EP3518190A1 - Method and device for multi-factor authentication - Google Patents

Abstract

The present invention relates to a method for multi-factor authentication of the identity of a user (07). In a first method step, a first and at least a second factor (01; 02) suitable for authentication are selected, which can be processed by a data processing unit as part of the multi-factor authentication. In the further method step, a first single-factor authentication is carried out, in which the first factor (01; 02) is checked for authenticity and / or integrity and the data processing unit outputs a result of the first single-factor authentication. In a further method step, a second single-factor authentication is carried out, in which the second factor (01; 02) is checked for authenticity and / or integrity and the data processing unit outputs a result of the second single-factor authentication. Furthermore, the identity of the user (07) is confirmed in one method step, provided the results of both the first and the second single-factor authentication have confirmed the authenticity of the user. Furthermore, the invention relates to a device for performing the method for multi-factor authentication.

Description

The present invention relates to a method for multi-factor authentication. Furthermore, the invention relates to an apparatus for carrying out the method for multi-factor authentication.

As is known, for authentication of entities, for example security documents, at least one so-called factor is checked, it being possible in principle to distinguish between the following three groups of factors: knowledge, possession or inherent features. Inherent features are for example biometric properties. Combining at least two factors in the review will allow for strong user authentication. In DIN ISO / IEC 29115, which describes the "Level of Assurance (LOA)", the entities are subdivided into four levels. DIN / IEC 29115 provides a framework for authenticating arbitrary entities. The LOA describes the degree of trust in the processes that lead to and include authentication. It reflects the amount of security that the entity claiming a particular identity is indeed the entity associated with the identity.

From the DE 10 2015 219 393 A1 a method for the identification of an object is known, wherein an identification feature is visible by irradiation in a defined wavelength range. The identification feature is compared with image data so that the identity and / or the authenticity of the object are checked.

The WO 2013/034603 A1 describes a method for verifying a security document with a security feature in the form of a fluorescent printing element.

From the DE 10 2014 100 463 A1 For example, a method is known which is for identifying a user using a communication device. The method provides that detected biometric features of an identification document of a user are transmitted to an electronic identification service.

In the DE 10 2016 107 250 A1 A method for multi-factor authentication and / or identification of users is described. The user is authenticated by computer input and electromyography signals.

The use of only one factor for authentication is used regularly. An authentication with another factor, that is a so-called multi-factor authentication is known in principle. At least two predefined factors are used to authenticate an identity. Multi-factor authentication, which uses multiple factors, is often complicated and not very flexible.

The object of the present invention, based on the present state of the art, is to provide a simplified method for the multi-factor authentication of a user's identity, which enables flexible multi-factor authentication.

According to the invention, the object is achieved by a method for multi-factor authentication of an identity of a A user according to the appended claim 1 and an apparatus for carrying out the method according to the attached independent claim 7 or 8.

The method according to the invention serves to identify the identity of a user by means of a multi-factor authentication. In a first method step, a first and at least one second factor suitable for authentication are selected, which can be processed or checked by a data processing unit. The at least two factors serve to authenticate the user identity and are therefore part of the multi-factor authentication. An entity can be tested by means of the method according to the invention. In a further method step, a first single factor authentication is performed by the data processing unit, wherein the first factor is checked for authenticity and / or integrity. Authenticity stands for authenticity or security, whereby, for example, the authenticity of a document is checked. A "document" may, for example, be an identification, value or security document, in particular a sovereign document, in particular a paper-based and / or plastic-based and / or electronic document, such as a passport, identity card, visa, driver's license, vehicle registration document, vehicle registration document, Health card, or a company card or the like. his.

The term integrity stands for integrity, reliability, completeness, freedom from errors, whereby, for example, a falsification of an image can be detected and thus its use can be prevented. Subsequently, in a further method step, the result of the first single-factor authentication of the first factor is output by the data processing unit. Another procedural step sees that the result of the first single-factor authentication is checked by means of a further factor, wherein the second factor is checked for authenticity and / or integrity. The further factor is checked by carrying out a second single-factor authentication with the aid of the data processing unit. Subsequently, the result of the second single-factor authentication is output. The output of the single-factor authentication takes place, for example, internally in the data processing unit to a calculation module or corresponding program unit carrying out the further step of confirming the identity of the user.

