Method and electronic device for authenticating user

Abstract

The present disclosure generally relates to a method for authenticating a user using an electronic device, wherein the electronic device includes a biometric sensing system and first, second and third control units. The present disclosure also relates to corresponding electronic devices and computer program products.

Description

Technical Field

[0001] The present disclosure generally relates to a method for authenticating a user using an electronic device, wherein the electronic device includes a biometric sensing system, and first, second, and third control units. The present disclosure also relates to corresponding electronic devices and computer program products. Background Art

[0002] Biometric technologies are increasingly being used to identify and / or authenticate the identity of a user. Biometric technologies promoted for such purposes include voice, fingerprint, iris, vein pattern and other scans. Currently, the use of fingerprint sensors to capture fingerprints has shown particular promise, for example due to their ease of integration with different types of electronic devices, such as smartphones, watches, tablets or any other type of electronic device where personalizing user interactions is beneficial. It has also been proposed to integrate such fingerprint sensors with smart card systems, potentially eliminating the need for a user to enter a PIN code when performing, for example, a financial transaction.

[0003] However, due to the mobility of the above-mentioned electronic devices, there is always a risk that the electronic devices fall into the "wrong hands" and / or are exposed to, for example, hacker attacks, the purpose of which is to tamper with or otherwise affect the biometric identification and / or authentication process.

[0004] In order to counter such attempts, attempts continue to be made to improve the biometric identification and / or authentication processes applied. However, such attempts often result in complex computational processing, thereby increasing the need to equip electronic devices with faster and more computationally powerful processing environments.

[0005] In some implementations of electronic devices of the above type where a high security and computationally powerful processing environment is desired, it has been proposed to "split" the computing performance into two parts, the first part being a high performance environment and the second part being a high security environment. The high performance environment typically has higher computing performance but lower security. Correspondingly, the high security environment, for example including a so-called secure element, typically has higher security but lower computing performance.

[0006] An example of such an implementation is disclosed in US9536131. ​​US9536131 provides an interesting approach to partitioning the computational resources required to perform biometric authentication, in particular with respect to fingerprint authentication, between a first processing unit providing the above-mentioned high performance environment and a second processing unit providing the above-mentioned high security environment. According to US9536131, the high performance first processing unit is used to perform a comparison process between an acquired fingerprint image of a user and a pre-recorded fingerprint template of a finger of the user to be authenticated.

[0007] Unfortunately, the solution proposed in US9536131 introduces some possible security risks by virtue of how the computational processing is divided between the first processing unit and the second processing unit. Summary of the invention

[0008] In view of the above-mentioned problems in the prior art, an object of the present disclosure is to provide a further balanced solution for biometric authentication of users using electronic devices, which effectively divides computing resources while maintaining high security.

[0009] According to one aspect of the present disclosure, a method for authenticating a user using an electronic device is provided, the electronic device comprising: a biometric sensing system configured to capture a biometric representation of the user; a first control unit connected to the biometric sensing system and adapted to provide a processing environment having a first security level, a second control unit arranged to communicate with the first control unit and adapted to provide a processing environment having a second security level; and a third control unit arranged to communicate with the second control unit and adapted to provide a processing environment having a third security level, wherein the second security level is lower than the first security level and the third security level, and the method comprises the following steps: acquiring a biometric representation using the biometric sensing system and the first control unit; A first control unit determines a first feature set indicative of the biometric representation; forms a protected representation of the first feature set using the first control unit; provides the biometric representation and the protected representation of the first feature set to the second control unit; determines a second feature set indicative of the biometric representation using the second control unit; provides the protected representation of the first feature set and the second feature set to the third control unit; extracts the first feature set from the protected representation of the first feature set at the third control unit to form an extracted representation of the first feature set; and authenticates the user at the third control unit based on a biometric template arrangement, the extracted representation of the first feature set, and the second feature set, wherein the biometric template arrangement represents the biometric representation of the user.

[0010] The main idea behind the present disclosure is an improved segmentation of the biometric authentication process, wherein some parts of the biometric authentication process are performed by a first control unit and some other parts of the biometric authentication process are performed by a second control unit. According to the present disclosure, a third control unit is then used for a "double match" of the first feature set and the second feature set in relation to a biometric template previously formed for the user.

[0011] Therefore, in a preferred embodiment, the second control unit is adapted to provide a higher performance environment than the performance environment provided by the first control unit.Furthermore, in a possible embodiment of the present disclosure, the first control unit and the third control unit provide a secure processing environment.

