical result is also the reduction of time costs, because if the “positioning” condition is fulfilled, there is no need for constant authentication, which requires additional time.

The problem for the system is solved in that the system of secure connection of a remote user containing means for generating an identification signal transmitted to a remote device, a data processing device, a fingerprint reader, a means of connection, a liquid crystal display is different in that it is made in the form of a device worn on the head, in which are mounted and form integral connections of a minicompoter or other control device providing computer functions, equipment for face biometric authentication, monitor, microphone, headphones, an interface for reading and writing information from external devices, controllers with drivers of all external devices.

As a device performing the functions of a computer, a stationary or portable computer can be used with the advantage of the hardware and software of the device. The “positioning” of the user is provided by appropriate optical or other sensors that control the distance from the individual’s face to the display, as well as contact sensors. These sensors control that the user does not remove the device from the head.

The device for personalized communication includes 2 fingerprint readers of both hands, which are simultaneously input devices (such as a mouse). Alternatively, it is possible to use one device with two fingerprint readers of both hands.

A virtual keyboard is called up on one of the windows on the monitor screen. Data typed by the user on the virtual keyboard using input devices, which are simultaneously devices that scan fingerprints, are interpreted by the computer as data coming from external input devices.

For people with disabilities, specialized means are provided for a personalized communication session. For example, in the absence of hands, there is no need for sensors to take and analyze fingerprints. In this case, the user controls the device through the microphone. In the absence or limited visual functions, the device is controlled by the auditory and voice functions of the individual. In this case, there is no need for a monitor.

The technical result of the system for providing a secure connection to a remote user is that the interconnection of the elements forming the apparatus, worn on the head in conjunction with two input devices with fingerprint readers, allows you to personalize the remote connection, reduce the time spent on permanent authentication through the use of the “position” of the user, increase reliability of access and security of information exchange, ensuring confidentiality of services through the use of aggregate and biometric recognition techniques.

The figure 1 shows a user with an apparatus for personalized communication.

The device consists of a helmet 1 made of opaque material with backlight 2, monitor 3 of the minicomputer 4. The position of the monitor is regulated by a block of controllable drives 5. The controllers of all external devices and devices that provide connection and personalized communication are located in hardware unit 6. Also shown in figure 1: a microphone 7; hinged when putting on the helmet, cover 8 with a contact sensor 9. The device is connected to a power source through block 10, and to a remote access network through input 1 1. Through permanent connections 12, 13, external input devices 14 and 15, which are simultaneously fingerprint readers, are connected with minicomputer 4.

The figure 2 shows the location of the equipment for biometric control of the face.

Identification devices 16, 17 are shown here, which can simultaneously control the distance from the sensor to the face, and headphones 18.19 are also shown. The position of the instruments together with the monitor relative to the face is changed using controlled drives 5.

The method of continuous authentication of an individual is implemented using a personification system as follows.

The user connects the device to a power source, connects to a remote access network. Then puts the device on his head. To do this, pre flips cover 8. After the helmet 1 is put on his head, the cover 8 returns to the position against the stop with the chin. This position is fixed by the contact sensor 9. The position of the monitor screen is adjusted together with devices for identification through the computer using the drives 5. Both hands are installed on the fingerprint readers 14.15 and the PPS server is called. To do this, the corresponding operating system requests appear on the monitor screen 3, to which the user answers, as well as a virtual keyboard for the user to dial the requested data.

At the first call, the user must register on the PUPS server. When registering an individual, the first and second representations of the individual are formed. The first presentation is documentary information about a person and his image, which can be read. The second view is computer-readable encrypted data that includes biometric information about the face, fingerprints, voice data of the individual. Face biometric data can be generated using well-known devices and technology for facial recognition of firms Вioоd Аmerica

Visiopis (https:. 'M'ww. Visktiss.sot). Or, retina authentication can be performed based on the analysis of the fundus vessels using equipment and technology of the company EuDeptifu (http: / Лвww.eyedepiif \> - comp). There are well-known methods of voice authentication, for example, the company VeriVoise (htt. YApvw. Veviosose. Cell). For fingerprint authentication, the technology of DigitalPersopa can be used (http: / AP \ pv.dwtalpersopa.com \ mobile terminal and the method of its operation (RU 2005107736/09, 03/21/2005).

The data of the biometric devices of the authentication apparatus is encoded and a set of templates is formed - a computer standard of the individual. KEI is recorded in the PUPS archive.

Upon subsequent calls by user 1 in order to conduct personalized communication, the PUP server, based on the data of user 1, finds the individual’s computer standard from the database (CEI). Performs a remote verification operation by running a program that verifies user 1. During verification using biometric devices, biometric data are determined, templates are created that are compared with CEI. If user 1 is authenticated, then the server requests the address of the second user and features operating modes: one-way or two-way authentication, as well as for which user the control and testing mode is applied (if such a mode is necessary).