In a further method step, the identity of the user is confirmed by the data processing unit if the respective single-factor authentications of the first and the second factor have confirmed the authenticity of the user. The multiple single-factor authentication forms part of multi-factor authentication and results in a combination. If at least one of the two single-factor authentications could not confirm the identity of the applicant, an error signal can be generated and output.

In one embodiment of the method, the method is designed as a single-stage process, wherein for the multi-factor authentication, the at least two factors are subjected to a single-factor authentication and the identity of the user is confirmed after successful authentication of the factors. The multi-factor authentication can be based on a basic identity, which is for example a passport or an identity card. The method of multi-factor authentication as a one-step process is data-sparing, since only the data necessary for authentication are stored in a digital memory store. The method comprises the method steps described above.

In a further alternative method step, at least one additional identity determination factor is subjected to single-factor authentication, wherein the single-factor authentication is part of the multi-factor authentication.

Preferably, three factors undergo single authentication and are used for multi-factor authentication. More preferably, five factors undergo single authentication and are used for multi-factor authentication. Alternatively, preferably, seven factors undergo single authentication and are used for multi-factor authentication.

In an alternative embodiment, the method is designed as a multi-stage process. Authentication may be on the basis of a primal identity that needs to be verified only once, for example, by personally verifying the identity by a designated controller, as described e.g. in the so-called POSTIDENT method is possible. In a further method step, a digital ID or a digital identifier is generated from the authenticated factors or from the results of the multi-factor authentication and transmitted by the data processing unit to a secure memory area if the identity of the user, for example, as a result of the POSTIDENT authentication was confirmed.

Preferably, the secure memory area is an intelligent data memory which is protected against foreign access, so that the digital identifier is also protected and the intelligent data memory serves as a digital vault. In a further method step, a partial identity is generated from the stored digital identifier by the data processing unit at a later time. In a further method step, a third single-factor authentication is performed on the data processing unit, in which a third factor is checked for authenticity and / or integrity. Furthermore, the data processing unit issues an output of a result of the third single-factor authentication. In a subsequent method step, the result of the third single-factor authentication with the generated partial identity is combined by the data processing unit into a combined digital ID. In the further method step, the identity of the user is confirmed by the data processing unit with the aid of the combined digital ID. The described method steps ensure fast, flexible authentication of the user identity. In the example case already mentioned, POSTIDENT can once confirm the original identity and then generate a digital ID as an everyday ID, which can be used with another factor in numerous applications.

The digital identifier may be augmented with other factors that have undergone single-factor authentication. The digital identifier can be continuously extended and adapted by the user, so that the digital identifier or its security is constantly growing.

The process steps are preferably carried out several times. Preferably, the digital ID becomes a secure external memory area via a secure communication link transmitted outside the data processing unit. Preferably, at least one of the factors is checked for integrity and authenticity so as to ensure the authenticity and integrity of each factor.

In a preferred embodiment, the single-factor authentications are based on reference data.

The reference data are preferably stored or stored in a digital data memory. Particularly preferably, the reference data are stored or stored encrypted in a digital data memory. The reference data is associated with the respective factors used for authentication. For example, the reference data may be stored in an intelligent database system with intrinsic security. The storage of the reference data preferably takes place in a central memory. Alternatively preferably, the storage of the reference data takes place in a decentralized memory. The storage can take place in an external memory, for example on a remote server.

Particularly preferably, the at least two factors from different groups can be selected and classified in these. The groups to which the factors belong are possession, knowledge, trait and addition. Further groupings can be defined. Alternatively, preferably, the at least two factors from the same group are selectable and to be classified in this.

A ownership factor is assigned to the ownership group. The possession factor is an object which is in the possession of the user and is usable by the user. The ownership factor can be formed by ownership: a badge, a mobile phone, a wearable or a SmartWatch. Alternatively, the ownership factor may be another unlisted type that is in the user's possession and which is usable by the user.