[0012] Compared to the prior art, the present disclosure allows adaptation of the biometric authentication process, wherein two separate feature extraction processes are performed by two different control units (i.e., a first control unit and a second control unit), and wherein a third control unit is arranged to perform a double matching process, wherein the results of the two feature extraction processes are compared with a biometric template arranged at the third control unit.

[0013] According to the present disclosure, the first control unit and the third control unit are represented as having a higher security level than the second control unit. The expression "higher security level" should be understood as referring to a processing environment in which trusted processing of personal data is possible, for example for performing the determination of a first feature set indicating a biometric representation and for performing a final authentication of the user. Such a processing environment (for example, made possible using a so-called security element) will provide a root of trust so that the processing running on at least the first control unit and the third control unit is performed in a controlled and trusted environment. In addition to conventional password or encryption protection, alternative security features can be introduced from both the software level and the hardware level based on, for example, an embedded security element.

[0014] To ensure that the features extracted at the first control unit are not "touched" by, for example, a third party, the first control unit forms a protected version of the first feature set. In one embodiment, the protection of the first feature set includes ensuring the integrity of the first feature set in a way that a third control unit can later verify the integrity of the first feature set.

[0015] However, in a preferred embodiment, the protection of the first feature set also includes ensuring the confidentiality (e.g., by means of encryption) and the integrity of the first feature set. Therefore, consistent with such an embodiment, it can be preferably ensured that the transmission of the first feature set and / or the second feature set between the first control unit and the third control unit and between the second control unit and the third control unit includes providing the following challenges: a challenge from the third control unit to the first control unit, and a challenge from the third control unit to the second control unit. The implementation of such a "challenge-response" process can, for example, be carried out in accordance with known processes.

[0016] As an alternative (or in addition), a timestamp may be allowed to be included in the protected first feature set, wherein the timestamp may be used to ensure the "freshness" of the first data set provided from the first control unit to the third control unit. That is, for example, the timestamp may be compared to a "time threshold", wherein the first feature set may be discarded if it is, for example, "too old". In this case, the double match will not succeed because no first feature set is "available" in the matching process involving the first biometric template.

[0017] In an embodiment of the present disclosure, the biometric template arrangement includes a first biometric template portion (T vl ) and the second biometric template portion (T vh ). Thus, the authentication process may involve comparing / matching the first feature set with the first biometric template portion, and comparing / matching the second feature set with the second biometric template portion. Thus, in one embodiment, the "structure" of the first template portion is matched to the "structure" of the first biometric template portion (and similarly for the second feature set and the second biometric template portion), for example, for the purpose of ensuring efficient comparison / matching therebetween.

[0018] In a preferred embodiment of the present disclosure, the user is authenticated based on a first comparison between the extracted representation of the first feature set and the first biometric template portion and a second comparison between the second feature set and the second biometric template portion. Thus, the user is authenticated only when both the first comparison and the second comparison are indicated as successful.

[0019] Consistent with the present disclosure, the feature extraction process implemented by the first control unit may be allowed to be "computationally lighter" than the feature extraction process implemented by the second control unit because in a typical embodiment the second control unit (as described above) is adapted to provide a higher performance environment than that provided by the first control unit.

[0020] Thus, by means of the present disclosure, it is possible to enable advanced authentication processes with high computational requirements, while still ensuring that the authentication process has a higher security and a lower risk of successful hacker attacks compared to the prior art. In addition to the above, it will of course be appreciated that the general segmentation of the authentication process may also be very useful in the implementation of electronic devices (e.g. in connection with smart card implementations) where the capabilities of the security process are limited due to cost and / or real estate reasons.

[0021] In the context of the present disclosure, the expression "control unit" should be understood to include any type of computing device, such as an ASIC, a microprocessor, etc. It should also be understood that the actual implementation of such a control unit may be divided between multiple elements / devices / circuits, still collectively referred to as a control unit. Preferably, the second control unit is arranged to be separate from the first control unit.

[0022] In the event that the user is successfully authenticated, in accordance with the present disclosure, at least one action may be performed. Such an action may, for example, be directed to an electronic device to allow the user to perform further operations using the electronic device, such as when the electronic device is a mobile phone or tablet. Of course, the at least one action may be any type of action that is appropriately used when it is necessary to authenticate the user (e.g., to allow a financial transaction to be conducted). In the event of a successful authentication, the first biometric template may also be updated based on at least one of the first feature set and the second feature set.

[0023] In an exemplary embodiment of the present disclosure, the first control unit is connected to the biometric sensing system and is configured to control the operation of the biometric sensing system. This implementation may be useful, for example, in the following situations: the electronic device is the mentioned mobile phone / tablet, laptop computer, etc.

