DE102005059001A1 - Portable electronic device, method for enabling a smart card and computer program product - Google Patents

Abstract

The invention relates to a portable electronic device with DOLLAR A - an interface (102) for accessing a chip card (112) from an external device, DOLLAR A - a chip card reader (120), DOLLAR A - a non-volatile electronic memory ( 104) for storing authentication data (106) of a user, DOLLAR A - a sensor (118) for detecting a biometric feature of the user, DOLLAR A - means (108, 114, 116; 146, 150, 152) for checking the biometric feature and to access the electronic memory (104) for the transmission of the authentication data (106) to the chip card via the chip card reader, if the verification of the biometric feature is successful, in order to enable the chip cards for access by the external device.

Description

The The invention relates to a portable electronic device, in particular a so-called USB stick, a method for unlocking a smart card and a computer program product.

Out the prior art so-called USB sticks are known. A USB stick is a portable data storage device with a USB plug. When USB acts it is a serial computer bus (Universal Serial Bus; www.usb.org).

With Help of a USB stick can be conveniently transported data to she for different applications and on different devices, in particular Computers, personal digital assistants (PDAs), digital cameras, dictaphones, Audio and / or video players, especially MP3 players, and the like.

USB sticks are already known from the prior art, in which the access to the data stored in the USB stick are protected by the fingerprint of a user. The stored data can therefore only be accessed if the access has previously been released by checking the fingerprint of an authorized user. A corresponding USB stick with fingerprint security is commercially available from Dr. Ing. Fehr GmbH ("BioSlimDisk" - www.4trust.de). A corresponding USB stick is also known from the DE 103 19 558 A1 and WO 02/42 887 A2.

From the DE 103 32 183 A1 Furthermore, a USB stick with layered memory architecture for storing large amounts of data is known.

Of the Invention is opposite The task is based on an improved portable electronic Device, In particular, to create a USB stick, as well as a method for Activation of a chip card and a corresponding computer program product.

The The underlying tasks of the invention are each with the Characteristics of the independent claims solved. Preferred embodiments of the invention are in the dependent claims specified.

According to the invention is a portable electronic device with an interface for accessing a chip card from one external device created. The interface may be, for example, a USB interface act, that is, the portable electronic Device can have a USB plug for plugging into the external device. at the external device it can in principle be any electronic device, such as a computer, laptop, PDA, voice recorder, electronic Camera, audio and / or video player, in particular an MP3 player, Car radio, navigation device, Controller, Electronic Control Unit (ECU) of a motor vehicle or the like.

The portable according to the invention electronic device has an integrated chip card reader. The chip card reader is used preferably for receiving a conventional Chip card, in particular a so-called microprocessor card (see. for this "manual the chip cards ", Wolfgang Rankl, Wolfgang Effing, chapter 2.3.2, pages 50, 51). The chip card reader is preferably used to hold a chip card a standardized format, in particular a chip card, the complies with the ISO 7810 standard.

For example the chip card has the format ID-00 or ID-000, as it usually does for the realization of so-called Subscriber Identity Modules (SIM) smart cards for mobile applications used in the GSM and UMTS network. (see "Handbook of Chip Cards", Chapter 3.1.1, Pages 57 to 61). The use of formats ID-00 or ID-000 has the advantage of a relatively small design of the chip card, so that these easily turn into a small portable electronic Accommodate the device leaves.

The portable according to the invention electronic device has a non-volatile electronic memory for storing the authentication data of a User. For example, the authentication data to a so-called Personal Identification Number (PIN), the to Part also known as Card Holder Verification (CHV). through the PIN authenticates a user to the corresponding chip card. Only if a correct PIN is entered into the chip card will the chip card for unlocked the use.

To Activation of the chip card are the user or the external Device ever according to the type of chip card one or more functionalities for Available. For example, after the activation, the implementation of a electronic signature or access to stored in the chip card Data, such as telephone numbers, e-mail addresses, User settings and the like.

The portable according to the invention electronic device also has at least one sensor for detecting a biometric Feature of the user. For example, the sensor is for detection a fingerprint or to capture characteristic features the voice, the facial features, the iris or other or additional formed biometric features.

The portable electronic device has means of checking one sensor detected biometric feature. For example For this purpose biometric reference data is accessed. With sufficient agreement the sensory biometric features with the biometric reference data, will the review as considered successfully. The successful review of the sensed biometric Feature is - ever according to embodiment - a necessary or sufficient prerequisite for access to the authentication data and the transmission the authentication data via the chip card reader to the chip card to enable this free.

This has the advantage that the user does not have his PIN, as with so-called Class 1 chip card readers usual, over one Computer keyboard must enter or a so-called class 2 smart card reader with a keyboard. Rather, the PIN becomes more successful biometric authentication of the user automatically from the non-volatile electronic memory and read about in the portable electronic Device integrated Transfer smart card reader to the smart card to enable this free.

In an embodiment The invention is non-volatile electronic storage of the portable electronic device next to the storage of authentication data of a user for storage formed further user data. This can also be a separate non-volatile electronic memory present in the portable electronic device be. Preferably, the access to the user data, such as Example of files saved by the user only after successful biometric authentication enabled.

