Control and secure data access method

Abstract

The invention relates to the field of computing. The technical result consists in increased security of presented data. The technical result is achieved in that to gain access and execute commands, a digital file is generated on the basis of unique user data (Object 2) and stored in the memory of an information system, said file being a digital representation of Object 2 (DRO 2); the information system carries out a procedure for the comparison and recognition of the presented DRO 2 in a database of DROs; on the basis of DRO 2 data obtained by the working of recognition algorithms, a digital file that constitutes a potential public key for gaining access to the resources of the information system is generated and saved; authentication is carried out by comparing a secret key with said potential public key; if the comparison results in a predetermined number of matches, the user is granted access to the resources of the information system in the given session and additional commands related to the secret key are executed, otherwise access is denied; when keys are generated by different algorithms in different information systems, identification is enabled using software.

Description

[0001] Method of managing and securing access to data

[0002] The proposed invention relates to the field of digital data processing and data management systems, and more specifically, to methods of secure access to data, authentication of users of data processing systems, and remote user authentication. The technical solution will find application as a system of access to information, to work on a computer, as a control unit on a locking electronic device, as an identifier in tracking and security systems, as a trigger for the operation of a script and household appliances, etc.

[0003] Various technical solutions are known in the area under consideration.

[0004] Thus, the patent application US 2017 / 0171177 A1 is known (published 06 / 15 / 2017, MIC H04L 29 / 06, G06K 9 / 62, G06K 9 / 00).

[0005] The user specifies one or more items to be authenticated, and the system provides images of one or more items. When the user opens the mobile application, the camera on the mobile device is activated and takes a picture of the item in the user's field of view. If the image matches one of the item images, the user is authenticated. The system allows the user to electronically authenticate themselves using an item in the mobile application. A personal item (e.g., jewelry, keys, clothing, accessories, handbags, keychains, photographs, tools, or books). In particular, the user is authenticated when the image of the personal item is recognized as matching the reference or stored image of the personal item intended for authentication. Disadvantages: has a narrower functionality compared to the one presented by the author.Namely, we are talking only about the technology of photography, it is intended for mobile phones, does not provide for recognition based on deep learning, use outside the mobile application. In addition, a significant difference is that the User uses only one object for identification, strictly associated with the key, both secret and public. The proposed technical solution provides a fundamentally different level of functionality, which ensures full protection of the data provided.

[0006] Known is the application for invention - US 2016 / 0300046 A1 (published on 13.10.2016, IPC G06F 21 / 31, G06K 9 / 62, H04N 5 / 225), which is the closest to the proposed invention in terms of a set of essential features, accordingly adopted as a prototype. The authentication system, according to one example, includes an image capture device for scanning an object. The authentication system also includes a module for determining object deficiencies based on scanning, generating a key database based on the identified deficiencies, and authenticating a user based on a comparison of the parameters of the identified deficiencies. The module data is generated during the initial registration of the object, when the user presents the object as the desired authentication device. However, it should be noted that in some examples, the object can be selected (for example, by management) as a user authentication device.During registration, the image capture device scans or reads the object when the object is initially presented. The authentication module scans the object to detect flaws and generate data that is used to authenticate the user in the future. It should be noted that a specific user can present one or more objects as an authentication device, and model data can be generated for each object. A solution is provided in which a person can be authenticated using an object. For example, the user can provide his / her own / personal item to be used as an authentication object. The solution is based on the fact that objects of the user's choice, such as accessories (ring, bracelet, belt buckle) acquire unique flaws during the manufacturing process and daily use.These defects can be read or scanned by an image capture device to extract or identify unique wear patterns that can be stored as a template. The template is then used to recognize the object and authenticate the user. As an example, a user may want their ring to serve as an authentication device for access to a facility / building or a secure data processing system (e.g., a computer). Another object (e.g., a car key) may serve as an authentication device for another type of access (a specific room or ATM, payment device, etc.).

[0007] Disadvantages: The known solution is based on scanning technology and has a narrow applied nature. The idea is to scan the inherent shortcomings of an individual thing and identify the user on this basis.