A knowledge factor is assigned to the knowledge group. The knowledge factor is information that the user knows and can possibly reproduce. Alternatively, the knowledge factor is information stored in a memory or a data processing unit. The knowledge factor can be formed by knowledge: a number, a password, a gesture, an e-mail account, a social media account or the type and / or the number and / or the combination of the individual to the multimedia Factor authentication factors used. Other types of knowledge factors for the process, not listed here, may be used.

A feature factor is assigned to the characteristic group. The feature factor is a physical characteristic of the user, so authentication can not be done without the user. The feature factors preferably include characteristics of the user. The feature factor may be formed by: a user's face, a user's iris, a user's fingerprint, a user's vein, a user's muscle, a user's gait, or a user's property. Further user characteristics as feature factors are possible.

An additional factor is assigned to the group Addition. The additional factor can be formed by: a position, a history or a user behavior, or by a relationship with another identity, wherein the further identity is already authenticated.

The method according to the invention is a dynamic method, which has the advantage of a flexible choice of the factors used for the user identification by a user brings.

Single-factor authentication, and thus verification of the individual factors selected in the process, is based on specific characteristics of the factors involved. Using sensors, the specific characteristics of the respective factors can be checked. The following are examples of the respective listed factors of the various groups. Alternative authentications and / or integrity checks of the individual factors are conceivable.

The identity document as a possession factor can be checked for authenticity and authenticity (authenticity and integrity) using a near video with LED or NFC. By means of the near video, the user identity is checked, whereby a video of the ID document is created together with the user. By comparing a user photo, which is located on the identification document, with a recording of the face of the user, the review can be done. Alternatively, the user photo of the ID document may be compared with a reference image. The reference image can be stored in an internal or external memory.

Furthermore, the identification document can be checked for authenticity by means of an alternative data and security feature check (for example emission of specific radiation at a predetermined excitation). Data verification may be based on bibliographic data on the identity document.

Preferably, the factors have security features. By means of the security features, the factors of a group are distinguishable from each other. Alternatively, the factors may have several different security features.

For example, an identity document may have a security element that can be excited by an electromagnetic radiation.

The mobile phone as a possession factor can be checked by validating the SIM or the IMEI of the mobile phone using a stored reference of the SIM and / or the IMEI for comparison. In particular, device-specific features are checked. Other mobile devices can also be used as a possession factor, for example a tablet. The wearable or the smartwatch as a possession factor can be authenticated by checking the SNR (serial number of the device) or the ID of the respective device.

The knowledge factors preferably include encryptions, accounts or references. The knowledge factor number, password or a gesture of the user can be checked and authenticated by a login or a login. Preferably, encryptions are checked by entering the appropriate data and comparing with reference data. The knowledge factor e-mail account or social media account can be checked by means of the data processing unit by a link or a transmitted code. Another knowledge factor, namely the type, the number and / or the combination of the various factors that are used for the multi-factor authentication, can be compared with stored references.

The face and / or iris of the user as a feature factor can be authenticated by means of a smart live video or selfie video or a user video by comparison with a badge photograph or with badge data or with stored reference data. The feature factor fingerprint and / or veins are to be recorded by sensor recordings and compared with card data or stored reference data. The Feature factor of the user's property or gait of the user can be checked by data acquisition by means of acceleration sensors and or gyroscope and / or GPS and data comparison with a mobile terminal which acquires the required data and using reference data. A suitable mobile terminal is for example a mobile phone or a smartwatch or a wearable. Alternatively, the user's characteristics or gait can be checked by comparing reference data with data generated by video analysis of the user with a remote system or proximity system.

The position as an additional factor must be authenticated by comparing MNO and / or GPS data (geo-fencing). The additional factor history and / or behavior is to be checked by comparing the last, stored login data, the last purchases or the favorite places of the user. The additional factor guarantor and / or relationship is to be authenticated by confirmation by means of at least one further identity in real time or by means of a stored reference identity.

The detection of the respective features of the individual factors is preferably carried out with devices or devices designed for this purpose. Particularly preferably, the specific features of the individual factors are detected by means of sensors designed for this purpose.

Preferably, the single-factor authentication is performed successively. Alternatively, the single factor authentication can be performed concurrently.