In an embodiment According to the invention, the portable electronic device has one or more radio detection elements. In the prior art, various radio detection systems are per se Also known as Radio Frequency Identification (RFID) systems be designated. Such RFID systems generally include at least one transponder and a transceiver unit. Of the Transponder is also called RFID tag, RFID chip, RFID tag, RFID label or radio tag; the RFID transceiver will also as a reader or Reader.

By the integration of one or more RFID tags into the portable electronic device receives this a universal key function. The portable electronic device can as an electronic key for the Access to electronic devices, data or functions as well as an electronic car key, building key or for other access protection systems be used.

In an embodiment According to the invention, the at least one radio-detection element of the portable electronic device activated only if a successful verification of the biometric feature of the user. In front of you such successful verification can So no radio detection take place, that is, the radio detection element, in particular the RFID tag, can not be addressed by an RFID reader become.

In an embodiment In accordance with the invention, the portable electronic device has a peelable protective cap for mechanical protection of the interface, in particular the USB connector. The protective cap is wearing a battery. When the protective cap is attached to the USB connector is, so the portable electronic device can not use the USB interface with electrical energy to be supplied. In this case takes over the battery located in the protective cap supplies the power. this makes possible a review of the biometric feature even if the portable electronic Device not plugged into the USB port of an external device. This is Particularly advantageous if the activation of the at least one Radio Detection Element from the previous successful verification of the biometric feature of the user, or if more Functions in the portable device are integrated, which should be usable, even if the device is not plugged into the USB interface.

In an embodiment According to the invention, the portable electronic device has a housing which is so formed is that there are two different mounting positions for the protective cap be formed. The protective cap is used in the first fastening position to protect the USB connector as well as the power supply, in particular for carrying out a biometric authentication to activate the at least one radio-detection element to be able to. In the other mounting position, the USB connector is released, so that the portable electronic device plugged into an external device can be supplied from there with electrical energy. In the second attachment position contacts the protective cap with corresponding contacts arranged in or on the housing, so that the battery arranged in the protective cap will be charged can.

In one embodiment of the invention, the portable electronic device has a carrying handle or clip to attach the portable electronic device to, for example, a user's belt. This is particularly advantageous for applications as an electronic access key to a building or other access protected area. At the entrances too such access protected areas RFID readers are usually placed approximately at waist height. When the user fastens the portable electronic device to his belt, he only needs to pass by such an RFID reader so that the RFID reader can interrogate the RFID tag of the portable electronic device without the user inserting the portable electronic device into the device Hand must take.

In an embodiment The invention is the carrying handle pivotally arranged, for example, so that he the protective cap enclose in their loading position can.

In an embodiment the invention is the portable electronic device as an integrated USB storage medium, USB smart card reader and for one Radio-detection system designed with biometric protection. Preferably takes place both the detection of a biometric reference feature and storage and biometric verification strictly within of the portable electronic device, without external devices for the required functions or access these features.

In an embodiment In accordance with the invention, the user may register multiple biometric features. The multiple biometric features can be used to secure the same or different data or functionalities. For example a user can fingerprint his left index finger one first PIN and the fingerprint of his right index finger one assign second PIN, which at the same time corresponding functionalities of a Chip cards selectable are. Furthermore, the portable electronic device may also include one or more others Having sensors to accommodate biometric features of various types, such as biometric features of the voice, the facial features or the iris of the user.

In an embodiment The invention is the portable electronic device for detecting the user's life educated. Before a release of access to the non-volatile electronic memory or before a transmission of authentication data to the chip card is thus automatically checked whether the user is still on Life is. The review can by detecting a physiological feature of the user and checking whether the physiological feature is within a normal range become. As a physiological feature for a living detection are suitable especially the pulse rate, electrocardiographic signals, the oxygen content of the blood, blood pressure and other nonspecific biometric features, as known per se from WO 09526013 are.

According to one embodiment The invention relates to the authentication data and / or the biometric Reference data stored encrypted in the portable electronic device. For this purpose, a factory in the manufacture of the portable electronic equipment generated key serve. Alternatively or in addition becomes such a key from the portable electronic device based on the biometric Generated reference data.

In an embodiment of the invention the authentication data and / or the reference data and / or user data only be decrypted after prior successful biometric verification. This has the particular advantage that the data, that is, in particular the authentication data and / or biometric reference data and / or User data, even if it is protected, the remove appropriate data storage from the portable electronic device and read out, as a decryption in not possible in this case is.

In an embodiment invention, the portable electronic device has a user interface, for example, the user capturing his biometric Reference data, biometric verification and / or other functionalities of the portable electronic device more accessible close. The user interface can do this one or more Display elements, such as light-emitting diodes and / or a liquid crystal display. Preferably, the user interface is designed to be be detected visually together with the sensor by the user can, that is, the user interface and the sensor are arranged so that they are in the user's field of vision.

In an embodiment According to the invention, the portable electronic device has an input element around which Enter authentication data. It may be at the input element For example, it is a one-button control. After Input of the authentication data, in particular one or more PINs become the authentication data in the non-volatile electronic memory for the further use saved.

In an embodiment invention, the portable electronic device includes a Random generator for generating the authentication data, ie in particular of one or more PINs. The pre-set on a chip card PIN is then changed accordingly.

In one embodiment of the invention who the automatically deleted the authentication data stored in the non-volatile electronic memory when the smart card is removed from the smart card reader.

In an embodiment the invention can be Do not remove the chip card from the chip card reader without this portable electronic device to destroy.