[0024] Based on the fact that the first control unit is slightly "weaker" than the second control unit from a computational perspective, in some embodiments it may be advantageous to determine the first feature set based on sub-portions of the biometric representation. According to the present disclosure, sub-portions may be considered to include, for example, cropping, decimation, or truncation processing to reduce the amount of data to be processed. Thus, a reduced amount of information is processed to determine the first feature set, thereby potentially balancing the computational power of the first control unit.

[0025] In a possible implementation, a sub-part of the biometric representation is selected by the first control unit. This implementation again does not allow any third party to participate in the selection of which information is further used, in contrast to the main / first biometric template. Preferably, this selection is allowed to be at least partially random, or at least different for different biometric representations (e.g. different for consecutive authentications of a user's biometric representation).

[0026] In order to further ensure sufficient security of the authentication process, in some embodiments, a shared symmetric integrity protection key (K) may be arranged, which is used to protect and extract the first feature set. Accordingly, regarding the transmission of the second feature set between the second control unit and the third control unit, another different symmetric integrity protection key may be used for the same purpose.

[0027] It should be understood that, as an alternative, with respect to at least one of the first feature set and the second feature set consistent with the above discussion, a scheme based on asymmetric cryptography may be used for achieving appropriate integrity protection.

[0028] In a preferred embodiment of the present disclosure, the biometric sensing system is configured to capture a fingerprint representation of a fingerprint pattern of a user's finger. Consistent with such an embodiment, the expression "representation of a fingerprint pattern of a user's finger" or "fingerprint image" should be interpreted broadly and include a conventional "visual image" of a fingerprint of a finger as well as a set of measurements related to the finger when acquired using a fingerprint sensor. Multiple fingerprint representations / images may then be acquired and fused together, wherein the resulting information is used as input for determining a feature set.

[0029] The mentioned fingerprint sensors may be implemented using any kind of current or future fingerprint sensing principles including, for example, capacitive sensing technology, optical sensing technology, or thermal sensing technology and combinations thereof. Both one-dimensional and two-dimensional sensors are possible and within the scope of the present disclosure.

[0030] In another possible implementation of the present disclosure, the biometric sensing system is configured to capture at least one of an image of a user and an iris representation of a user. Likewise, for example, a camera device or other device may be used to capture, for example, an image of a user or an iris of a user. Other implementations are possible for obtaining, for example, an iris representation of a user.

[0031] According to another aspect of the present disclosure, an electronic device is provided, comprising: a biometric sensing system configured to capture a biometric representation of a user; a first control unit connected to the biometric sensing system and suitable for providing a processing environment with a first security level; and a second control unit arranged to communicate with the first control unit and suitable for providing a processing environment with a second security level, wherein the electronic device is suitable for performing the following operations: acquiring a biometric representation using the biometric sensing system and the first control unit; determining a first feature set indicating the biometric representation using the first control unit; forming a protected representation of the first feature set using the first control unit; and providing the biometric representation and the protected representation of the first feature set to the The second control unit includes: a first control unit and a second control unit; determining a second feature set indicative of the biometric representation using the second control unit; providing the protected representation of the first feature set and the second feature set to a third control unit, wherein the third control unit is arranged to communicate with the second control unit and is adapted to provide a processing environment having a third security level, the second security level being lower than the first security level and the third security level; extracting the first feature set from the protected representation of the first feature set at the third control unit to form an extracted representation of the first feature set; and authenticating the user at the third control unit based on a biometric template arrangement, the extracted representation of the first feature set, and the second feature set, wherein the biometric template arrangement represents the biometric representation of the user. This aspect of the disclosure provides similar advantages to those discussed above with respect to the previous aspects of the disclosure.

[0032] In one embodiment, the electronic device further comprises a third control unit. Alternatively, the third control unit may be arranged away from the electronic device.

[0033] According to another aspect of the present disclosure, there is provided a computer program product comprising a computer-readable medium having stored thereon a computer program device for controlling an electronic device, the electronic device comprising: a biometric sensing system configured to capture a biometric representation of the user; a first control unit connected to the biometric sensing system and adapted to provide a processing environment having a first security level; a second control unit arranged to communicate with the first control unit and adapted to provide a processing environment having a second security level; and a third control unit arranged to communicate with the second control unit and adapted to provide a processing environment having a third security level, wherein the second security level is lower than the first security level and the third security level, and the computer program product comprises: code for acquiring a biometric representation using the biometric sensing system and the first control unit; and code for code for determining, using the first control unit, a first feature set indicative of the biometric representation; code for forming, using the first control unit, a protected representation of the first feature set; code for providing the biometric representation and the protected representation of the first feature set to the second control unit; code for determining, using the second control unit, a second feature set indicative of the biometric representation; code for providing the protected representation of the first feature set and the second feature set to the third control unit; code for extracting, at the third control unit, the first feature set from the protected representation of the first feature set to form an extracted representation of the first feature set; and code for authenticating the user at the third control unit based on a biometric template arrangement, the extracted representation of the first feature set, and the second feature set, wherein the biometric template arrangement represents the biometric representation of the user. Again, this aspect of the disclosure provides similar advantages to those discussed above with respect to the previous aspects of the disclosure.

