Secure biometric verification of identity

Abstract

A high security identification card includes an on-board memory for stored biometric data and an on-board sensor for capturing live biometric data. An on-board processor on the card performs a matching operation to verify that the captured biometric data matches the locally stored biometric data. Only if there is a positive match is any data transmitted from the card for additional verification and/or further processing. Preferably, the card is ISO SmartCard compatible. In one embodiment, the ISO SmartCard functions as a firewall for protecting the security processor used for storing and processing the protected biometric data from malicious external attack via the ISO SmartCard interface. In another embodiment, the security processor is inserted between the ISO SmartCard Interface and an unmodified ISO SmartCard processor and blocks any external communications until the user's fingerprint has been matched with a previously registered fingerprint. Real-time feedback is provided while the user is manipulating his finger over the fingerprint sensor, thereby facilitating an optimal placement of the finger over the sensor. The card may be used to enable communication with a transactional network or to obtain physical access into a secure area.

1 .- 25 . (canceled) 
     
     
         26 . A smart card comprising:
 an on-board security processor that is communicatively coupled with an on-board sensor, wherein the sensor operates to receive real-time input data from a user, and the security processor operates to authenticate the user according to the real-time input data; and   an on-board communications processor that is communicatively coupled with an on-board communications interface to provide communications between the communications processor and an external smart card reader,   wherein the security processor is functionally separated from the communications processor by a firewall, thereby blocking direct communications between the security processor and the communications interface.   
     
     
         27 . The smart card of  claim 26 , wherein the sensor is a biometric sensor, and the real-time data is real-time biometric data. 
     
     
         28 . The smart card of  claim 26 , wherein:
 the security processor comprises a data store having template data associated with a previously authorized user stored thereon; and   the security processor operates to authenticate the user by applying the real-time input data to the template data.   
     
     
         29 . The smart card of  claim 28 , wherein the security processor operates to:
 apply the real-time input data to the template data by performing a matching operation between the template data and input data; and   transmit a verification message to the communications processor if the matching operation yields a positive result.   
     
     
         30 . The smart card of  claim 29 , wherein the firewall operates to allow only the verification message to be communicated from the security processor to the communications processor. 
     
     
         31 . The smart card of  claim 26 , wherein the firewall permits communications from the security processor to the communications processor and blocks all communications from the communications processor to the security processor. 
     
     
         32 . The smart card of  claim 26 , wherein the communications processor is an ISO SmartCard processor. 
     
     
         33 . The smart card of  claim 26 , wherein:
 the external smart card reader is an ISO card reader; and   the communications interface comprises an ISO contact pad via which the communications processor communicates with the ISO card reader.   
     
     
         34 . The smart card of  claim 26 , wherein:
 the external smart card reader is an ISO card reader; and   the communications interface comprises an ISO antenna that operates to establish contactless communications between the communications processor and the ISO card reader.   
     
     
         35 . The smart card of  claim 26 , further comprising:
 a security antenna that provides wireless power to at least the security processor.   
     
     
         36 . The smart card of  claim 35 , further comprising:
 a data antenna that provides wireless data communications between the communications processor and the external smart card reader,   wherein the data antenna is physically separated from the security antenna, such that provision of wireless power to the security processor by the security antenna does not permit wireless data communications with the security processor.   
     
     
         37 . The smart card of  claim 26 , wherein the sensor is one of a fingerprint scanner, a voice recognizing microphone, a camera, or a bioassay tester. 
     
     
         38 . A method comprising:
 receiving real-time input data from a user via a sensor disposed on a smart card and coupled with a security processor disposed on the smart card;   authenticating the user by the security processor according to the real-time input data; and   communicating between a communications interface and an external smart card reader in accordance with the authenticating,   wherein the communications are directed by a communications processor disposed on the smart card, and the security processor is functionally separated from the communications processor by a firewall, thereby blocking direct communications between the security processor and the communications interface.   
     
     
         39 . The method of  claim 38 , wherein:
 the authenticating comprises matching the real-time input data against template data stored by the security processor.   
     
     
         40 . The method of  claim 39 , further comprising:
 transmitting a verification message from the security processor to the communications processor when the matching yields a positive result.   
     
     
         41 . The method of  claim 38 , wherein the firewall permits communications from the security processor to the communications processor and blocks all communications from the communications processor to the security processor. 
     
     
         42 . The method of  claim 38 , wherein:
 the external smart card reader is an ISO card reader; and   the communications interface comprises an ISO contact pad via which the communications processor communicates with the ISO card reader.   
     
     
         43 . The method of  claim 38 , wherein:
 the external smart card reader is an ISO card reader; and   the communications interface comprises an ISO antenna that operates to establish contactless communications between the communications processor and the ISO card reader.   
     
     
         44 . The method of  claim 38 , further comprising:
 a security antenna that provides wireless power to at least the security processor.   
     
     
         45 . The method of  claim 44 , further comprising:
 a data antenna that provides wireless data communications between the communications processor and the external smart card reader,   wherein the data antenna is physically separated from the security antenna, such that provision of wireless power to the security processor by the security antenna does not permit wireless data communications with the security processor.