In an embodiment According to the invention, the portable electronic device has an operating element for switching a status of the chip card. With the help of the control element can be For example, the status of the chip card from "smart card inserted" and "smart card removed" switch.

In an embodiment According to the invention, the portable electronic device is designed to be not disassemble into its components. For example, that is portable electronic device for this purpose filled with a potting compound. This has another one Protective function, to avoid, for example, the non-volatile electronic Memory is removed from the portable electronic device.

In an embodiment of the invention are more in the portable electronic device Integrated functions, such as telecommunications functions, in particular a mobile phone, an MP3 player, an electronic Camera or the like.

In In a further aspect, the invention relates to a method for unlocking a chip card with the following steps: Checking a biometric feature of a user, access to authentication data of a user, which in a non-volatile electronic memory are stored, and transmission of the authentication data to the chip card over a smart card reader.

In In another aspect, the invention relates to a computer program product with processor executable Program instructions for execution a method according to the invention.

In In another aspect, the invention relates to a portable electronic Device (in particular a so-called USB stick) with a bus interface, in particular a USB interface, which in addition to the transmission of data to the Supplying the electronic device with electrical energy serves when the electronic device is plugged into the interface is. The electronic device has a detachable protective cap, in a first position a plug, in particular a USB plug, covering the device, and in a second position, with the electronic device arranged contacted electrical contacts, leaving a rechargeable battery of the electronic device is charged. When the protective cap is in the first position is located, the electronic device through the battery with electrical Be supplied with energy. When the protective cap in the second Position is located and the electronic device in the interface of an external equipment plugged in, the battery in the protective cap of the external Device over that portable electronic device and its electrical contacts are charged. This makes possible, one or more functionalities of the portable electronic equipment are usable even if the portable electronic device is not into the interface, especially the USB interface, of the external equipment is plugged.

In an embodiment In accordance with the invention, the power supply of the portable electronic device can be both in the first and in the second position of the cap with the battery. this makes possible it to operate the portable electronic device, if it is not plugged into the interface of the external device, namely independently of whether the protective cap in the first or in the second Position is located.

in the others are preferred embodiments the invention with reference to the drawings explained in more detail. It demonstrate:

1 a block diagram of an embodiment of a portable electronic device according to the invention,

2 a flow chart of an embodiment of a method according to the invention,

3 a block diagram of an embodiment of a portable electronic device according to the invention,

4 a schematic representation of an embodiment of a portable electronic device with attached protective cap,

5 the embodiment of the 4 with removed protective cap,

6 a schematic representation of an embodiment of a portable electronic device with attached protective cap and charging contacts,

7 the embodiment of the 6 with the protective cap in a loading position,

8th a perspective view of an embodiment of a portable electronic device with a hinged carrying handle and Protective cap,

9 the embodiment of the 8th with the protective cap in an alternative position,

10 a plan view of the embodiment of the portable electronic device of 8th and 9 .

11 the embodiment of the 10 with removed protective cap,

12 a detailed view of the embodiments of the 8th to 11 .

13 the capture of the fingerprint using the in the 8th to 11 illustrated embodiments of the portable electronic device.

In the following figure designation are corresponding to each other Elements marked with the same reference numerals.

The 1 shows a portable electronic device 100 , which can be designed in particular as a so-called USB stick. The device 100 has a plug 102 , especially a USB plug. The device 100 has one or more non-volatile memory 104 for storing authentication data 106 , biometric reference data 108 and user data 110 ,

The authentication data 106 For example, include one or more PINs to unlock a smart card 112 or various functionalities of the chip card 112 or different chip cards.

For biometric reference data 108 it may be data obtained from a fingerprint or one or more other biometric features of a user representing the user's corresponding biometric feature.

In the user data 110 It can be a variety of data, such as files, especially text, audio and / or video files, electronic documents and the like, which the user on the electronic device 100 stored in its use as a portable data carrier.

The device 100 also has a microprocessor 114 to the embodiment of program instructions 116 ,

Furthermore, the device has 100 at least one sensor 118 to capture a biometric feature of the user. At the sensor 118 it may be, for example, a fingerprint sensor, a microphone and / or a CCD camera.

The device 100 has an integrated chip card reader 120 , which is to receive the chip card 112 serves.

The device 100 may also have a push button 122 via which a user can enter the authentication data.

As a chip card 112 In the embodiment considered here, a processor chip card with a microprocessor comes 124 and an electronic memory 126 for use. The microprocessor 124 For example, it may be configured to execute program instructions for generating an electronic signature or the like. In particular, the smart card 112 a smart card operating system, which allows the execution of so-called applets, so that the smart card 112 can provide a wide variety of functionalities.

The device 100 may be related to another electronic device, such as a computer 128 be used. The computer 128 has a memory 130 to save a file 132 , Further, the computer has 128 at least one microprocessor 134 for executing program instructions 136 for the electronic signing of the file 132 as well as program instructions 138 to provide an e-mail functionality.

The computer 128 also has a serial bus interface 140 , in particular a USB interface, as well as a mobile radio interface 142 , For example, to a digital mobile network, such as a GSM, GPRS and / or UMTS network, in particular for the wireless transmission of e-mails.