[0034] Further features and advantages of the present disclosure will become apparent when studying the attached claims and the following description. Those skilled in the art realize that different features of the present disclosure can be combined to create embodiments other than those described below, without departing from the scope of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Various aspects of the present disclosure, including specific features and advantages of the present disclosure, will be readily understood from the following detailed description and accompanying drawings, in which:

[0036] Figure 1A and Figure 1B shows example implementations of different electronic devices according to currently preferred embodiments of the present disclosure,

[0037] Figure 2 Schematically shows the inclusion of Figure 1A and 1B An example of a fingerprint sensor array in an electronic device is shown,

[0038] Figure 3A Conceptually shows the Figure 1A and Figure 1B An architectural block structure implemented at the electronic device shown and consistent with the present disclosure, and Figure 3B shows an alternative distributed architecture consistent with the present disclosure,

[0039] Figure 4 A detailed message diagram describing an implementation of the authentication process is presented, and

[0040] Figure 5 is a flow chart disclosing exemplary steps of the present disclosure. DETAILED DESCRIPTION

[0041] The present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, in which currently preferred embodiments of the present disclosure are shown. However, the present disclosure may be implemented in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided for thoroughness and completeness, and to fully convey the scope of the present disclosure to the skilled person. The same reference numerals refer to the same features throughout.

[0042] Turning now to the drawings, in particular Figure 1A , schematically illustrates a first example of an electronic device according to the present disclosure in the form of a mobile phone 100 having an integrated biometric sensing system and a display unit 104 with a touch screen interface 106. In this embodiment, the biometric sensing system is illustrated as a fingerprint sensor arranged on the front side of the mobile phone 100. The fingerprint sensor 102 may, for example, be used to unlock the mobile phone 100 and / or for authorizing transactions performed using the mobile phone 100. As an alternative, the biometric sensing system may, for example, be arranged to include a camera device (or the like) arranged to capture an image of, for example, the face or iris of a user for authentication of the user.

[0043] Preferably, and as will be apparent to the skilled person, Figure 1AThe mobile phone 100 shown in the figure also includes: a first antenna for WLAN / Wi-Fi communication, a second antenna for telecommunication communication, a microphone, a speaker, and a phone control unit. Of course, the mobile phone may include additional hardware features. In addition, it should be noted that the present disclosure may be applied in connection with any other type of portable electronic device, such as a laptop computer, a remote control, a tablet computer, or any other type of current or future similarly configured device.

[0044] exist Figure 1B , a second example of an electronic device according to the present disclosure is shown in the form of a smart card 100', integrating a biometric sensing system, the biometric sensing system comprising a fingerprint sensor 102, the fingerprint sensor 102 comprising a plurality of sensing features and configured for capturing a fingerprint representation of a fingerprint pattern of a user's finger, and a control unit device 108, the fingerprint sensor 102 comprising a plurality of sensing features and configured for capturing a fingerprint representation of a fingerprint pattern of a user's finger, the control unit device 108 being connected to the fingerprint sensor 102 and configured to control the operation of the fingerprint sensor 102. In this embodiment, the fingerprint sensor 102 is arranged on the front side of the smart card 100'. However, the fingerprint sensor 102 may alternatively (or in addition) be arranged on the back side of the smart card 100'. The fingerprint sensor 102 may, for example, be used to authenticate a user when performing a payment / transaction, for example, allowing the smart card 100' to interact with, for example, a POS terminal once the user's finger has been enrolled. Furthermore, the smart card 100' may integrate a plurality of contact plates 110 which are electrically connected to at least the control unit 108, allowing a wired connection to be provided to a POS terminal if / when the smart card 100' is inserted into a card slot provided in the POS terminal.

[0045] In addition, in some embodiments, the smart card 100' may also include a user interface, such as a light source 112 (e.g., a light emitting diode, LED) integrated with the smart card and arranged to be electrically connected to the control unit device 108. Further, the smart card 100' preferably includes a device (not shown) for allowing wireless interaction with the POS terminal, such as being suitable for allowing near field communication (NFC) between the smart card 100' and the POS terminal. Therefore, when using wireless communication, the user does not need to insert the smart card 100' into the card slot of the POS terminal. The NFC connection between the smart card 100' and the POS terminal can also provide power to the smart card 100' in a manner known to the skilled person.