[0008] The proposed technical solution has a different level of functionality, much broader, and is based on a different principle of key creation, which ensures full protection of the provided data.

[0009] Thus, technical problems in the area under consideration consist of limited possibilities for ensuring full protection of the provided data, since the transfer of personal user data takes place, which increases the vulnerability of the computer or server due to the fact that false information may be entered into the data from the outside, and also in the fact that authentication is complicated by the need for very high detail. The proposed technical solution is aimed at eliminating these and other problems.

[0010] The technical result is an improvement in the technical characteristics of the method, consisting in increasing the protection of the provided data, together with a simplification of the proposed method.

[0011] The technical result is achieved by the fact that in the method of control and secure access to data, which consists in the fact that on the basis of objects of the material world, including their images, electronic data of the user is created and stored in the database of the information system, which is subsequently compared with the electronic data of the user, also created on the basis of objects of the material world, which the user provides to obtain access and execute commands, and on the basis of this comparison a decision is made on granting access or executing a command, according to the invention. To ensure control and access to the information system, objects of the material world, items and images (Objects) are used. The method consists of the following stages:

[0012] During the first session of work in the information system, based on the unique data of the User - the object of the material world No. 1, selected as the basis for creating a secret key, a digital file (machine code) is created and stored in the memory of the IS, representing an Object in digital form (hereinafter referred to as "OCV");

[0013] - then the information system compares and recognizes Digital Object No. 1 in the database of Digital Objects, or creates a new OCV in the database;

[0014] - to carry out the matching and recognition procedure, the information system uses a set of image recognition algorithms, including deep learning methods using neural networks, computer vision methods based on histograms of directional gradients, scale-invariant transformations of features, etc.;

[0015] - the result of recognition will be the assignment of the OCV to a specific class from the IS database, or the creation of a new class;

[0016] - based on the data about Object in digital form No. 1, obtained as a result of the operation of recognition algorithms, a digital file (machine code) is created and saved in the information system, including the recognition results, essential features of the object, the actual digital form No. 1, and other data arrays that may be needed for further identification depending on the goals and design of the information system;

[0017] - then the IS assigns this digital file or part of this digital file as a secret key for accessing the IS resources in subsequent sessions; at this stage, additional conditions for executing other computer commands, triggers for program scripts, etc. are assigned; - during the second and subsequent sessions of work in the IS, based on the unique data of the user - Object of the material world No. 2, a digital file (machine code) is created and stored in the IS memory, representing Object in digital form No. 2;

[0018] - then the IS performs the procedure of matching and recognizing the OCV No. 2, similar to that described above, and based on the data obtained as a result of the operation of the recognition algorithms, creates and saves a new digital file (machine code), which includes an array of data with the recognition results, the essential features of the object, the OCV No. 2 itself, other arrays of data that may be needed for further identification depending on the goals and structure of the IS, and which is ultimately a potential public access key to the resources of the IS, a contender for the public key;

[0019] - in its structure, as a machine code, the potential public key will be completely analogous to the secret key (since these two keys are created on the basis of the same data processing procedure);

[0020] - then authentication occurs - the information system compares the secret and potential public keys with each other; if the comparison result gives the agreed number of matches, then the user is granted access to the resources of the information system in this session, additional commands associated with the secret key are executed, otherwise access is denied;

[0021] - in cases where keys are created by different algorithms in different information systems, identification is provided by means of special software that provides mutual definition of classes among the contents of key files, makes it possible to compare keys created by different algorithms. The essence of the proposed invention is explained by the graphic material presented in Fig. 1, where all stages of the method are shown.

[0022] Here the author considers it necessary to give some clarifications.

[0023] By "Information system" (IS) the author means a set of hardware and software tools for creating, storing, changing and searching for information, for interaction with the user. In accordance with this definition, for the purposes of the application, IS is hereinafter understood to mean both a separate computer and remote authentication servers, any combination of computers, networks, network devices, peripheral devices and executing mechanisms.

[0024] “Objects of the material world” include not only objects and images, but also any material objects - landscapes, buildings, structures, geological structures, etc.