To start up the device 100 the user gives the chip card 112 assigned authentication data, for example via the push button 122 one. For example, the smart card has 112 at least two functionalities, namely a functionality for generating a digital signature and a second functionality in which the smart card 112 as SIM for the mobile radio interface 142 of the computer 128 can serve. The first and the second functionality may be associated with different PINs, which the user for example via the push button 122 can enter. The authentication data containing the two PINs 106 be in the non-volatile memory 104 stored.

The entry via the push button 122 For example, can be done so that the user to enter the digit X the push button 122 Press X times in succession for less than 1 second, for example; to end the input of the digit X, the user presses the push button 122 for at least a second, then the next digit of the PIN to be entered in this manner in the device 100 enter.

Furthermore, the user detects with the help of the device 100 his biometric reference data, for example, with his finger over the sensor 118 drives so that corresponding fingerprint data as biometric reference data 108 captured and in the memory 104 get saved. It is also possible to record several biometric reference data records.

For example, the user first gives the PIN for the first functionality of the smart card 112 , ie z. As the electronic signing functionality, and then he drives with his left index finger on the sensor 118 , The resulting biometric reference data is automatically assigned to the first PIN. Thereafter, the user gives the second PIN, the SIM functionality of the smart card 112 is assigned via the push button 122 in the store 104 and then the user moves his right index finger over the sensor 118 , The biometric reference data collected by the right index finger 108 are automatically assigned to the second PIN.

To use the device 100 is the chip card 112 in the chip card reader 120 , The chip card 112 can with the smart card reader 120 be firmly connected or it must be previously in the smart card reader 120 be plugged in.

The device 100 with the chip card 112 gets into the bus interface 140 of the computer 128 with the help of the plug 102 plugged in.

To the device 100 To be able to use, the user must now biometrically authenticate against the device, for example, with his left or right index finger on the sensor 118 moves. This makes it possible to access the user data 110 writing or reading from the computer 128 from access.

When the user with his left index finger on the sensor 118 drives, by executing the program instructions 116 referring to the biometric reference data 108 recognize that there is a match with the biometric reference data associated with the first PIN. Accordingly, the first PIN is via the smart card reader 120 to the chip card 112 transferred to unlock them. On the other hand, the user moves his right index finger over the sensor 118 Thus, a match is detected with the other biometric reference data record associated with the second PIN. Accordingly, the second PIN is via the smart card reader 120 to the chip card 112 to enable their corresponding other functionality. The user can also first with the left and then with the right index finger on the sensor 118 drive to both functions of the smart card 112 switch on freely.

The user can now view the file 132 Sign by the program instructions 136 starts. These generate a hash value from the computer 128 over the bus interface 140 to the device 100 is transmitted. The hash value is over the card reader 120 in the chip card 112 which generates an electronic signature for the hash value by typing one in the memory 126 stored secret key is accessed, and the electronically signed hash value is received by the device 100 to the bus interface 140 transfer.

The electronically signed file 132 will now be wirelessly transferred to another computer via e-mail. To do this, the user starts the program instructions 138 to the signed file 132 as an attachment to an e-mail. Sending the e-mail becomes the mobile interface 142 enabled, via the bus interface 140 on the chip card 112 accesses their SIM functionality.

The 2 shows a corresponding flow chart. In the step 200 becomes the device 100 in the bus interface 140 of the computer 128 plugged. In the step 202 Become biometric data of the user using the device 100 detected. The device 100 then check if the captured biometric data is in the device 100 stored biometric reference data sufficiently match (step 204 ). If this is not the case, the device refuses 100 an access of the computer 128 (Step 206 ). The device can be accessed via a user interface 100 prompt the user for one or more additional input attempts to capture the biometric data.

If in the step 204 a sufficient agreement of the acquired biometric data with the reference data is determined in the step 208 an access to the authentication data, that is to say the PIN assigned to the reference data with which the match was determined. The PIN will be in the step 210 automatically to the chip card 112 transferred to unlock them.

• – Ein Anwendungsprogramm des Computers (vgl. Computer 128 der 1) ist so programmiert, dass es die Verwendung eines sog. Klasse 2 Kartenlesers erfordert. Wenn das Anwendungsprogramm die Chipkarte (vgl. Chipkarte 112 der 1) benötigt, sendet es über die Bus-Schnittstelle (vgl. Bus-Schnittstelle 140) eine Aufforderung an das Gerät 100 zur Eingabe der Authentisierungsdaten (vgl. Authentisierungsdaten 106) der 1, d.h. überlicherweise der PIN zum Freischalten der Karte. Bei einem üblichen Klasse 2 Kartenlesegerät muss der Benutzer daraufhin manuell seine PIN über die Tastatur des Klasse 2 Kartenlesegeräts eingeben. Im Gegensatz dazu wird der Benutzer bei einer Ausführungsform des erfindungsgemäßen Geräts 100 über eine Nutzerschnittstelle (vgl. Leuchtdioden 168 der 10 und 11) aufgefordert, sind biometrisch zu authentifizieren (vgl. Schnitt 202). Nach erfolgreicher biometrischer Authentifizierung wird dann auf die PIN zugegriffen (Schritt 208) und die PIN wird automatisch zu der Chipkarte übertragen (Schnitt 210), wodurch die Chipkarte freigeschaltet wird. Dadurch wird eine verbesserter Benutzungskomfort erreicht, da die PIN nicht bei jeder Aufforderung zur Eingabe der Authentisierungsdaten manuell eingegeben werden muß.
• – Ein Anwendungsprogramm dient zur digitalen Signierung (vgl. Programminstruktionen 136 der 1). Mit dem Empfang einer Aufforderung zur digitalen Signierung des Hash-Wertes durch das Gerät 100, wird der Benutzer über die Nutzerschnittstelle des Geräts 100 aufgefordert, sich biometrisch zu authentifizieren, so dass die PIN zu der Chipkarte übertragen wird, und diese darauf hin die digitale Signatur generiert. Die biometrische Authentifizierung hat in dieser Anwendung den Charakter einer Unterschriftsleistung.