[0046] The control unit device 108 is preferably arranged to communicate with or include a memory such as a database, for example for storing one or more fingerprint templates for one or more fingers of a user. The control unit device 108 may include one or more microprocessors, microcontrollers, programmable digital signal processors or other programmable devices. The control unit device 108 may also or alternatively include one or more application specific integrated circuits, programmable gate arrays or programmable array logic, programmable logic devices or digital signal processors.

[0047] In the case where the control unit device 108 includes a programmable device such as a microprocessor, a microcontroller, or a programmable digital signal processor as described above, the processor may also include computer executable code that controls the operation of the programmable device. It should be understood that all or some of the functionality provided by means of the control unit device 108 may be at least partially integrated with the fingerprint sensor 102. With respect to the present disclosure, the processing performed by the control unit device 108 is partially divided between the first control unit 302, the second control unit 304, and the third control unit 306, as will be further elaborated below with respect to FIG. 3.

[0048] Further references Figure 2 , conceptually illustrating a slightly enlarged view of the fingerprint sensor 102. In the case of employing capacitive sensing technology, the fingerprint sensor 102 is configured to include a large number of sensing features, preferably arranged in a two-dimensional array. The size of the two-dimensional array may depend on the planned implementation, and 160×160 pixels are used in an embodiment. Other sizes are certainly possible, and are within the scope of the present disclosure, including two-dimensional arrays with fewer pixels than the examples described above. Figure 2 A single sensing element (also denoted as a pixel) is indicated by reference numeral 202. However, as indicated above, it should be understood that the present disclosure may also be applied to other types of fingerprint sensing technologies, such as optical sensing technologies, or thermal sensing technologies, and combinations thereof. Both one-dimensional sensors and two-dimensional sensors are possible and within the scope of the present disclosure.

[0049] Now go to Figure 3A Combined with Figure 4 and Figure 5 , conceptually illustrating possible implementations of a generalization of concepts provided according to the present disclosure. Figure 3A The examples shown can generally be applied to Figure 1A and Figure 1B Both the illustrated examples of electronic devices 100, 100' are applicable, for example, to both mobile phone and smart card examples.

[0050] As shown above, the control unit device 108 provided by the electronic device 100, 100' includes a first control unit 302, a second control unit 304 and a third control unit 306. According to the present disclosure, the first control unit 302 is arranged to communicate with the fingerprint sensor 102. At least one of the first control unit 302 and the third control unit 306 may include a security element.

[0051] According to the present disclosure, the second control unit 304 is arranged to communicate with the first control unit 302 and the third control unit 306. According to the present disclosure, the first control unit 302 is arranged to provide a processing environment with a higher security level at least compared to the second control unit 304. Likewise, in a typical embodiment, the third control unit is arranged to have a higher security level at least compared to the second control unit 304. The third control unit 306 is further arranged to communicate with or include a storage element 308, for example including a database of previously registered representations (or fingerprint templates) of a user's finger (to be authenticated). According to the present disclosure, it is desirable to allow access to the storage element 308 only using the third control unit 306.

[0052] During operation of the electronic device 100, 100', and consistent with the illustration provided in Figure 3, the first control unit 302 is arranged to, in cooperation with the fingerprint sensor 102, obtain a fingerprint image of the user's finger once the user's finger is placed near the fingerprint sensor 102 or in contact with the fingerprint sensor.

[0053] Based on the fingerprint image, the first control unit 302 determines that a first set of characteristic features indicative of a fingerprint pattern of the user is present within the acquired fingerprint image.Different techniques for extracting characteristic fingerprint features are possible and within the scope of the present disclosure.

[0054] The first control unit 302 then forms a protected representation of the first feature set. By means of forming a protected representation of the first feature set, the integrity of the first feature set may be ensured. Such integrity of the first feature set may also comprise ensuring the freshness of the first feature set, meaning that a (comparatively) "old" version of the first feature set cannot in practice be used to authenticate the user. That is, in case, for example, a hacker intends to exploit an old version of the first feature set, he will not succeed, since the first feature set (by means of integrity protection) may be adapted to, for example, comprise a timestamp (or the like), which timestamp (or the like) may be verified in the authentication step (as will be discussed further below).