Preferably, factors for the multi-factor authentication are used, which are available to the user in a timely manner.

The inventive method preferably combines classical factors and new technologies for authenticating an identity, which advantageously results in a secure method for user identification. An advantage of the method according to the invention is that there is a strong user authentication, since several factors are used for the authentication. Another advantage of the method is that the method is user-friendly and the user can freely choose the factors, their number and combination. The user can primarily use the factors and devices available to him. Alternatively preferably, the type, number and combination of factors are automatically and / or dynamically selectable. It has proved to be advantageous that the user does not need any additional or additional devices for authentication of his identity. For the purposes of this application, dynamic multifactor authentication is to be understood as meaning, in particular, multifactor authentication, in which the type and number of factors are determined dynamically for each authentication request depending on the respectively required degree of authentication. The method is therefore dynamic in the sense that the selection of the combination of features to be detected for a successful authentication of the user takes place upon receipt of the authentication request. In contrast to a static method, the selection can therefore take place individually, ie dynamically, for each authentication request. In particular, the selection for identical authentication requests may be different. This increases the safety of the process. Even if the metrics necessary for successful authentification in a first authentication request were to be transferred to the hands of an unauthorized party due to theft and / or tampering, it can not succeed even if the authentication request is identical authenticate when the combination of features to be detected changes dynamically. Furthermore, for example, the selection can be adapted or changed as a function of changed framework conditions or detection of irregularities (such as, for example, a request from a terminal other than usual).

For automatic selection of factors and their combination, number and type, a calculator can be used. Default values for the type, number and / or combination of the factors are preferably fed to the data processing unit. The verification of authenticity and / or integrity can also be called verification.

The device according to the invention is designed to execute the above-described method for multi-factor authentication of a user's identity on the basis of two factors with security features. The device comprises at least one sensor which serves to detect the security features of the factors. The sensor may be an image sensor, a motion sensor or accelerometer, a biometric sensor, or a position sensing sensor. Other types of sensors may be used in the multi-factor authentication device. The sensor is designed to detect a signal of the security feature. Furthermore, the device comprises a data processing unit. The data processing unit receives the signal detected by the sensor. Furthermore, the data processing unit subjects the detected signal to a single-factor authentication to confirm the identity of the user, if the results of both the first and the second single-factor authentication confirm the authenticity of the user.

An image sensor can be integrated in an image acquisition unit for taking a picture, an image series or a video his. The image acquisition unit is, for example, a camera. The motion sensor or acceleration sensor is preferably designed to record a movement or a gait of a user. Preferably, the biometric sensor is a sensor for receiving a fingerprint of the user. Alternatively preferably, the biometric sensor is a sensor designed to receive the iris of the user. Furthermore, the biometric sensor may be configured to detect the muscle activity of the user.

In an alternative embodiment, the device for multi-factor authentication of a user's identity on the basis of a security document with user data and / or a security feature that reacts to electromagnetic radiation comprises an image acquisition unit, a lighting unit and a data processing unit. The image capture unit is used to capture an image, a series of images or a video of the security document, wherein a signal or data record is generated, which serves to authenticate a first factor. The signal or the data record, which, for example, reflects a photograph of the security document, serves to authenticate the user identity. The image acquisition unit may include one or more sensors. The lighting unit is designed to generate electromagnetic radiation. The illumination unit is to be arranged opposite the security document such that the electromagnetic radiation radiates to the security document, in particular to the security feature. The security document can receive the electromagnetic radiation and is stimulated to react or to luminescence. The data processing unit is used to perform a first single-factor authentication of the first factor based on the image, the image series or the video of the user data with stored reference data.

Furthermore, the data processing unit is used to carry out a second single-factor authentication on the basis of the luminescence-stimulated security feature.

The second single-factor authentication preferably takes place on the security document by means of the image, the series of images or the video of the security feature excited for luminescence by comparison with a reference value of the excited security feature. Furthermore, the data processing unit serves to confirm the identity of the user, if the results of the single-factor authentication confirm the authenticity of the user.