This allows various embodiments:

• - An application program of the computer (see Computer 128 of the 1 ) is programmed to require the use of a so-called class 2 card reader. If the application program the chip card (see smart card 112 of the 1 ), sends it via the bus interface (see bus interface 140 ) a request to the device 100 for entering the authentication data (see Authentication Data 106 ) of the 1 , ie usually the PIN to unlock the card. For a standard class 2 card reader, the user must then enter his PIN manually using the class 2 card reader keyboard. In contrast, the user in one embodiment of the device according to the invention 100 via a user interface (see LEDs 168 of the 10 and 11 ) are to be biometrically authenticated (see section 202 ). After successful biometric authentication, the PIN is then accessed (step 208 ) and the PIN is automatically transferred to the chip card (section 210 ), whereby the chip card is unlocked. As a result, an improved user comfort is achieved since the PIN does not have to be entered manually each time the authentication data is requested.
• - An application program is used for digital signing (see program instructions 136 of the 1 ). Upon receiving a request to digitally sign the hash value through the device 100 , the user is through the user interface of the device 100 prompted to biometrically authenticate, so that the PIN is transferred to the smart card, and this generates the digital signature. Biometric authentication has the character of a signature service in this application.

The 3 shows a further embodiment of the device 100 , In the embodiment of the 3 is the plug 102 to power the device 100 formed with electrical energy when the device 100 in the appropriate bus interface 140 is plugged in.

The device 100 has in the embodiment of 3 an interface duplicator 144 , which can be designed in particular as a so-called USB hub.

In the embodiment considered here are the biometric reference data 108 in a biometrics system 146 stored, which contains a reference database with the biometric reference data.

Furthermore, the device has 100 a mass storage 148 for storing the user data 110 , Preferably, the mass storage is also 148 biometriekontrolliert, that is, before a read or write access to the mass storage 148 An appropriate biometric check must be carried out beforehand.

In the embodiment considered here, the program instructions include 116 , Program instructions 150 to provide a function manager, that is, to control the various functionalities of the device 100 , in particular the input and output functionalities and the user interface as well as program instructions 152 for the encryption and decryption of data.

The program instructions 152 can use a manufacturer-defined key for encryption and decryption. Alternatively or additionally, the program instructions 152 Generate a key used for encryption and decryption from one or more of the reference biometric records stored in the reference database. Preferably, they are in the memory 104 stored authentication data 106 , that is, the PINs, the biometric reference data used in the biometric system 146 stored as well as the user data 110 of the mass storage 148 stored in encrypted form.

For a data access must first be made a biometric verification by biometric data using the biometric sensor 118 be recorded. In order to check for sufficient compliance with biometric reference data of the reference database, the acquired biometric data are determined using the program instructions 152 encrypted and compared in the encrypted domain with the biometric reference data. Alternatively, the biometric reference data is decrypted for verification. Only after a successful biometric check can be on the mass storage 148 and / or the memory 104 be accessed.

The device 100 also has a radio-detection element 154 and a radio-detection element 156 which can be designed as contactless chip systems, in particular as so-called RFID tags. The radio detection elements 154 and or 156 may also be biometrically controlled. To activate the radio detection element 154 and or 156 So it may be necessary to first make a biometric check using the biometrics sensor 118 and the biometrics system 146 he follows.