[0055] like Figure 4As shown, for example, a challenge-response process can be used to ensure integrity. In this embodiment, it is assumed that pre-configuration has been performed before the actual data transmission between the control units 302, 304, 306. For example, the pre-shared symmetric key K can be securely stored in the sensor / first control unit 302 and at the third control unit 306. In addition, in such an embodiment, the third control unit 306 is preferably adapted to securely store at least one pair of registration templates of the user in the associated storage element 308, namely: T vh , T vl .

[0056] about Figure 4 , using the following symbols:

[0057] End-user high-resolution biometric images: I h

[0058] End-user low-resolution biometric images: I l

[0059] Biometric High Resolution Validation Template: T vh

[0060] Biometric low-resolution verification template: T vl

[0061] Biometric high-resolution recognition template: T IDh

[0062] Biometric low-resolution recognition template: T IDl

[0063] Shared symmetric integrity protection key (between the sensor and the highly protected system): K

[0064] Message authentication, with a symmetric key K and a message m as input: a = MAC(K, m), and

[0065] Concatenation of two binary parameters: ||

[0066] The protected representation of the first feature set and the fingerprint image will then be provided to the second control unit 304. In an embodiment of the present disclosure, the second control unit 304 may be represented, for example, by a "common" control unit included in the electronic device 100, 100', such as a common processor for overall processing and control of the mobile phone 100 (e.g., handling calls, display, etc.).

[0067] Then, the second control unit 304 determines a second feature set representing the fingerprint image. The second feature set typically includes "more information" compared to the first feature set. That is, since the first control unit 302 typically has less computing power compared to the second control unit 304, it is desirable according to the present disclosure to, for example, adjust the feature determination process so as to be different for the first control unit 302 compared to the second control unit 304. Thus, in an embodiment of the present disclosure, the first control unit 302 may, for example, be adapted to process only a sub-portion of the fingerprint image for determining the first feature set. Conversely, the second control unit 304 may then be adapted to form a second feature set based on (substantially) all acquired fingerprint images.

[0068] The second control unit 304 then provides the protected representation of the first feature set and the second feature set to the third control unit 306. The third control unit 306 then extracts the first feature set from the protected representation of the first feature set, thereby forming an extracted representation of the first feature set. Therefore, the first control unit 302 and the third control unit 306 can, for example, employ at least one of a symmetric or asymmetric cryptographic scheme to ensure the integrity of the first feature set. Therefore, once extracted at the third control unit 306, the selected cryptographic scheme can be used to ensure that the first feature set is "fresh" (e.g., based on the mentioned timestamp or the like), and that the first feature set is "untouched" when relayed from the first control unit 302 to the third control unit 306 (i.e., "passing through" the second control unit 304).

[0069] Then, the third control unit 306 authenticates the user. In accordance with the present disclosure, the authentication is preferably implemented as a "double match", which means that the user is authenticated only if both the first feature set and the second feature set correctly match the previously registered fingerprint template stored at the storage element 308. In an embodiment of the present disclosure, for example, the storage element 308 may be allowed to store the first fingerprint template portion (T corresponding to the structure of the extracted representation of the first feature set) vl ) and a second biometric template portion (T corresponding to the structure of the second feature set vh ) Both. In this way, two separate matching processes can be performed, wherein the user is authenticated only if both matching processes are successful. In addition, consistent with the above-mentioned freshness, timestamp information can additionally be used as a component of the authentication process.

[0070] In case there is a "double match", the third control unit 306 may output an authentication signal. The authentication signal may then be used, for example, to unlock the mobile phone 100 or the smart card 100'.

[0071] It should be understood within the scope of the present disclosure that the third control unit 306 does not necessarily have to be arranged as a component integrated with the electronic device. Figure 3B As illustrated in , the third control unit 306 may be arranged separately (e.g., remotely) from the electronic device 306. For example, in one embodiment, the third control unit 306 may be a server arranged to communicate with the second control unit 304 (e.g., using network communication 310). In such an embodiment, Figure 4 The message diagram illustrated in can also be adapted to correspond to such an implementation.

[0072] The control function of the present disclosure can be implemented using an existing computer processor, or implemented by a dedicated computer processor of a suitable system combined for this purpose or other purposes, or implemented by a hard-wired system. Implementations within the scope of the present disclosure include program products, which include machine-readable media, which are used to carry or store machine-executable instructions or data structures thereon. Such machine-readable media can be any available medium that can be accessed by a general or special-purpose computer or other machine with a processor. For example, such machine-readable media can include RAM, ROM, EPROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage device, or any other medium, which can be used to carry or store the desired program code in the form of machine-executable instructions or data structures and can be accessed by a general-purpose computer or a special-purpose computer or other machine with a processor. When information is transmitted or provided to a machine through a network or other communication connection (hard-wired, wireless, or a combination of hard-wired or wireless), the machine appropriately regards the connection as a machine-readable medium. Therefore, any such connection is appropriately referred to as a machine-readable medium. The above combination is also included in the scope of the machine-readable medium. Machine-executable instructions comprise, for example, instructions and data which cause a general purpose computer, special purpose computer, or special purpose processing machines to perform a certain function or group of functions.