Preferably, the lighting unit is spaced from the security document to order. The lighting unit is preferably an LED light. Preferably, a security feature is applied to the security document. Preferably, the security feature is a luminescent material which can be excited by electromagnetic radiation for photoluminescence. The security feature may be formed as a pattern. Preferably, the security feature is at least partially overlapping on a user photograph located on the security document.

Preferably, the device for carrying out the method for multi-factor authentication is a mobile terminal. Alternatively, the device for carrying out the method for multi-factor authentication is preferably a tablet. Particularly preferably, the device for carrying out the method for multi-factor authentication is a smartphone. The lighting unit may be a flash function of the mobile terminal. Preferably, the lighting unit is an LED light of a smartphone, with the LED light, a flash function of a camera is executable. The output of the result of the multi-factor authentication is preferably via a display or a monitor of the device, in particular of the mobile terminal. The output of the result of the multi-factor authentication is alternatively preferably via an acoustic interface of the device, in particular of the mobile terminal.

• Figur 1 eine Anordnung zur Ausführung eines erfindungsgemäßen Verfahrens zur Multi-Faktor-Authentifizierung einer Identität eines Anwenders.
• Figur 2 zeigt eine Anordnung zur Ausführung eines alternativen Verfahrensschritts des Verfahrens.
• Figur 3 zeigt eine tabellarische Aufstellung einer Anzahl möglicher Faktoren für die erfindungsgemäße Auswahl.

Further advantages and details of the present invention will become apparent from the following description of preferred embodiments, with reference to the drawings.

• FIG. 1 an arrangement for carrying out a method according to the invention for multi-factor authentication of a user identity.
• FIG. 2 shows an arrangement for carrying out an alternative method step of the method.
• FIG. 3 shows a tabulation of a number of possible factors for the selection according to the invention.

FIG. 1 shows a greatly simplified representation of an arrangement for carrying out a method step of a method according to the invention for multi-factor authentication of a user identity (in FIG. 2 shown), which is carried out with a device according to the invention. In this case, the device is a mobile terminal, in particular a smartphone 01 of the user. The smartphone 01 includes a camera (not shown) and a lighting unit (not shown) associated with the camera. The camera of the smartphone 01 can be used to take a picture, a series of pictures or a video from an identity card 02. The identity card 02 is a security document which is assigned to a user 07. The identity card 02 includes not only a photo 03 or photo of the user 07 but also his personal data 04. Furthermore, the identity card 02 comprises at least one security feature 06. The security feature 06 may be a luminescent material applied to the identity card 02, which can be excited by electromagnetic radiation for photoluminescence. The electromagnetic radiation can be generated by the illumination unit, for example an LED light, of the smartphone 01. To prevent falsification of the identity card 02, the security feature 06 is at least partially integrated into the photo 03 located on the identity card 02, for example by using luminescent pigments in a transparent protective layer covering the photo. This ensures the trustworthiness, integrity, identity card 02. The verification of the authenticity, ie the authenticity, is carried out by checking the security feature 06 on the identity card 02, wherein the security feature 06 is measured, for example.

The verification and single-factor authentication of the security feature 06 as a first factor reflects a method step of the multi-factor authentication of the method according to the invention. As a further single factor, which serves the multi-factor authentication and is subjected to a single factor authentication, the personal data 04 of the user can be checked. The personal data 04 or biographical data of the user 07 can be compared with reference data stored on a computer. The identity card 02 is in the possession of the user and is a possession factor which can be used for the multi-factor authentication.

Another possession factor is the smartphone 01 of the user, which can also be used in a further process step for multi-factor authentication. The single authentication of the smartphone 01 can by means of verification the device number with a stored reference number.

The multi-factor authentication described above is done by means of two ownership factors. If both factors are authenticated, the identity of the user is considered confirmed.

Fig. 2 shows an alternative method step of the method for multi-factor authentication, wherein the user 07 with a, in his possession, smartphone 01 and his ID card 02 performs a multi-factor authentication. The verification of the authenticity and integrity of the identity card 02 and the smartphone 01 done, as to Fig. 1 Further, a single authentication of the user 07 with the ID card 02, wherein the user 07 with the camera of the smartphone 01 generates a live video is carried out on the basis of a security feature 06 of the ID card 02 and the device number of the smartphone. Subsequently or in real time, the face of the user 07 is compared to the live image with the photo 03, which is located on the identity card 02.