• – Um den Betrieb durch die automatischen Türen zu betreten, bringt der Benutzer den Token, das heißt das Gerät 100, in die Nähe des üblicherweise hüfthoch angebrachten berührungslosen Lesers für das Funkerkennungselement 154, wobei der Leser zum Beispiel als RFID-Leser ausgebildet sein kann. Das Funkerkennungselement 154 sendet daraufhin die erforderliche Kennung und die Türen öffnen sich. Ist der Token am Gürtel des Benutzers angehängt, genügt ein nahes Vorbeigehen an dem Leser.
• – Zum Öffnen der Tür seines Arbeitszimmers hält der Benutzer den Token an das Türschloss seines Arbeitszimmers. Der in dem Türschloss des Arbeitszimmers eingebaute berührungslose Leser wird aktiviert und das Funkerkennungselement 156 sendet die Kennung zum Öffnen der Tür des Arbeitszimmers.
• – An seinem Arbeitsplatz steckt der Benutzer den Token in den USB-Port seines PCs, vgl. die Bus-Schnittstelle 140 der 1. Der PC gewährt dem Benutzer nur dann Zugriff, wenn sich der Benutzer biometrisch authentifiziert hat, indem er zum Beispiel seinen Finger über den Biometriesensor 118 streift. Damit öffnet sich auch der interne Massenspeicher 148 auf dem Nutzerdaten 110 abgelegt und transportiert werden können, die der Benutzer zum Beispiel an einer anderen Stelle (zu Hause oder auf Dienstreise) erhalten bzw. bearbeitet hat. Der für die Nutzung der Chipkarte 112, die insbesondere als Smart Card ausgebildet sein kann, benötigte PIN wird ebenfalls bereitgestellt und automatisch in die Smart Card übertragen, wenn diese dazu von den PC-Anwendungen (vgl. Programminstruktionen 136 und 138 der 1) aufgefordert wird. Das ist zum Beispiel erforderlich beim Anmelden an interne oder externe Anwendungen und Netze, wenn die entsprechenden Schlüssel dazu auf der Chipkarte hinterlegt sind. Außerdem ist dies zum Verschlüsseln von Nachrichten, wie zum Beispiel E-Mails, oder zum elektronischen Signieren erforderlich.
• – Sobald der Benutzer den Token zieht, wird sein PC automatisch gesperrt.
• – Zum Weiterarbeiten mit dem PC genügt das Einstecken und nochmaliges biometrisches Authentifizieren.
• – Auf dem Weg zur Kantine legt der Benutzer den Token in das dafür vorgesehene Fach der Geldaufladevorrichtung. Er kann jetzt einen Geldschein in die Geldaufladevorrichtung stecken und der Betrag wird auf dem Funkerkennungselement 156 gutgeschrieben. In der Kantine erhält der Benutzer den Token beim Bezahlen an den entsprechenden Leser und der jeweilige Betrag wird von dem Funkerkennungselement 156 abgebucht.
• – Zurück zum Arbeitszimmer öffnet der Benutzer wieder die Tür zu seinem Arbeitszimmer durch Anhalten des Tokens an das Türschloss an das Funkerkennungselement 156.
• – Seinen PC und seine Anwendungen öffnet der Benutzer durch Einstecken des Tokens und anschließender biometrischer Authentifizierung.
• – Am Ende des Arbeitstages speichert der Benutzer Daten zum Mitnehmen (zum Beispiel zur weiteren Bearbeitung zu Hause) auf dem in dem Token integrierten Massenspeicher 148. Der Token verschlüsselt diese Daten beim Schreiben und speichert sie verschlüsselt ab, ohne weitere Aktion des Benutzers. Sollten es besonders sensitive Daten sein, können sie zusätzlich mit dem auf der Smart Card abgelegten Schlüssel verschlüsselt werden.
• – Die automatische Ausgangstür des Betriebs öffnet der Benutzer wieder durch Annähern des Tokens an den berührungslosen Leser der automatischen Türen. Damit ist auch gleichzeitig seine Arbeitszeit erfasst und im Katastrophenfall bekannt, dass der Benutzer den Betrieb verlassen hat.
• – Zu Hause steckt der Benutzer den Token in seinen Heim-PC, welcher ein völlig anderer PC als sein Arbeitsplatz-PC mit einem anderen Betriebssystem sein kann, authentifiziert sich biometrisch und kann dann seine mitgenommenen Daten nutzen. Beim Lesen werden diese Daten, die verschlüsselt abgespeichert sind, durch den Token selbst, ohne weiteres Zutun des Benutzers, entschlüsselt und beim Schreiben wieder verschlüsselt. Selbst wenn der Token verloren gehen sollte, könnte ein Finder die Daten nicht lesen.

Through the device 100 can in the embodiment of the 3 a biometrically secured, uni will be made available to a more general identification token. The following describes a typical usage of such an identification token in a larger enterprise:

• - To enter the operation through the automatic doors, the user brings the token, that is the device 100 , in the vicinity of the usually waist-mounted contactless reader for the radio-detection element 154 For example, the reader may be designed as an RFID reader. The radio detection element 154 then sends the required ID and the doors open. If the token is attached to the belt of the user, a close passing on the reader is sufficient.
• - To open the door of his study, the user holds the token to the door lock of his study. The non-contact reader installed in the door lock of the workroom is activated and the radio detection element 156 sends the ID to open the door of the study.
• - At his workstation, the user inserts the token into the USB port of his PC, cf. the bus interface 140 of the 1 , The PC grants access to the user only when the user has biometrically authenticated, for example, by fingering the biometrics sensor 118 roams. This also opens the internal mass storage 148 on the user data 110 can be stored and transported, which the user has received or processed, for example, at another location (at home or on business trip). The one for the use of the chip card 112 , which may be designed in particular as a smart card, required PIN is also provided and automatically transferred to the smart card, if this to the PC applications (see program instructions 136 and 138 of the 1 ). This is required, for example, when logging on to internal or external applications and networks, if the corresponding keys are stored on the smart card. It is also required for encrypting messages, such as e-mail, or for electronic signing.
• - As soon as the user drags the token, his PC is automatically locked.
• - To continue working with the PC plugging and repeated biometric authentication is sufficient.
• - On the way to the cafeteria, the user places the token in the dedicated compartment of the cash-drawer. He can now put a bill in the money-drawer and the amount will be on the radio-recognition element 156 credited. In the canteen, the user receives the token when paying to the corresponding reader and the respective amount is paid by the radio-recognition element 156 charged.
• Back to the study, the user re-opens the door to his study by holding the token to the door lock on the radio detection element 156 ,
• - The user opens his PC and its applications by inserting the token and subsequent biometric authentication.
• At the end of the working day, the user stores data to be taken away (for further processing at home, for example) on the mass memory integrated in the token 148 , The token encrypts this data as it is written and stores it in encrypted form, with no further action on the part of the user. If it is particularly sensitive data, they can also be encrypted with the key stored on the smart card.
• - The automatic exit door of operation opens the user again by approaching the token to the non-contact reader of the automatic doors. This also records his working time and, in the event of a disaster, knows that the user has left the company.
• At home, the user inserts the token into his home PC, which can be a completely different PC than his workstation PC with a different operating system, authenticates himself biometrically and can then use his captured data. During reading, these data, which are stored in encrypted form, are decrypted by the token itself, without further intervention by the user, and are re-encrypted when writing. Even if the token was lost, a finder could not read the data.