[0025] By “Digital Object” the author means a digital file / machine code created on the basis of any devices and technologies that allow encoding and transferring to a storage medium an array of data related to the original / Object.

[0026] Such devices and technologies include emitters, receivers, analyzers and data converters across the entire spectrum of radiation and mechanical waves, capable of forming a digital file with an array of data related to an object of the material world (digital image, digital copy), as well as mechanical devices that copy the shape and other features of a material object.

[0027] In particular, such technologies are photography, video shooting, scanning, creating a digital image - a data array obtained by discretization (analog-digital conversion) of the original. Being encoded with a special algorithm and recorded on a carrier, this data array becomes a file.

[0028] Separately, it is necessary to mention the possibility of using digital twin technology - a digital model of a physical object that interacts with this object and uses data of the physical object in real time to model the behavior and monitor the operations of such an object, allowing control over the operation of such a physical object.

[0029] The key point of the invention is the combined use of recognition systems. These are traditional computer vision methods and recognition based on deep learning. Recognition is the assignment of initial data to a certain class by identifying essential features characterizing this data from the general mass of data.

[0030] The file obtained by the recognition algorithms, called by the author as OCV, created on the basis of the object of the material world, undergoes a recognition procedure, the purpose of which is to assign it to a certain class from the IS database. The result of the recognition will be the key information in the newly created file - a secret or potential public key.

[0031] Thus, in practice, this means that the user can provide as an object for creating a public key not the same object that was used to create the secret key, but an identical or similar one, and not necessarily in the same angle and lighting. For example, the user provided the IS with a green stool with a round seat to create a secret key. The recognition algorithm found a class of these stools in its database. Now, when accessing the system again, another user will show exactly the same stool. Even with deviations in shape, color, texture, etc., the IS will recognize it, assign it to the same class and make a decision on access.

[0032] If the IS does not have enough information about assigning the OCV to a certain class, the algorithm creates a new class.

[0033] Alternatively, the IS can use the OCV to create a key for computer vision recognition, creating a key based on histograms of directional gradients or scale-invariant feature transformations, for example.

[0034] The question of using a specific recognition method (based on deep learning or computer vision technology) or a combination of recognition methods in the IS is decided programmatically depending on the specific purpose of the IS. The same applies to filling the key with information. It can contain information about the class, clusters, or any other information, including histograms and essential features of the object that allow identification.

[0035] Another important note. The user creates a secret key in the IS. But the public key is not created and is not stored in the IS memory. The public key will be created in the future, after matching / recognizing the applicant's OCV and determining the OCV class.

[0036] This approach to creating keys significantly diversifies the possibilities that are opened up for users of the invention. At the same time, the highest level of protection against unauthorized access is ensured.

[0037] The invention provides for the use of objects of the material world or their images as a basis for creating keys, not necessarily the same or 100% identical! The main thing is that the recognition systems classify them as one and the same class. The importance of other significant individual features can be taken into account by software methods in different ways, depending on the User's tasks.

[0038] The proposed invention practically connects the material and digital worlds, introducing into circulation material objects, items and their images for the control of digital technologies.

[0039] Thus, with the help of the invention, a computer user can provide or receive access to data, as well as control the computer itself remotely, without using the standard computer interface. In practice (not in the sense of scientific terminology), the password / key that must be presented to initialize commands will be any object of the material world or its image - you just need to know which object is the key.