In the in Fig. 2 The methods shown use three factors for multi-factor authentication. Once all three factors have been authenticated, the identity of the user is confirmed.

LIST OF REFERENCE NUMBERS

01

Device / mobile terminal

02

The security document

03

photo

04

personal data

05

-

06

safety feature

07

user

Claims (10)

Method for multi-factor authentication of a user's identity (07), comprising the following steps: - selecting a first and at least one second factor (01, 02) suitable for authentication, which can be tested by a data processing unit, as part of the multi-factor authentication; Performing a first single-factor authentication on the data processing unit, wherein the first factor (01; 02) is checked for authenticity and / or integrity and the data processing unit outputs an output of the first single-factor authentication; Performing a second single-factor authentication on the data processing unit, wherein the second factor (01; 02) is checked for authenticity and / or integrity and the data processing unit issues an output of a result of the second single-factor authentication; and - Confirmation of the identity of the user (07) by the data processing unit, if the results of both the first and the second single-factor authentication have confirmed the authenticity of the user. The method of claim 1, further comprising the steps of: Transmitting the result of the multi-factor authentication as a digital ID (identifier) by the data processing unit in a secure memory area if the identity of the user (07) has been confirmed; - generating a partial identity from the stored digital ID by the data processing unit at a later time; Performing a third single-factor authentication on the data processing unit, in which a third factor (01; 02) is checked for authenticity and / or integrity and the data processing unit issues an output of a result of the third single-factor authentication; Combining the result of the third single-factor authentication and the generated partial identity by the data processing unit into a combined digital ID; - Confirmation of the identity of the user (07) by the data processing unit using the combined digital ID. Method according to one of claims 1 or 2, characterized in that the method step is carried out several times with further factors (01; 02). Method according to one of claims 1 to 3, characterized in that the data processing unit default values for the type, number and / or combination of factors (01, 02), which are subjected by the data processing unit of a single-factor authentication, are fed. Method according to one of claims 1 to 4, characterized in that the factors which are subjected by the data processing unit of a single-factor authentication are selected from - the following list: - security document (02), mobile communication unit (01) with stored identification data, - stored on a remote server, - user-related files; - history of application data; - Relationship to an already authenticated identity. Method according to one of claims 2 to 5, characterized in that the digital ID is transmitted via a secure communication connection to a secure external memory area outside the data processing unit. Apparatus for carrying out the method according to one of claims 1 to 6 for the multi-factor authentication of a user's identity on the basis of two factors (01, 02) with security features (06), comprising at least one sensor for detecting the security features of the factors, wherein the sensor can be selected from the following list: - image sensor, - Biometric sensor, Motion sensor or acceleration sensor, Position detection sensor, and wherein the sensor is for detecting a signal of the security feature (06);
further comprising a data processing unit, which the receives signal detected by the sensor and subject each to a single-factor authentication to confirm the identity of the user, if the results of both the first and the second single-factor authentication confirm the authenticity of the user. Apparatus for carrying out the method according to one of claims 1 to 6 for the multi-factor authentication of a user's identity on the basis of a security document with user data and / or a security feature that reacts to electromagnetic radiation, comprising: an image-capturing unit for capturing an image, an image series or a video of the security feature of the security document, wherein the image, the image series or the video serve for authentication of a first factor; a lighting unit configured to generate electromagnetic radiation which can be received by the security feature of the security document and excited to respond; and a data processing unit for carrying out a first single-factor authentication of the first factor based on the image, the image series or the video of the user data with stored reference data, and for carrying out a second single-factor authentication of a second factor on the basis of the luminescence-stimulated security feature, to confirm the identity of the user, provided the results of the single-factor authentication confirm the authenticity of the user. Apparatus according to claim 8, characterized in that the device is a mobile terminal, in particular a smartphone. Computer program comprising program code means for carrying out all the steps of a method according to one of claims 1 to 6, when the computer program is executed on a data processing unit.

Images