The 4 shows an embodiment of the portable electronic device 100 with a protective cap 158 , The 4 shows the device 100 with the on a housing 160 of the device 100 attached protective cap 158 , The protective cap 158 serves for mechanical protection of the plug 102 , To insert the device 100 in the bus interface 140 the user pulls the protective cap 158 off, leaving the plug 102 becomes accessible, as in the 5 shown.

The 6 shows an embodiment of the device 100 , on the case 160 two mounting positions for the protective cap 158 are formed. The 6 shows the protective cap 158 in her the plug 102 covering position.

The protective cap 158 includes in the embodiment of 6 and 7 a rechargeable battery. In the mounting position of 6 can the device 100 not over the plug 102 be supplied with electrical energy, especially during transport of the device 100 , Nevertheless, functionalities of the device 100 use To be able to, the device becomes 100 from the one in the cap 158 arranged battery supplied with electrical energy. In particular, this allows the use of the biometric authentication function of the device 100 even if the device 100 not in the bus interface 150 (see. 1 ) is plugged.

For example, at least one of the radio detection elements 154 or 156 designed so that this can interact with an RFID reader only after previous biometric authentication. For biometric authentication, however, electrical energy is required which can not be supplied solely by the electromagnetic waves received by the radio-detection element. The required for the biometric authentication electrical energy is thus of the rechargeable energy of the protective cap 158 delivered.

The 7 shows the device 100 when the protective cap 158 in their alternative mounting position, ie their loading position, is located. In this mounting position, the battery of the protective cap 158 with the charging contacts 162 of the device 100 contacted on the plug 102 are arranged opposite housing side. In this mounting position of the protective cap 158 can the device 100 with his plug 102 in the bus interface 140 be plugged in, leaving the computer 128 the device 100 can supply with electrical energy. The electrical energy supplied by the computer also becomes the charge of the battery in the protective cap 158 used by over the charging contacts 162 an electric circuit is closed.

Additionally, on the protective cap 158 or on the housing 160 a switch may be arranged to turn the power on or off when the protective cap 158 in her in the 6 is shown fastening position.

The 8th shows an embodiment of the device 100 in perspective view. In the embodiment of the 8th is the protective cap 158 in a fixing position, that in the 6 corresponds shown position.

The device 100 has in the embodiment of 8th a carrying handle 164 to the device 100 for example by means of a belt carabiner or carrying strap.

The 9 shows the device 100 in the embodiment of the 8th when the protective cap 158 in her 7 corresponding fastening position is located. The carrying handle 164 can be attached to the case 160 be pivotally mounted to attach the protective cap 158 on the case 160 to facilitate or enable.

The 10 shows a plan view of the device 100 the embodiments of the 8th and 9 , The protective cap 158 is in the embodiment of the 10 in one of the 7 and 9 corresponding position.

In the embodiment of the 10 are on the case 160 in the area in front of and behind the sensor 118 guide grooves 166 educated. The guide grooves 166 serve to facilitate the recording of a fingerprint by the sensor 118 For example, the user moves his index finger along the guide grooves 166 over the sensor 118 slide.

On the same side of the housing as the sensor 118 are light emitting diodes 168 arranged, which can have different colors. Through the LEDs 168 a user interface is provided which provides the user with the operating state of the device 100 displays. For example, via the light emitting diodes 168 indicates whether a biometric reference feature has been successfully captured, biometric authentication has succeeded or failed, etc.

It is particularly advantageous that the LEDs 168 and the sensor 118 lie in the field of vision of the user, so that the user the light emitting diodes 168 and the sensor 118 can simultaneously visually capture.

The 12 shows a detailed view of a portion of the back of the housing 160 the embodiments of the 8th to 11 , In the upper edge of the case 160 a detachable housing flap is arranged, which has been removed, so that the smart card reader (see 120 of the 1 and 3 ) becomes accessible to the smart card 112 to insert into the chip card reader or pull out.

The chip card 112 can also with the device 100 be firmly connected. In this case, the device can 100 have an additional control element to switch the status of the chip card between "inserted in smart card reader" and "removed from smart card reader".

The interior of the housing 160 can also be filled with a potting compound to a non-destructive removal of individual components of the device 100 to prevent.

The 13 shows a subsection of the device 100 in the embodiments of 8th to 12 , in a use position. A user first lowers his index finger in the direction of the arrow 170 on the beginning of the guide grooves 166 then turn it in the direction of the arrow 172 over the sensor 118 to draw.

alternative Also, a sensor can be used to capture the fingerprint be in which no relative movement of the sensor and the finger is required.