[0073] Although the accompanying drawings may show a sequence, the order of the steps may be different from the sequence depicted. Likewise, two or more steps may be performed simultaneously or partially concurrently. Such variations will depend on the software system and hardware system selected and the designer's choice. All such variations are within the scope of the present disclosure. Likewise, software implementation can be achieved through standard programming techniques, which have rule-based logic and other logic to achieve various connection steps, processing steps, comparison steps and decision steps. Additionally, even though the present disclosure has been described with reference to the specific exemplary embodiments of the present disclosure, many different changes, modifications, etc. will become apparent to those skilled in the art.

[0074] In addition, according to the study of the drawings, the disclosure and the appended claims, those skilled in the art can understand and implement the variations of the disclosed embodiments when practicing the claimed disclosure. In addition, in the claims, the word "comprising" does not exclude other elements or steps, and the indefinite article "a" or "an" does not exclude a plurality.

Claims

1. A method for authenticating a user using an electronic device, the electronic device comprising: - a biometric sensing system configured to capture a biometric representation of the user, - a first control unit connected to said biometric sensing system and adapted to provide a processing environment having a first security level, a second control unit arranged to communicate with said first control unit and adapted to provide a processing environment having a second security level, and - a third control unit arranged to communicate with said second control unit and adapted to provide a processing environment having a third security level, The second safety level is lower than the first safety level and the third safety level, and the method comprises the following steps: - acquiring a biometric representation using said biometric sensing system and said first control unit, - determining, using said first control unit, a first set of features indicative of said biometric representation, - forming a protected representation of said first feature set using said first control unit, - providing said biometric representation and a protected representation of said first set of characteristics to said second control unit, - determining, using the second control unit, a second set of features indicative of the biometric representation, wherein the first set of features is determined from a comparatively low-resolution biometric representation compared to the determination of the second set of features, - providing a protected representation of said first feature set and said second feature set to said third control unit, - extracting, at said third control unit, said first feature set from a protected representation of said first feature set, thereby forming an extracted representation of said first feature set, and - authenticating the user at the third control unit based on a combination of a biometric template arrangement, an extracted representation of the first feature set and the second feature set, wherein the biometric template arrangement is stored using a storage element associated with the third control unit and represents a biometric representation of the user.

2. The method according to claim 1, wherein: The step of extracting a protected representation of the first set of features comprises providing a challenge from the third control unit to the first control unit.

3. The method according to claim 2, wherein: The challenge is relayed by the second control unit.

4. The method according to claim 1, wherein: The step of forming a protected representation of the first feature set includes causing the protected representation of the first feature set to include a timestamp.

5. The method according to claim 4, wherein: The step of authenticating the user also depends on the timestamp.

6. The method according to claim 1, wherein: The first control unit and the third control unit are adapted to provide a secure processing environment.

7. The method according to claim 1, wherein: The first control unit is configured to control the operation of the fingerprint sensing system.

8. The method according to claim 1, wherein: The second control unit is a universal control unit for the electronic device and is also adapted to at least partially control a display screen included in the electronic device.

9. The method according to claim 1, wherein: The biometric template arrangement comprises a first biometric template portion (T vl ) and the second biometric template portion (T vh ).

10. The method according to claim 9, wherein: - the first biometric template portion (T vl ) corresponds to the structure of the extracted representation of the first feature set, and - the second biometric template portion (T vh ) corresponds to the structure of the second feature set.

11. The method according to any one of claims 9 and 10, wherein: The user is authenticated based on a first comparison between the extracted representation of the first feature set and the first biometric template portion and a second comparison between the second feature set and the second biometric template portion.

12. The method according to claim 11, wherein: If both the first comparison and the second comparison are indicated as successful, the user is authenticated.

13. The method according to claim 1, further comprising the steps of: - forming a protected representation of said second feature set using said second control unit, and - extracting, at said third control unit, said second feature set from a protected representation of said second feature set, thereby forming an extracted representation of said second feature set.

14. The method according to claim 13, wherein: A protected representation of the second set of features is formed using a key that is different from a key used to form the protected representation of the first set of features.

15. The method according to claim 1, wherein: The first feature set includes less information than the second feature set.