After the verification operation, user 1 immediately “takes a position”, i.e. the individual must not remove the device from the head and must hold at least one finger of each hand on the fingerprint reader. “Positioning” is controlled by optical or other sensors to determine the distance from the sensor to the nearest point on the face, which during personalized communication should not exceed the threshold value and with the help of fingerprint readers. The technology of access and personalized communication can be performed according to the following algorithm. The PUP server requests confirmation from the User 2 interface, after receiving the confirmation, verifies (if necessary) the second user and, in case of coincidence, establishes a personalized connection. The PUP server authenticates users (users) during the communication process. In an alternative embodiment, the 1st idea of the individual and its CEI are recorded on a computer-readable storage medium. At the same time, users are connected directly using the following technology. User 1 enters his data into the machine from a machine-readable storage medium, passes verification and enters the address and name of the 2nd user, as well as features of the information exchange mode (one-way or two-way authentication, for which user authentication is required, for which user the test or control mode is applied knowledge). The user interface device sends a request to user address 2 that contains the content file with the user IDE 1, an access key to user 1 information, and a readable representation of 1 about user 1 and its email address. A similar operation is performed by user 2 and his interface device. A personalized connection is established when the destination addresses match and the condition for the exchange of content files with CEI and access codes to information. With this connection, each of the parties may, at its discretion, conduct a request for verification of the interlocutor. For example, user 2, having received the CEI of user 1, can carry out remote authentication of user 1 at a time or with a certain frequency. If the biometric data templates do not match, the connection immediately ceases.

Claims

CLAIM

1. A method of secure connection of a remote user, in which the identification signal is transmitted to a remote device, using a computer-readable storage medium (electronic card, flash memory and other), containing two representations of the individual: the 1st representation is readable and contains documentary information about a person and his image: the 2nd view is computer-readable encrypted data that includes biometric information. about and divid, fingerprints, hand wherein the condition is provided by a constant personalization when accessing the user system and the exchange of confidential information in real time.

2. A method for secure connection of a remote user according to claim 1, characterized in that the biometric data of the face, fingerprints of all fingers of both hands and data with a voice pronouncing standard phrases are obtained as a result of registration of the individual, on the basis of which a set of templates is formed - a computer standard of the individual .

3. The method of secure connection of a remote user according to claim 2, characterized in that access to a confidential exchange of information and a personalized connection to remote users is provided by a personalized communications service provider that has a special purpose, software and tools, and an archive with an authentication database for individuals, groups of individuals, organizations.

4. A method for secure connection of a remote user according to claim 3, characterized in that _; that the computer standard of the individual is entered into the database of the personified communications service provider and onto a computer-readable storage medium, forming the 2nd representation of an individual

5. The method of secure connection of a remote user according to claim 4, characterized in that the computer standard of the individual is used to verify an individual to gain access to the user interface and during the exchange of information.

6. The method of secure connection of a remote user according to claim 5, characterized in that the access to the personalized mode is carried out by direct connection with a personalized communication service provider or by reading information from a computer-readable storage medium.

7 The method of secure connection of a remote user according to claim 6, characterized in that after gaining access, permanent authentication is ensured by the fact that the individual

"Positioned" in the user interface, without removing the authentication device from the head, constantly holding at least one finger of each hand on the fingerprint reader.

8 The method of secure connection of a remote user according to claim 7, characterized in that the user in some cases of personalized communication (knowledge control, testing) "positsiyuyutsya" that is isolated from the external environment due to visual and auditory isolation, does not produce voice sounds, Does not use information output devices.

9. The method of secure connection of a remote user according to claim 8, characterized in that it allows two modes of information exchange: one-way and two-way authentication, which are displayed on the user’s monitor screen.

10. The method of secure connection of a remote user according to claim 9, characterized in that for individuals having physiological, anatomical features, these data are taken into account when forming the computer standard of the individual.

11. Remote Authentication Secure Connection System individuals, containing software and hardware for generating an identification signal transmitted to a remote device, a data processing device, a fingerprint sensor, a connection tool, a liquid crystal display, characterized in that it is made in the form of an apparatus of opaque material, worn on the head, into which are mounted and form integral connections minicomputer or other control device providing functions of a computer, devices for biometric face authentication, monitor, micro he, headphones, reading and writing information interface with external devices, controllers, drivers of all external devices.

12. The secure connection of the remote user system according to claim _11. characterized in that the “positioning” of the user is ensured by appropriate optical or other sensors monitoring the distance from the individual’s face to the display, as well as contact sensors.

13. A secure connection system for a remote user according to claim 12, characterized in that it has 2 fingerprint readers of both hands, which are simultaneously input devices (such as a mouse).

14. The remote user protected compound according to claim 13, characterized in that on one of the monitor window is called a virtual keyboard, wherein the user-dialed data on the virtual keyboard using the ^'input devices are interpreted by the computer as the data input from the external input device.

15. A secure connection system for a remote user according to claim 14, characterized in that for people with disabilities, specialized means are provided for a personalized communication session.