100

device

102

plug

104

Storage

106

authentication data

108

reference data

110

user data

112

smart card

114

processor

116

program instructions

118

sensor

120

Smart card reader

122

push-button

124

microprocessor

126

Storage

128

computer

130

Storage

132

file

134

processor

136

program instructions

138

program instructions

140

Bus Interface

142

Mobile interface

144

Interfaces duplicators

146

biometric system

148

mass storage

150

program instructions

152

program instructions

154

Radio frequency identification element

156

Radio frequency identification element

158

protective cap

160

casing

162

charging contacts

164

carrying handle

166

guide grooves

168

LEDs

170

arrow

172

arrow

Claims (34)

Portable electronic device with - an interface ( 102 ) for access to a chip card ( 112 ) from an external device ( 128 ), - a chip card reader ( 120 ), - a non-volatile electronic memory ( 104 ) for storing authentication data ( 106 ) of a user, - a sensor ( 118 ) for capturing a biometric feature of the user, 108 . 114 . 116 ; 146 . 150 . 152 ) to check the biometric feature and to access the electronic memory ( 104 ) for the transmission of the authentication data ( 106 ) to the smart card via the smart card reader, if the verification of the biometric feature is successful in unlocking the smart cards for access by the external device. Portable electronic device according to claim 1, comprising a radio-detection element ( 154 . 158 ). Portable electronic device according to claim 2, comprising means ( 108 . 114 . 116 ; 146 . 150 . 152 ) for activating the radio-detection element as a function of the verification of the biometric feature. Portable electronic device according to claim 2 or 3, with a removable protective cap from the interface ( 158 ), wherein the protective cap carries a battery for powering the radio-detection element. Portable electronic device according to claim 4, comprising a housing ( 160 ), wherein the housing is designed for attaching the protective cap, and the housing contact elements ( 162 ) for charging the battery. Portable electronic device according to one of the preceding Claims, where the interface is a bus interface. Portable electronic device according to one of the preceding Claims, where the interface is a USB interface. Portable electronic device according to one of the preceding claims, with means ( 114 . 116 . 118 ; 146 . 150 . 152 ) for acquiring and storing a biometric reference feature ( 108 ) of the user. A portable electronic device according to claim 8, wherein the Means for detecting and storing the biometric reference feature and the means of reviewing the biometric feature are designed so that the detection, Storage and verification exclusively within the portable electronic device he follows. Portable electronic device according to one of the preceding claims, with means ( 114 . 116 . 118 ; 146 . 150 . 152 ) to capture multiple biometric features of the user. The portable electronic device of claim 10, wherein each of the biometric features a functionality to be released is assigned. Portable electronic device, which is the biometric Characteristic to a fingerprint, features of the voice, the face, the Iris and / or one or more other biometric features or a combination of such biometric features. Portable electronic device according to one of the preceding Claims, with means for detecting the user's life, wherein the transmission The authentication data only occurs when the user previously recognized as alive. A portable electronic device according to claim 13, wherein said Means for detecting the presence of a physiological feature the user is trained to do this for the user's live recognition to compare with one or more comparison values. Portable electronic device according to claim 13 or 14, wherein the means for detecting the life for measuring a pulse rate, a body temperature and / or another physiological feature of the user are. Portable electronic device according to one of the preceding claims, with means ( 152 ) for encrypting the authentication data and biometric reference data. Portable electronic device according to claim 16, with means ( 152 ) for decrypting the authentication data ( 106 ), where the decryption is done after checking the biometric feature. Portable electronic device according to claim 16 or 17, being a key for the encoding and / or decryption derived from biometric reference data. Portable electronic device with a user interface ( 166 . 168 ) arranged to be visually detected simultaneously with the sensor. Portable electronic device according to one of the preceding claims, having an input element ( 122 ) for entering the authentication data. A portable electronic device according to claim 20, wherein the input element is a one-button operating element ( 122 ). Portable electronic device according to one of the preceding Claims, with a random generator for generating the authentication data the user. Portable electronic device according to one of the preceding Claims, wherein the authentication data is automatically from the non-volatile electronic Memory deleted when the smart card is removed from the smart card reader. Portable electronic device according to one of the preceding Claims, the chip card is not non-destructive can be removed from the chip card reader. A portable electronic device according to claim 24, further comprising Operating element for switching a status of the chip card. Portable electronic device according to one of the preceding claims, having at least two radio-detection elements ( 154 . 156 ) of the same or different frequency bands. Portable electronic device according to one of the preceding Claims, with a potting compound. Portable electronic device according to one of the preceding claims with battery operated functions. A portable electronic device according to claim 28, wherein the battery operated function is a telecommunications function, in particular a wireless telephone or data transfer function, a playback function of audio and / or video data or the like. Portable electronic device according to one of the preceding claims, with a pivotable carrying handle ( 164 ). A portable electronic device according to claim 30, wherein the carrying handle is adapted to be mounted on a housing ( 160 ) of the electronic device fitted protective cap encloses when it is in a loading position. Method for activating a chip card ( 112 ) with the following steps: - checking ( 114 . 116 . 118 . 108 ) of a biometric feature of a user, - access to authentication data ( 106 ) of the user stored in a nonvolatile electronic memory ( 104 ), transmission of the authentication data to the chip card via a chip card reader ( 120 ). The method of claim 32, wherein a phy siological feature of the user is checked before the authentication data is transmitted to the smart card. Computer program product with from a processor ( 114 ) executable program instructions ( 116 ; 150 . 152 ) for carrying out a method according to claim 32 or 33.