16. The method according to claim 1, wherein: The first set of features is determined based on a sub-portion of the biometric representation.

17. The method according to claim 16, wherein: The sub-portion of the biometric representation is selected by the first control unit.

18. The method according to claim 1, wherein: The second control unit is arranged separately from the first control unit and the third control unit.

19. The method according to claim 1, wherein: The third control unit is arranged separately from the first control unit and the second control unit.

20. The method according to claim 1, wherein: The electronic device further comprises the storage element associated with the third control unit, the storage element being used to store a fingerprint template arrangement.

21. The method according to claim 1, wherein: The first control unit and the third control unit share a symmetric integrity protection key (K), and the symmetric integrity protection key (K) is used to protect and extract the first feature set.

22. The method according to claim 1, wherein: The first control unit and the third control unit are adapted to apply a scheme based on asymmetric cryptography for integrity protection of at least one of the first feature set and the second feature set.

23. The method according to claim 1, wherein: The biometric sensing system is configured to capture a fingerprint representation of a fingerprint pattern of a finger of the user.

24. The method according to claim 1, wherein: The biometric sensing system is configured to capture at least one of an image of the user and an iris representation of the user.

25. An electronic device comprising: - a biometric sensing system configured to capture a biometric representation of a user, - a first control unit connected to said biometric sensing system and adapted to provide a processing environment having a first security level, and - a second control unit arranged to communicate with said first control unit and adapted to provide a processing environment having a second security level, Wherein, the electronic device is suitable for performing the following operations: - acquiring a biometric representation using said biometric sensing system and said first control unit, - determining, using said first control unit, a first set of features indicative of said biometric representation, - forming a protected representation of said first feature set using said first control unit, - providing said biometric representation and a protected representation of said first set of characteristics to said second control unit, - determining, using the second control unit, a second set of features indicative of the biometric representation, wherein the first set of features is determined from a comparatively low-resolution biometric representation compared to the determination of the second set of features, - providing the protected representation of the first feature set and the second feature set to a third control unit, wherein the third control unit is arranged to communicate with the second control unit and is adapted to provide a processing environment having a third security level, the second security level being lower than the first security level and the third security level, - extracting, at said third control unit, said first feature set from a protected representation of said first feature set, thereby forming an extracted representation of said first feature set, and - authenticating the user at the third control unit based on a combination of a biometric template arrangement, an extracted representation of the first feature set and the second feature set, wherein the biometric template arrangement is stored using a storage element associated with the third control unit and the biometric template arrangement represents a biometric representation of the user.

26. The electronic device according to claim 25, further comprising the third control unit.

27. The electronic device according to claim 25, wherein: The third control unit is arranged remote from the electronic device.

28. The electronic device according to claim 25, wherein: The electronic device is at least one of a mobile phone, a tablet computer, a wearable electronic device, and a smart card.

29. The electronic device according to claim 25, wherein: The biometric sensing system includes a fingerprint sensing device using at least one of optical sensing technology, thermal sensing technology, and ultrasonic sensing technology.

30. The electronic device according to claim 25, wherein: The biometric sensing system includes means for acquiring at least one of an image of the user and an iris representation of the user.

31. A computer program product comprising a non-transitory computer readable medium having stored thereon computer program means for operating an electronic device, the electronic device comprising: - a biometric sensing system configured to capture a biometric representation of a user, - a first control unit connected to said biometric sensing system and adapted to provide a processing environment having a first security level, a second control unit arranged to communicate with said first control unit and adapted to provide a processing environment having a second security level, and - a third control unit arranged to communicate with said second control unit and adapted to provide a processing environment having a third security level, The second security level is lower than the first security level and the third security level, and the computer program product comprises: - code for acquiring a biometric representation using said biometric sensing system and said first control unit, - code for determining, using said first control unit, a first set of features indicative of said biometric representation, - code for forming a protected representation of said first feature set using said first control unit, - code for providing said biometric representation and a protected representation of said first set of characteristics to said second control unit, - code for determining, using the second control unit, a second set of features indicative of the biometric representation, wherein the first set of features is determined based on a comparatively low-resolution biometric representation compared to the determination of the second set of features, - code for providing a protected representation of said first feature set and said second feature set to said third control unit, - code for extracting, at said third control unit, said first feature set from a protected representation of said first feature set, thereby forming an extracted representation of said first feature set, and - code for authenticating the user at the third control unit based on a combination of a biometric template arrangement, an extracted representation of the first feature set and the second feature set, wherein the biometric template arrangement is stored using a storage element associated with the third control unit and the biometric template arrangement represents a biometric representation of the user.

Images