[0040] Examples of practical use of the invention: to gain access to data, a traveler takes a designated key with him on his trip. For example, a bottle of his favorite drink, a wedding ring or a pendant. By presenting the designated item or its image, the traveler will gain access to his files anywhere on the planet, without the risk of forgetting or losing secret codes, without needing an electronic device; to make a bank transaction, the user must present the device, for example, a table lamp of a special design - anywhere on the planet; to pay for a secret product, the user sends a messenger to the other end of the world with the obligation to walk in a red shirt of a special cut in a certain location; to turn off the TV, you need to show the device your slipper or something else that is always at hand at home; an unmanned vehicle can move independently, coordinating its path to the destination with map data.Simply by comparing the information from your video camera with a map or a set of landmarks; to open the lock on the front door to your apartment, or the lock on your safe, you need to show the device your hat (or the key to the apartment, or an insect, or jewelry, etc.); to automatically sort people in video surveillance systems; in this case, people with certain signs (for example, in bandanas) are taken under control, and people (say, with roses in their buttonholes) are excluded from surveillance; to get a room key or pay for a room, confirm your location, a tourist must take a photo and send an image of his hotel, a palace nearby, a mountain nearby, etc.; to obtain guaranteed access to the community's material assets, participants create an analogue of a bank letter of credit - they present the agreed objects to the IS, and access is granted to everyone at the same time; to make access to their assets as difficult as possible, the user assigns not one secret key based on an object, but a series, combination, sequence of keys. It uses both objects and images to create a key, includes time and geographic intervals and restrictions. The possibilities for using the invention are endless.

[0041] Thus, thanks to the new technical solution, users receive a fundamentally new level of data protection, as well as an effective way to manage the computer. The advantages of the invention are:

[0042] • ease of key creation and authentication;

[0043] • the practical impossibility of hacking / selecting a key, due to the infinite variety of objects in the material world, their images and their combinations when creating a key;

[0044] • no need to save digital passwords and media in any form;

[0045] • the everyday convenience of such “material encryption”, storage and transmission of keys, along with wide applicability;

[0046] • the ability to control the operation of computers and devices using objects of the material world, without using standard interfaces;

[0047] • reduction of the time spent interacting with the computer. There is no need to enter data from the keyboard, use the mouse, etc.

[0048] Thanks to the proposed technical solution, the technical characteristics of the method are improved, namely, the protection of the provided data is increased, and the simplification of the proposed method is achieved.

Claims

Invention formula 1. A method for managing and securing access to data, which consists in the fact that, on the basis of objects of the material world, including their images, electronic data of the user is created and stored in the database of the information system, which is subsequently compared with the electronic data of the user, also created on the basis of objects of the material world, which the user provides to obtain access and execute commands, and on the basis of this comparison a decision is made to grant access or execute a command, characterized in that, to ensure management and access to the information system, objects of the material world are used - objects and images, not necessarily identical (hereinafter - Objects), and consisting of the following stages: - during the first session of work in the information system, based on the unique data of the user - Object 1 - a digital file is created and stored in the memory of the information system, which represents Object 1 in digital form; - then the information system compares / recognizes the Object in digital form 1 in the database of Objects in digital form or creates a new Object (or class of Objects) in digital form in the database; to carry out the comparison / recognition procedure, the information system uses a set of image recognition algorithms, including deep learning methods based on neural networks, computer vision methods based on histograms of directional gradients, and scale-invariant transformations of features; - based on the data recognition algorithms obtained as a result of the work on the Object in digital form 1, a digital file is created and stored in the information system, which (or part of which) will be the secret key for gaining access to the resources of the information system in subsequent sessions; - this file stores an array of data related to the Object in digital form 1 - information about the class label, recognition results; - at this stage, the secret key is assigned additional functions for executing commands to the information system; - during the second and subsequent sessions of the information system, in order to gain access and execute commands, based on the unique data of the user - Object 2, a digital file is created and stored in the memory of the information system, which represents Object 2 in digital form; the information system carries out a procedure for matching / recognizing Object 2 in the database of Objects in digital form, similar to that described above; - based on the data recognition algorithms obtained as a result of the work on the Object in digital form 2, a digital file is created and stored in the information system, which will be a potential public key for gaining access to the resources of the information system; - in its structure, as a machine code, the potential public key will be completely analogous to the private key, since these two keys are created on the basis of the same data processing procedure; - then authentication occurs - the information system compares the secret and potential public keys with each other; - if the comparison result yields the agreed number of matches, then the user is granted access to the resources of the information system in this session, additional commands associated with the secret key are executed, otherwise access is denied; - in cases where keys are created by different algorithms in different information systems, identification is performed using software that ensures mutual identification of classes among the contents of key files.

2. The method according to paragraph 1, characterized in that a computer or an authentication server is used as the information system.

Images