The invention is explained in the following using the exemplary embodiments shown in the drawings.
In order to start the process according to the invention, the Internet page required for releasing the access is called with the personal computer 2 and the portable data carrier 1 is inserted into a port of the USB interface 7 of the personal computer 2 and activated as a result. As represented by a block B1, the user then enters a user ID on the called Internet page. The input can take place in such a manner, e.g., that the user transmits the user ID to the Internet page from a public area of the non-volatile memory 4 of the portable data carrier 1. This is represented as block B2. The public area of the non-volatile memory 4 is accessible from outside the portable data carrier 1. Therefore, commands available on a customary personal computer 2 such as “copy” or “cut” and “insert” can be used for the transmission. Alternatively, for transmission from the non-volatile memory 4 of the portable data carrier 1, it is also possible to enter the user ID via a keyboard of the personal computer 2 into the Internet page. In a further variant, the inputting of the user ID is entirely eliminated.
As the next action, a random number generated by an associated server is displayed on the Internet page. This is illustrated by a block B3. According to a block B4, the random number is transmitted by the user by the commands “cut” and “insert” from the Internet page into the public area of the non-volatile memory 4 of the portable data carrier 1. A Block B5 illustrates that the random number is used as input for generating a response, shown as a block B6, of the portable data carrier 1. However, as is indicated by a block B7, the response is only generated in case of a successful authentication of the user. The authentication takes place in the present exemplary embodiment of the process according to the invention by means of a verification of a fingerprint of the user. The user initiates the verification according to block B8, e.g., by placing a finger on the fingerprint sensor 5 or by executing a program in the non-volatile memory 4 of the portable data carrier 1. The fingerprint sensor 5 takes a picture whose features are extracted and compared with stored reference features. Alternatively, the authentication of the user can take place by inputting a personal identification number. After a successful authentication, the portable data carrier 1 generates the response. The random number is taken into account during the generation of the response. For example, a digital signature of the seized random number is computed for generating the response.
As represented by a block B9, the response is made available in the public area of the non-volatile memory 4 of the portable data carrier 1. According to block B10, the user transmits the response from the non-volatile memory 4 of the portable data carrier 1 onto the Internet page by using the commands “cut” and “insert”. A block B11 indicates that the associated server verifies the correctness of the response and accordingly releases the access for the user.
If no security requirements that are too high are to be filled, a simplified variant of the process according to the invention without a random number can also be used. In this variant, the fingerprint of the user is again verified. In the case of a positive result, a one-time password is generated by the portable data carrier 1 and filed in the public area of the non-volatile memory 4 of the portable data carrier 1. The user transmits the one-time password onto the Internet page in the manner already described. The access for the user is thereupon released for a given time period. A further simplification of the process according to the invention can also be achieved in the variant in such a manner that, instead of the fingerprint, a personal identification number is used to authenticate the user. In this instance, an executable program is filed in the public area of the non-volatile memory 4 of the portable data carrier 1 that requests the inputting of the personal identification number of the user. The value entered by the user for the identification number is compared with a reference value and, if there is a coincidence, a one-time password is again generated, then is filed in the public area of the non-volatile memory 4 of the portable data carrier 1 and is transmitted from there by the user to the Internet page.
A browser implemented as an executable program in the portable data carrier 1 can also be used when carrying out the process according to the invention. The Internet pages via which the access can be released by the user can be saved as “favorites”. It is not necessary in this variant to have recourse to the browser of the personal computer 2 and to use its security settings.
In all the process variants, security-relevant operations are executed by the security chip 6 and information to be kept secret is stored in the security chip 6. In particular, it can be provided that a biometric reference data set, which can be entirely or partially compared in integrated circuit 3 with current biometric raw data, is stored in the security chip 6.
When the portable data carrier 1 designed according to
If the program recognizes a password-protected application or Internet page again for the first time, it can suggest the automatic registering of the login information to the user. Depending on the configuration settings of the program, the entry of the login information can automatically take place at the next calling if the user is authenticated relative to the token. Alternatively, the program can request the placement of the finger.
Otherwise, the process according to the invention described using
An important aspect of all variants of the process according to the invention is that it is not necessary to install software solely for the process on the personal computer 2. Standard software of the personal computer 2 and/or software implemented on the portable data carrier 1 can be used for carrying out the process.
Number | Date | Country | Kind |
---|---|---|---|
103 59 680.1 | Dec 2003 | DE | national |
Filing Document | Filing Date | Country | Kind | 371c Date |
---|---|---|---|---|
PCT/EP04/14237 | 12/14/2004 | WO | 00 | 5/14/2007 |